Trust and privacy

If you rent

• Hosts never see your account, email or key. They get the prompt text and nothing that says who sent it. You never see which host ran a job.
• Ballast deletes prompt and reply text when a job ends. The request is erased at that moment and streamed pieces are removed within about a minute.
• What stays is the model, token counts, price, the host that ran it, timing and status. That is what billing, your usage page and spot checks need.
• You confirm all this once, before your first key is created.

If you host

• The client runs no renter code. It passes prompt text to Ollama as data, accepts only catalog models and rejects any job field it does not recognise.
• It opens no listening port and writes no prompt text to its logs.
• It holds no database credential and no Ballast secret. It has one device token, which you can revoke from the dashboard.
• Uninstalling removes the client, its service and the token and leaves Ollama and its models where they were.

What this does not cover

Spot checks prove a host gives right answers. They do not stop a host from reading what arrives on its own machine. Nothing in Ballast encrypts a prompt from the host that runs it. If that matters for your data, do not send it.

More

The full policy is on the privacy page. Payments run in Stripe test mode, and payouts are test payouts. To delete your account, see account deletion. For anything else, use Support.