URL-mode secrets never transit the bridge, its logs, the client, or the model result. In URL mode the secret flows operator → target directly; the bridge learns only that the opaque completion callback fired. Results omit content per spec.
Audit-trail hygiene: the audit trail records the target URL's origin only — no query string — and never records form content values. Ask metadata (session / requestState binding, era, mode, outcome, metering) is processed only to operate the bridge for that operator's account, bind and return the answer, and meter the ask — no sale of operator data, no cross-operator use, no telemetry beyond what the product surface documents. Asks, bindings, and audit records are per-account isolated.
Account tokens are stored as SHA-256 hashes only and shown once at issuance. State is retained while the account is active; backups are kept 14 days. Support correspondence (support@textforagents.com) is handled under the company's ordinary support privacy practice.