This analysis describes what OpenRouter's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated policy raises the minimum age to use OpenRouter from 13 to 18 years old, meaning users under 18 are no longer eligible. For users who upload files through the Files API feature, the revised terms establish specific handling procedures: files are encrypted at rest and in transit, transmitted to model providers you select, retained until deletion or account closure, and not used for training or marketing purposes. The policy specifies that access is restricted to automated systems necessary to operate the service, and manual access occurs only for investigating violations, responding to legal process, or providing support. You can delete uploaded files at any time, which triggers removal efforts from active systems and backups within timeframes specified in the Data Processing Agreement.
View change record →How other platforms handle this
We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.
We keep some data until you delete your Google Account, such as information about how often you use Gemini Apps.
We may retain your Personal Data for a period of time consistent with the original purpose of collection...or as long as required to fulfill our legal and/or regulatory obligations.
"When your account is deleted, all associated personal data is deleted, unless we are required to maintain it for regulatory and compliance purposes or for a legal or business necessity.Excerpt from OpenRouter's Privacy Policy
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The clause states: “When your account is deleted, all associated personal data is deleted, unless we are required to maintain it for regulatory and compliance purposes or for a legal or business necessity.”
ConductAtlas has identified this type of provision across 275 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenRouter.