Privacy notice
Last updated:
This notice must match your deployment. The statements below describe what this codebase actually does. If you add analytics, error tracking, or a different model provider, update this page — an inaccurate notice is worse than none.
The short version
- Conversations are stored in your browser, not in a server-side transcript.
- Prompts are sent to model providers for inference. That is the only time content leaves your device.
- Cross-device sync is end-to-end encrypted. We store ciphertext we cannot decrypt.
- We do not train models on your conversations.
What we store on our servers
| Data | Why | Retention |
|---|---|---|
| Email, password hash (scrypt), plan | Account access and billing | Until you delete the account |
| Session record (random id, user agent, IP) | Keep you signed in; revoke compromised sessions | 30 days, or until sign-out |
| Anonymous identifier + prompt context of each turn | Serve the request; enforce daily limits | Signed-in: attached to your chat record. Anonymous: usage counters only |
| Encrypted workspace snapshot (optional) | Restore your chats on another device | Until you delete it in the app |
| Generation jobs (prompt, parameters, output URL) | Produce and bill media, honour refunds | Until you delete the job |
| Payment records | Tax and accounting obligations | As required by law (typically 7–10 years) |
What stays on your device
Your chat history, drafts, generated media and preferences live in your browser's local storage. Clearing site data deletes them; if you have not enabled sync, they cannot be recovered. Encrypted sync uses a key derived from a passphrase that never leaves your browser — which also means a forgotten passphrase means the backup cannot be restored by us.
Third parties
- Model providers receive the prompt and return the completion. They process it under their own API terms, typically without training on API traffic; check your provider's policy.
- Payment processor (Stripe) receives the billing details you enter. We never see your card number.
- Email delivery receives your address to send sign-in and reset messages.
- Hosting sees request metadata (IP, user agent, timestamps) in logs.
We do not sell personal data, and this codebase ships no advertising or cross-site tracking pixels.
Legal bases (GDPR)
- Contract — providing the service you signed up for.
- Legitimate interests — abuse prevention, rate limiting, keeping the service available.
- Consent — optional encrypted sync, where you explicitly enable it.
- Legal obligation — retaining payment records.
Your rights
Depending on where you live you may request access, correction, deletion, portability, or restriction of processing, and object to processing based on legitimate interests. Write to support@example.com. You can also delete your account from the app; this removes account, sessions, chats, jobs and encrypted snapshots on our side.
Security
Passwords are hashed with scrypt, sessions are signed and revocable, sync payloads are encrypted with AES-256-GCM before upload, and all traffic is served over TLS. No system is perfectly secure; if you find a vulnerability please report it to support@example.com before disclosing it publicly.
Children
The service is not directed at children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.
Changes
Material changes will be announced in the app or by email before they take effect.
See also our terms of service.