Privacy Policy

Account details needed to sign you in and bill you (your name and email), and the operational data needed to run your requests and keep the service secure (such as session and device signals used to protect your account).

We do not sell your data, share it beyond what operating the service requires, or use it to build advertising profiles.

Sensitive fields - including your name and email - are encrypted at rest with AES-256-GCM. Your email is additionally stored as a keyed one-way index so we can look it up without keeping it in plain text, and passwords are stored only as Argon2id hashes.

We support two-step sign-in (authenticator apps and passkeys), bind each session to a device, rotate refresh tokens with reuse detection, and require step-up re-authentication for sensitive actions like data export or account deletion.

Images and documents you provide are read in memory and immediately discarded - only the text extracted from them is kept, encrypted. The original files are never written to disk or stored. Image metadata (EXIF and similar) is stripped before processing.

Your message text is handled as user input, never inserted into the assistant's hidden instructions. The underlying AI model and provider are never exposed - not in answers, headers, errors or the API.

For the desktop agent, your code and files stay on your machine: we keep no transcript and no source code for that surface, only operational metadata (such as token counts and timings). Other AI interactions may be retained in an encrypted, access-controlled audit log for a limited period to prevent abuse, then deleted.

If you bring your own AI provider key, it is encrypted at rest, never shown back to you in full, used only for your own requests, and billed by your provider - never metered against your plan or shared with any other user.

Payments are made in cryptocurrency through our payment processor. We do not collect or store card numbers or bank details. Orders and invoices are retained for accounting and legal purposes, including after account deletion, with a billed-to snapshot as the law requires.

We use first-party cookies strictly to keep you signed in. We do not use third-party advertising or analytics trackers to follow you across the web.

We keep operational data only as long as needed to provide the service and meet legal obligations. AI audit records are kept for a limited retention window and then deleted; orders and invoices are retained for accounting law.

You can export your data or delete your account from Dashboard → Settings; both require a fresh re-authentication. Deleting your account ends your plans, revokes your sessions and removes your personal data, except records we must retain for accounting. You can also request access to or correction of your data by contacting us.

Questions about privacy or a data request? Reach us by email or Telegram - see the Contact page.