Identity stops at the Mothpoint

Picture a short script on your laptop that sends a contract to a model and asks for a summary. You wrote one question, but the request that leaves your machine carries a good deal more than that.

It goes out with a key tied to an account and a billing name, from an IP address that places it on a network, and with a user agent that names your client and its version. Your SDK may add fields such as user or metadata without being asked.

None of that is needed to answer the question. Each piece tells one asker apart from another, and together they let a host link every prompt you send into one long record of what you were working on.

On Moth the same script calls one address, the Mothpoint, with a moth_ key. The Mothpoint doesn't pass your request along with a few headers crossed out. It reads the body, keeps only the fields the endpoint names, and builds a new call from what is left.

POST /v1/chat/completions
authorization: Bearer moth_7f3a…72fs
user-agent: openai-python
# from 203.0.113.24

{
  "model": "claude-sonnet-4.6",
  "user": "dana@example.com",
  "metadata": { "team": "research" },
  "messages": [{ "role": "user", "content": "Summarise this contract" }]
}

POST (the host's endpoint)
authorization: Bearer (one pooled key)
# from Moth's servers

{
  "model": "(the host's name for the model)",
  "messages": [{ "role": "user", "content": "Summarise this contract" }]
}

• Your IP address and user agent stay behind, because no header you sent goes on and the call leaves from Moth's servers.
• Your key is swapped for one pooled key that every caller's calls share.
• Your wallet never reaches a host, and Moth keeps only a keyed hash of the address you sign in with.
• Fields that name you, such as user, metadata and a message's name, are dropped without an error, so your SDK keeps working.

Taking those fields off would not be enough if each caller still left under a key of their own, because the key alone would let a host group your requests. So every call leaves under the same shared key, through one queue that takes accounts in turn.

The prompt goes on, since the model has to read it, and everything that says who sent it stops at the Mothpoint.

To the host, your question and anyone else's arrive the same way, from the same servers and under the same key. The reply is rewritten on the way back too, with Moth's own id and model name, and with any cost figure or error text from the host taken off.

A promise about the host would mean little if the middle of the path kept a copy. The Mothpoint records each call by account, key, model, token counts, charge and time taken, and the prompt and the reply are not written down anywhere on our side.

0

copies of your prompt or the reply kept by Moth

1

pooled key that every call leaves under

90days

that a billing row is kept before it becomes a daily total

Your chat history stays in your own browser, where you can export it or wipe it, and none of it sits on our servers.

The Mothpoint removes who sent a request, not what the request says. If a prompt contains your name, your address or a detail only you would know, that detail reaches the model like the rest of the prompt, and in Anonymized mode the host can read the content under its own policy.