Data retention and privacy

Infrared keeps the content of a moderation only as long as you tell it to. You set the number of days for a project, and you can switch storage off for a project, a template or a single request.

Scores and decisions are kept for good, because your usage history and your record of decisions are built on them. What expires is the content they were made from.

To keep one submission out of storage, send store: false with it:

curl https://api.useinfrared.com/v1/moderations \
  -H "Authorization: Bearer $INFRARED_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "text",
    "input": "Selling my road bike, barely used. Message me here for more photos.",
    "content_id": "post_8842",
    "store": false
  }'

const response = await fetch("https://api.useinfrared.com/v1/moderations", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.INFRARED_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    type: "text",
    input: "Selling my road bike, barely used. Message me here for more photos.",
    content_id: "post_8842",
    store: false,
  }),
});

const moderation = await response.json();

import os
import requests

response = requests.post(
    "https://api.useinfrared.com/v1/moderations",
    headers={"Authorization": f"Bearer {os.environ['INFRARED_KEY']}"},
    json={
        "type": "text",
        "input": "Selling my road bike, barely used. Message me here for more photos.",
        "content_id": "post_8842",
        "store": False,
    },
)

moderation = response.json()

{
  "object": "moderation",
  "id": "mod_35IFx06NBKLh5RF01PzYwL",
  "status": "completed",
  "flagged": false,
  "recommendation": "allow",
  "content_id": "post_8842",
  "created_at": "2026-10-08T08:46:39.646Z",
  "completed_at": "2026-10-08T08:46:41.065Z"
}

The answer is the same as for any moderation. The text was screened and written nowhere.

How long content is kept

Each moderation gets a removal date when it is created: the project's Retention setting in days, counted from that moment and never above the plan's limit.

The date is stamped on the moderation, so:

• A change of plan never removes stored content early, and an upgrade does not bring back what was never stored.
• Changing Retention in Settings, Project does move the date of everything the project still holds. A shorter period is applied by the next nightly purge.

The Live console shows the state of each moderation under Content: kept until a date, not stored, or removed on a date.

Four switches, one rule

Content is stored only when all four of these allow it:

1. The plan stores content.
2. The request does not send store: false.
3. Store inputs is on in the project's settings.
4. Store inputs is not set to Off in the template's run settings.

Any one of them is enough to stop storage. A template set to On does not override a project that is off.

What is stored and what is not

"Not stored" covers the input and the media. The rest of the moderation is still written.

The removal date itself differs. On a plan that stores no content it is the moment of creation, so the evidence goes with the next nightly purge. With store: false or Store inputs off on a paid plan, it is the project's full retention period.

A moderation whose input was not stored has no preview in the dashboard and cannot be run again: POST /v1/moderations/{id}/remoderate answers 409 input_not_stored.

What the purge removes

A purge runs every night. For each moderation past its date it:

• deletes the stored images, originals and blurred copies;
• clears the input, the response body, the decision snapshot and metadata;
• clears what each policy matched: the quoted spans, the masked text and the explanations.

What remains is the record that a decision was made: the id, the template and its version, the score of every policy, the verdict, the recommendation, the reasons, your content_id, the author and the timestamps. GET /v1/moderations/{id} still answers with those, and with metadata set to null. Usage totals never change.

Other places content appears

For content that must leave as little behind as possible, send store: false and turn Cache results off for the project or the template.

The Free plan

The Free plan stores no input and no media. The response body, with the evidence it quotes, stays on the moderation until the next nightly purge and in the webhook event log for 30 days.

Images in the dashboard

For every stored image Infrared also keeps a blurred copy, and the dashboard shows that copy first. Opening the original takes a deliberate click by someone who can work the review queue, and every reveal is written to the audit log.

The API never returns the stored input or a link to a stored image.

Personal data in a response

The personal_data policy finds emails, phone numbers, card numbers, IBANs and national ids, and street addresses when the template asks for them. Where a template turns it on, the response carries the text with each match masked. This comes from a review that gave a phone number:

{
  "details": {
    "personal_data": {
      "labels": ["phone"],
      "matches": [{ "label": "phone", "value": "+44 7700 900123", "start": 40, "end": 55 }],
      "masked_output": "Great seller, fast delivery. Call me on +44***23 if you want the same deal.",
      "field": "body"
    }
  }
}

masked_output is there for you to publish or to log. It does not redact the response: matches carries the original values. The basic check does not include this policy. Policy options lists the kinds a template can choose.

Asynchronous requests

An image is screened after the request has answered, so its input has to wait somewhere. When the moderation is not stored, the input is held only while the status is screening, and it is cleared the moment the run ends or fails.

Deleting an account

Deleting your account, in Settings, Profile, erases your sign-in, your profile and every invitation that was sent to your address. It cannot be undone.

• An organisation where you are the only member is erased with its projects, moderations, stored images, authors, keys and audit log. Its plan ends at once, and its billing account with the payment provider is deleted with the cards saved in it. The provider keeps the invoices the law requires, so download the ones you need first.
• An organisation with other members is left to them. Its records of what you did (decisions, notes, audit log rows) stay, without your name, your email address or your IP address. If you set up its billing, the billing contact passes to an Owner who stays.
• If you are the only Owner of an organisation that other people work in, make one of them an Owner or remove them first. The dashboard tells you which organisations this applies to.

Next

• Organisations and projectsAn organisation holds the plan and the people. A project holds what a request touches: templates, keys, the review queue and its own settings.
• Audit logA record of who changed what in your organisation: templates, keys, members, queue decisions and billing. Rows are kept for 365 days.
• Deliveries, retries and replayA delivery is one event sent to one endpoint. What counts as delivered, how a failure is retried for about an hour, and how to send a delivery again.
• Policy options and instructionsDecide how each policy behaves on a template: mode, threshold, effect and weight, guidance for the models, and the options four policies take.