Privacy Policy

• Account information (email, auth identity, profile fields).
• Authentication data, including sign-in provider identifiers and session information.
• Messages, prompts, responses, citations, source metadata, and conversation history.
• Uploaded or pasted images, documents, filenames, file metadata, and parsed attachment text where applicable.
• Preferences and personalization settings, including language, Study/Mini mode choices, saved memory, and personalized context records.
• Subscription, billing status, Stripe customer/subscription identifiers, trial status, and entitlement information.
• Feedback, contact-form messages, support requests, and related email metadata.
• Usage, device, browser, log, analytics, rate-limit, cache, and security data needed to operate and protect the service.

We use information to authenticate users, provide chat responses, process uploads, preserve conversation history, apply language and personalization settings, enforce safety rules, manage subscriptions, provide support, improve reliability, prevent abuse, debug issues, and comply with legal obligations.

We may use aggregated or de-identified operational data to understand service health, latency, cache effectiveness, feature usage, and reliability. We do not need raw prompts for many operational metrics, and we aim to keep admin-facing telemetry aggregate and practical.

Prompts, messages, uploaded content, conversation context, source snippets, and related metadata may be sent to AI providers to generate responses and apply safety or routing controls. Web-source lookups may send your query or derived search terms to third-party search or content providers when current information is needed.

The app may store generated responses, conversation metadata, and narrow cache-related data to provide history, improve speed, and reduce repeated processing for eligible requests. Cache digest telemetry is aggregate and is designed not to store raw prompts.

Uploaded images and documents may be processed directly by the app and, where enabled, temporarily stored in private storage before being used to answer your request. Attachment records include ownership and status metadata so files can be tied to the user who uploaded them.

We aim to keep temporary attachments only as long as needed for processing, security, debugging, or legal requirements. Some conversation content and parsed attachment-derived text may remain in chat history if needed to preserve the conversation you asked us to save.

Payments, cards, checkout, invoices, subscription portal sessions, and related billing workflows are handled by Stripe. We receive and store billing status, customer identifiers, subscription identifiers, plan information, trial status, and webhook events needed to grant or remove access. We do not store your full payment card number.

We use cookies, local storage, and session storage for authentication, legal consent, preferences, security, and core app behavior. We may use analytics tools, including Google Analytics, to understand traffic, usage, and product performance.

Browser settings, extensions, or device settings may limit cookies or analytics collection, but disabling required storage may affect app functionality.

• Contract: to provide the product features you request.
• Legitimate interest: to secure, operate, and improve the service.
• Consent: where you explicitly agree (for example, terms acceptance).
• Legal obligation: where processing is needed to comply with law.

• OpenAI: AI response generation, model routing, and related processing.
• Supabase: authentication, database, private storage, and account data.
• Stripe: payments, subscription checkout, billing portal, and invoices.
• Google: OAuth sign-in and analytics, where enabled.
• Apple: OAuth sign-in and mobile billing support, where enabled.
• Vercel: hosting, deployment, and infrastructure logs.
• Upstash/Redis: rate limits, response cache, and operational metrics, where configured.
• Resend: transactional emails and contact-form delivery, where configured.

OpenAI API data is not used to train OpenAI models by default unless the account opts in.

We retain information for as long as needed to provide the service, maintain your account and conversation history, process billing, resolve disputes, enforce safety and security rules, debug issues, and comply with legal obligations. Retention periods may vary by data type.

You may delete conversations or request account/data deletion, subject to operational, legal, fraud-prevention, tax, billing, and security retention requirements.

Data may be processed outside your country, including in the United States.

• Right to access your data.
• Right to correction of inaccurate data.
• Right to deletion, subject to legal/operational requirements.
• Right to data portability where applicable.
• Right to object to certain processing.
• Right to withdraw consent where processing is based on consent.

Rights vary by jurisdiction. To make a request, contact us using the email below. We may need to verify your identity before fulfilling a request.

This service is not intended for children under the minimum legal age in your jurisdiction without appropriate parental or guardian consent.

We use reasonable technical and organizational controls, but no system can guarantee absolute security.

We may update this Privacy Policy from time to time. If changes are material, we may require renewed acceptance before continued use.

Privacy questions or data requests: contact@theologie.ai