Privacy Policy

What data we process

Account data: your name, email address and (for email sign-up) a hash of your password.

Usage data: your chats, text extracted from files you upload, and your daily credit counter.

Payment data: subscription, credit pack and invoice records. Your card details never reach us; payments on the web are processed by Stripe, and payments in the Android app by Google Play.

Technical data: your IP address. It is processed to prevent abuse, enforce request limits and block abusive addresses; no profile is built from your IP address.

Visit data: the address of the page you open, your browser’s language, and a short, irreversible hash derived from your IP address and browser signature. It is kept on our own server, is not sent to third parties and is used only to count visitors; the raw IP address is not written to this record. At most 100,000 rows are kept, and older rows are deleted.

Your notes do not reach the server: they are stored encrypted in your browser. The server only stores the encryption key, linked to your account, so you can open your notes on other devices too.

Why we process it

To provide the service (your chat history, credit allowance and subscription), to keep it secure and to meet our legal obligations. Legal basis: performance of a contract and legitimate interest.

Who we share it with

To generate responses, your messages and relevant document text are sent to the provider of the AI model that writes the response. When you choose "Search the web", your question is searched using a web search service. When you create an image, your prompt is sent to the image model provider; before generation it is also checked for content safety.

Payments run through Stripe, and emails are sent through the configured email provider. When you buy in the Android app, the purchase token issued by Google Play is sent to Google to verify the purchase; the purchase is linked only to an irreversible hash derived from your account ID. Beyond this, we do not sell your data to third parties or share it for advertising.

We use Microsoft Clarity to understand how you use the site: views, clicks and in-page navigation on public pages are sent to and processed by Microsoft. If you connect from the European Union, the European Economic Area, the United Kingdom or Switzerland, measurement runs only with your explicit consent; in other regions it is on by default. Everywhere, you can turn it off at any time with “Cookie preferences” in the footer. Measurement never runs on chat, notes, media, account, admin and sharing screens; the content of these screens is never measured.

Public chats

The questions and answers of a chat you create as public or publish can be seen by anyone, may be listed on the Explore page and may be indexed by search engines. Files you upload are not published by default. If the platform setting is on, images you upload may appear on the public page, and the names and text of documents you upload may be opened to signed-in members only; this is stated clearly on the chat screen and in the publishing confirmation.

The title and description of the published page are generated by a language model. Your consent is requested before your first public chat, and the date of your consent is stored in your account.

When you make a chat private or delete it, it is unpublished; search engine caches may take time to update.

How long we keep it

Your chats and file text are kept until you delete them or close your account. When you delete your account, your chats, files, usage counters and your customer record at Stripe are deleted together.

Event logs are deleted after 180 days, and payment provider records after 90 days. Payment records are kept in de-personalised form because of accounting obligations.

Your rights

You have the right to access, correct and delete your data and to object to its processing. You can send your request to ltd.bilgisam@gmail.com.

You can download a copy of your data (account, chats, payments and credit history) from the account page and delete your account yourself there; this directly fulfils access and deletion requests.