Privacy policy

Version 2, effective from 2026-08-01.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Valery Mironov, Behringstrasse 20, 12437 Berlin, Germany Email: vmm84@me.com

A data protection officer has not been appointed: the app is built and run by one person, and the conditions of Article 37(1) GDPR are not met — we are not a public authority, we do not carry out large-scale systematic monitoring, and we do not process special categories of data on a large scale.

2. What data we process

Account data. Email address and password in encrypted form, chosen language, display settings. Optionally first and last name.

Content. Your messages, model responses, uploaded files and text extracted from them, your projects and — if you switch the feature on — facts remembered about you.

Usage data. Time, type and size of every request, the model used, number of tokens, cost incurred, errors and cancellations. We need this data to enforce quotas and to review whether the service is economically viable.

Purchase and subscription data. App Store transaction identifiers, plan, term and status. We do not receive payment data: card details and billing rest exclusively with Apple.

Device data. Operating system version, app version and — if notifications are enabled — the Apple Push Notification service token.

Support. Subject, messages and attachments of your enquiries.

We do not deliberately process special categories of personal data under Art. 9 GDPR. If you include such data in a message it is processed like other content — please provide only what your question requires.

3. Purposes and legal bases

| Purpose | Legal basis | |---|---| | Operating the account, answering requests, providing the subscription | Art. 6(1)(b) GDPR (contract) | | Quotas, accounting, abuse prevention, security | Art. 6(1)(f) GDPR (legitimate interest) | | Remembered facts about you, push notifications | Art. 6(1)(a) GDPR (consent) | | Statutory retention | Art. 6(1)(c) GDPR (legal obligation) |

You may withdraw consent at any time in the settings. Switching the memory feature off deletes the facts already remembered.

4. Recipients

Language model providers. To answer your request we transmit its content to one of the following providers, depending on the model selected: OpenAI, Anthropic, Google and DeepSeek. What is transmitted is the content of the request, not your email address or account identifier.

Apple. Processing of purchases and delivery of notifications.

Hosting. We operate the server and database at Hostinger International Ltd, 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Servers are located in Frankfurt am Main, Germany. (Hosting provider and location) under a data processing agreement pursuant to Art. 28 GDPR.

We do not sell data and we use no third-party advertising or analytics services.

5. Transfers to third countries

The model providers named above process data in the United States among other places. Transfers take place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR).

DeepSeek models are processed in the People's Republic of China. There is no European Commission adequacy decision for China, so such a transfer requires separate safeguards under Article 46 GDPR. If you do not want the content of your request to be sent to China, do not select DeepSeek models.

6. Is your content used for training?

We do not train models on your content. Whether a model provider uses transmitted content for its own purposes is governed by our contract with that provider; we use the business tiers for which the providers state that use for training is excluded.

7. Retention

• Content and projects: until you delete them or delete your account.
• Remembered facts: until you switch the feature off or delete your account.
• Usage data: 24 months.
• Purchase records: for as long as statutory retention periods require,

as a rule ten years under § 147 of the German Fiscal Code.

• Support enquiries: three years after the enquiry is closed.

When you delete your account we remove content, projects, files and remembered facts. Records of usage and purchases are kept without content data — without them we could neither substantiate our accounts nor prevent credits from being granted twice.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please contact vmm84@me.com.

You also have the right to lodge a complaint with a supervisory authority. The authority of your place of residence or of our establishment is competent: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany (entrance Alt-Moabit 60), datenschutz-berlin.de.

9. Automated decisions

No automated decision in an individual case producing legal effects (Art. 22 GDPR) takes place. Selecting the model and classifying request complexity serve technical processing only.

10. Children

The App is not intended for children under 16. If we learn that an account belongs to a child we delete it.

11. Security

The connection to the server is encrypted end to end (TLS). Access to the administration interface is protected by a second factor. Access keys for model providers reside exclusively on the server and are not contained in the App.

12. Changes to this policy

We adapt this policy when the service or the legal situation changes. We will inform you of material changes in the App at least thirty days before they take effect.