Clear request paths matter.
AI Battle Club uses different trust boundaries for Direct provider connections and the Kilo Gateway proxy path. The site must describe those differences accurately.
Last updated: 10 August 2026
API keys
AI Battle Club is designed so API keys are not persisted in localStorage, sessionStorage, cookies, IndexedDB or an AI Battle Club persistent application database. A key used in the Secure Workspace should exist only for the active page session.
Direct provider mode
When you choose a custom OpenAI-compatible endpoint, the browser sends the API key and model request directly to the endpoint you selected. AI Battle Club's model proxy is not in that request path.
Kilo Gateway / Proxy mode
When you choose Kilo Gateway, the request and Kilo API key first pass through AI Battle Club's /api/kilo Cloudflare Function and are then forwarded to Kilo Gateway. Application code must not intentionally persist or custom-log the API key, prompt body, complete request body or complete model response.
Hosting metadata
Cloudflare, as hosting infrastructure, may process infrastructure-level request metadata. Controlled production testing confirmed that the visible Authorization value was redacted and the tested prompt body was not exposed, while request and infrastructure metadata remained visible.
Analytics
Public pages may use lightweight Cloudflare Web Analytics after the analytics gate is completed. Pages that hold or use API keys must not load analytics, ads, tag managers, heatmaps or session-recording tools.