Data controls in the workspace sidebar separates optional request text from the operational metadata shown in Usage. Only the organization owner can change text capture or read retained text. Administrators can still troubleshoot request metadata in Diagnostics under their existing permissions.
Two independent retention policies
| Data | Policy |
|---|---|
| Usage metadata | Request ID, model, status, token counts and timing follow the existing Usage retention setting. Turning text capture off does not delete this metadata. |
| Provider key activity | Provider key connected, rotated and removed events follow the Usage retention setting, but are kept for at least 365 days, so a short usage period never erases the key audit trail. They never contain the key. |
| Request content | Optional bounded request and response text is stored encrypted. Capture is off by default and requires the owner's explicit opt-in. It has its own expiration. |
Pay-as-you-go organizations can opt in for 1–7 days. Pro (subscription) is zero data retention: it prohibits content capture and content reads, even if an older enabled flag exists. Enterprise starts with zero data retention; its owner can opt in to a bounded period of up to 90 days. Moving an organization to Pro or Enterprise turns capture off and deletes retained text. See Plans.
Changing these settings does not change your plan.
Accounting evidence
The Usage retention setting and content cleanup never delete accounting evidence. These records have no automatic expiry and are kept for as long as Token Streamer operates the service:
| Record | Contents |
|---|---|
| Credit ledger entries | Purchases, usage charges, and reversals, with token counts and price version. |
| Request outcomes | The final or pending state of each funded request. |
| Credit corrections | Any correction made by Token Streamer support, with its reason and amount. |
None of these records stores prompts, completions, provider keys, or customer API keys. Deleting an organization keeps them, because the ledger must still reconcile. Backups follow separate retention controls.
Opt in or turn capture off
Open Data controls, select I consent to retaining bounded request and response text, choose a period, and select Save content policy. Changes apply to future requests using persistent organization API keys. Temporary model-test requests are metadata-only.
Capture is best effort, saved after the response is sent, and limited to 16 KiB (16,384 bytes) of UTF-8 request text and the same for response text. Either field can be truncated. Missing content can mean capture was off, delivery failed, the request had no eligible text, or retention expired. Retained text is not a full request-body replay. Request headers, image/audio/video bytes, binary data and tool arguments are excluded by text-only capture.
Token Streamer also redacts recognizable API tokens, Bearer credentials, private-key blocks and obvious secret-field values. Media data URIs are removed. Detection cannot identify every sensitive value in arbitrary text. Redaction can shorten or truncate a record, and does not make captured content public.
Turning capture off immediately purges existing content across all organization regions. Re-enabling creates a new policy start timestamp; delayed reports from before that timestamp cannot restore purged text. Shorter periods hide older text immediately and remove it. Longer periods do not extend the original expiration of existing records or recover deleted content. Expiration runs from the original request receipt, rather than the later report arrival.
Expired content is unavailable immediately, before physical cleanup. Cleanup then removes expired content, and content from disabled or deleted organizations. Backups follow separate retention controls.
Inspect one request
In Diagnostics, the owner can expand a request and choose Inspect retained text. The dialog fetches content only after that action; page props and metadata lists contain no plaintext or encrypted payload. Content remains scoped to the organization, currently selected workspace region, active capture policy and current retention bounds. Closing the dialog clears its content and cancels pending reads. Subscription, expired, deleted, unrecorded and out-of-scope records return the same unavailable result (content_not_available).
The original API key's region governs which text can be captured. Changing the workspace region does not change an existing key's region. For example, an EU key may still report EU text after the workspace switches to the US; switch back to Europe to inspect it. The text expiration remains unchanged.