Privacy Policy
Last updated 2 October 2026
1. Who operates this site
Open-Source-Lab operates this model catalogue and the Open-Source-Lab Playground at playground.open-source-lab.com. The catalogue does not require an account. The Playground can be used as a guest or with an account. For privacy questions or requests, contact info@open-source-lab.com.
2. Notice at collection
Categories and sources. The site receives your IP address and technical request details when your browser makes a request. When you use save or compare, the application stores a keyed digest of that IP address, the model identifiers you select, and a last-updated time.
Playground data. Guest Playground requests use a keyed digest of the public IP address received with the request, plus chat character totals and timestamps, to apply shared limits of 30,000 characters per rolling 5 hours and 300,000 characters per rolling 7 days. Guest sessions using the same public IP address share those limits. Email account creation collects an email address, a password hash, and the time and policy version accepted. ChatGPT sign-in users are asked to accept once on their first Playground visit, and that acceptance is stored with their Playground user identifier. When you use the Playground, your chat messages are sent to the model provider you select.
Purposes and retention. We use this information to provide saved and compared model lists, run the Playground, apply guest usage limits, and operate and protect the services. Catalogue lists expire after 365 days without an update. Guest Playground usage records are deleted after 7 days. Account chat history follows the retention setting shown in the Playground; you can also delete chats or account data there.
Recipients and sale or sharing. Hosting and database providers, model providers selected for a chat, the email delivery provider used for account verification, and Stripe when you choose a paid plan may receive information needed for their services. We do not sell or share saved model selections for cross-context behavioral advertising. Privacy rights and requests are explained below.
3. Information processed
Saved and compared models. When you save a model or add it to comparison, the site stores the model identifiers you select and a last-updated time. It does not store chat prompts, API keys, or model responses.
Playground chats and accounts. To generate a response, the Playground sends your message and the conversation context needed for that request through its server to the model provider you select. Guest chat history is kept in your browser and is not saved to the Playground account database. If you sign in, chat history and settings can be saved to the Playground database and follow your retention and deletion controls. Provider API keys saved to an account are encrypted at rest. Guest keys remain in browser memory between requests and are sent to our server when needed to retrieve models or route your chat; they are not saved to the account database.
If you create an email account, the Playground stores your email address, a salted password hash, account and verification details, and a record of the privacy policy version and time you accepted at signup. Sign-in with ChatGPT uses identity information supplied by that platform. The Playground does not receive your ChatGPT password.
IP address and saved-list key. The hosting network receives your IP address when your browser requests a page or uses the saved-list feature. The application uses the IP address supplied with that request to create a keyed digest. It stores the digest with the selected model identifiers and last-updated time. The application database does not store the raw IP address. A keyed digest is pseudonymous and may still be personal information under applicable law.
Guest usage identifier. When you use guest chat, the Playground derives a keyed digest from the public IP address supplied by the hosting network. It stores that digest with each usage event's timestamp and input and output character counts so all guest sessions from the same public IP address share the 5-hour and 7-day limits. The usage table does not store the raw IP address or guest chat text. These records are deleted after 7 days.
Technical request data. Our hosting and network providers process request information, including IP addresses and basic connection details, to deliver and protect the site. Their processing is governed by their service terms and privacy information.
4. How we use this information
We use the IP-derived key and model identifiers to provide the save and compare features across visits. We use technical request information to operate, maintain, and protect the site. We do not use saved model selections for advertising or cross-site profiling.
We use the guest usage digest and character counts only to apply per-IP chat limits, detect misuse, and maintain the Playground. Model providers process chat content to return responses under their own terms and privacy practices.
Where the GDPR applies, we limit processing to these stated purposes. The save and compare processing responds to the feature you choose to use. Security and service operations may rely on legitimate interests where permitted by law. We assess other lawful bases as required for the particular processing and location.
5. How IP-based lists work
Saved and compared models are associated with the public IP address used for a request, through a keyed digest. An IP address can change over time or be shared by people on the same network. People whose requests use the same public IP address may see the same saved and compared lists. If your public IP address changes, a previously saved list may no longer appear. The saved-list feature uses a network address, which can represent multiple people.
You can remove the lists associated with your current IP address by choosing Clear in the catalogue. If you cannot access a previous list because your IP address changed, email us with your request.
6. Service providers and external links
The catalogue and Playground serve their fonts, icons, and brand images from their own sites. Loading a page does not make a separate request to Google Fonts or Poe's image delivery network. Hosting and database providers still process technical request data to deliver and protect the Services. Model and community links open independent services when you choose them. Stripe processes checkout and payment information if you choose a paid Playground plan. Each external service has its own privacy practices.
7. Retention and security
Saved and compared lists expire after 365 days without an update and are removed when the saved-list service next processes a request after that period. You can also clear them at any time. Clearing data removes the list associated with the IP address used at that time. Guest chat usage events are deleted after 7 days, with an hourly cleanup job. Account chat history follows the retention setting you choose in the Playground. Hosting providers may keep technical request records under their own retention practices.
The IP-derived key is generated with a secret held by the site service. We use HTTPS for connections. No internet service can guarantee absolute security, so please do not treat a saved list as confidential when using a network shared with other people.
8. Privacy rights
Depending on your location and the law that applies, you may be able to request access to, correction of, or deletion of personal information, or object to or restrict some processing. You may also have the right to complain to your local data protection authority. Use Clear to delete the lists linked to your current IP address, or email info@open-source-lab.com for another request. We may ask for information reasonably needed to locate and verify a request.
Where the California Consumer Privacy Act, as amended by the CPRA, applies, California residents may have rights to know, access, correct, and delete personal information, and to opt out of its sale or sharing. We do not sell or share saved model selections for cross-context behavioral advertising. Applicability and available rights depend on the law and the circumstances.
9. Cookies and similar storage
The catalogue does not set first-party cookies. Guest access to the Playground uses a required, host-only cookie to remember that you accepted this policy. It is HttpOnly, Secure over HTTPS, SameSite=Lax, and expires after one year; it contains a signed policy version and is not used for advertising or analytics. Email account signup stores the accepted policy version and time with the account instead, so the consent prompt is not repeated at each sign-in. A previous catalogue version stored saved lists in browser local storage; see the Cookie Policy for details.
10. Children
This catalogue is intended for a general audience and is not designed to collect personal information from children. Contact us if you believe a child has provided personal information through this site.
11. Changes to this policy
We will update this page when our data practices change. The current version describes the Playground's guest consent cookie, account signup acknowledgement, and IP-based guest usage limits.
12. Official legal references
13. Contact
Send privacy questions and requests to info@open-source-lab.com.