Privacy Policy

Last updated 21 October 2026.

Tokenlifter is a product of Flow Fuser: Flow Fuser Yazılım ve Danışmanlık Hizmetleri, tax number 8410647162, Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe / İstanbul, Turkey. Flow Fuser is the data controller for Tokenlifter. This policy explains what we do with your data.

What we process

• Your account: email address, password (stored only as a hash), sign-in records and API keys (stored only as a hash).
• What you send us to score or check: prompts and texts. They are processed to answer your request and not stored; we keep the score, the findings and a SHA-256 fingerprint of the input.
• Usage: how many tokens each request used, when, and with which key; for billing and to enforce quotas.
• Messages you send through the contact form.
• Security records: IP addresses and important account actions.

Who else processes it

• Prompts you ask us to score are sent to Anthropic's Claude API (United States) to produce the score. Anthropic does not use API data to train its models under its commercial terms.
• Our servers are in Turkey. Data sent from the European Union is transferred there and to the United States under standard contractual clauses.
• Payments are handled by Lemon Squeezy, our reseller and merchant of record. Your card details go to Lemon Squeezy, never to us; we receive the state of your subscription and the last four digits of the card.

How long we keep it

Account data as long as the account exists. Billing records as long as tax law requires. Security records for up to two years.

Your rights

You can ask for a copy of your data, its correction or deletion, including deleting your account, and object to its processing, under the GDPR and Turkey's data protection law (KVKK). Write to us through the contact form from your account's email address; we answer within 30 days. You can also complain to your data protection authority.

Do not send secrets

Do not put passwords, keys or other people's personal data into prompts you send us. The command-line tool masks common secrets before sending, but it cannot catch everything.