Privacy

Zero-Data-Retention (ZDR)

• We select AI service providers according to our data protection requirements.
• We use zero-data-retention options where they are available and enabled for the respective service.
• We do not release your content for training.

AI Processing & Service Providers

To provide the features, we transmit certain content to carefully selected third-party providers (processors):

• What data: your messages and the prior chat history, attached files and images, voice recordings.
• To which recipients: OpenRouter (openrouter.ai) as an AI gateway for chat, research and agent features, file and image analysis, automatic title generation, and speech-to-text (transcription); OpenRouter forwards the content to selected model providers (processors) for inference. Mistral AI (mistral.ai) for text-to-speech (speech output, web only; on iOS speech output runs on the device). Web searches (research and agent features) go through OpenRouter; when external tools are enabled, additionally through a self-hosted search service (SearXNG) that queries public search engines.
• For what purpose: to answer your requests, power research and agent features, generate titles automatically, transcribe speech, and produce speech output.

Hosting & GDPR

• Data stays in the EU (Hetzner, Germany).
• GDPR-compliant.

Account & Security

• Authentication via JWT; sign in with email/password, Google, or GitHub.
• Row-Level Security (RLS) on all tables, with access limited to your own data.
• No secrets in the client; server-side validation of all inputs.
• Rate limiting on all API routes; origin lockdown via Cloudflare Tunnel.
• Uploaded files and artifacts are stored in private storage buckets (signed URLs).

Deleting Your Account

When you delete your account, all of your own data (chats, projects, files, artifacts, research documents, agents) is removed; an active subscription is canceled beforehand.