Trust & data practices
What Veezee stores, how it's protected, and how to leave.
What we store#
We keep request and response bodies to support idempotent replay: if you retry a call with the same Idempotency-Key, you get back the exact stored result instead of a second charge. Bodies are kept for up to 30 days and are size-capped. Ledger events (the record of what was charged and when) are kept indefinitely, since they're your billing record.
Telemetry#
Operational telemetry uses opaque, hashed identifiers, never raw account or request data. We don't put personal information in telemetry.
Keys#
API keys are shown to you exactly once, at creation. We store only a hash of the key, not the key itself.
Authentication#
REST and the CLI use API keys only, no OAuth. MCP clients that support the MCP authorization spec (Claude Code, claude.ai, ChatGPT developer-mode connectors, and others) connect via a real OAuth flow instead: an unauthenticated request gets a 401 with OAuth discovery, and a compliant client opens a Veezee sign-in with no key involved. Full reference: /auth.md.
Billing and cancellation#
Paid plans are self-serve through Stripe. To change or cancel: ask your agent for its manage link (the free get_usage tool returns manage_url), or paste your API key at /manage. Either opens the Stripe billing portal for your account. Flex packs are one-time purchases; nothing recurs, so there is nothing to cancel.