Privacy Policy

• Your Account ID. It is generated in your browser, and only values derived from it are sent.
• Any encryption key. Keys are derived locally and held as non-exportable browser keys.
• The readable content of your conversations, thread titles, or search index.
• Temporary chats, in full — no runtime with a storage or sync adapter is even mounted for them.

2.1 Account. An account reference derived from your Account ID by hashing, a password-hash verifier, your encrypted key bundle and its initialisation vector, format version numbers, a synchronisation counter, and creation and update timestamps.

2.2 Devices and sessions. A device identifier generated by your browser, the SHA-256 hash of each session token (never the token), the device a session belongs to, and creation, expiry, last-used, and revocation timestamps. No IP address and no user agent is stored with a session.

2.3 Encrypted history. Thread and message ciphertext with their initialisation vectors, format versions, revision numbers, timestamps, deletion markers, and per-account synchronisation rows. The identifiers are random values your browser generates; they are not derived from your content.

2.4 Payments. The Monero subaddresses allocated to your account with their wallet indices, and for each deposit its transaction id, exact atomic amount, block height, confirmation count, block timestamp, and whether it has been credited — plus the immutable ledger entries that convert those deposits into USD credits at a recorded quote. Monero transactions are public on the Monero blockchain; that is a property of the network, not of this service.

2.5 Usage metadata. For each request: the model identifier, input and output token counts, the reserved and settled cost, the markup applied, the prices used, the status, and timestamps. This records that you used a model and what it cost — never what you asked. It is the basis of billing. We also keep daily totals of completed requests per model, without account or session identifiers, to rank available models and providers by their usage over the last 30 days. These aggregate counts are public and exclude automatic chat titles and failed requests.

2.6 API keys. The SHA-256 hash of each key (never the key), its visible prefix, the name you chose, and creation, last-used, and revocation timestamps. The name is stored as you typed it, in the clear, so avoid putting anything sensitive in it.

2.7 Portal, feedback, and support. The self-hosted customer portal stores feedback, votes, comments, support messages, and related workflow metadata in the clear. Public-board content is visible publicly; support conversations are visible to you and the operator. When you sign in, the portal receives a stable portal-specific pseudonym and a non-routable synthetic address — not your Account ID, authentication material, prompt history, wallet data, name, or real email. You may also submit through the portal's anonymous mode, in which case no xmr4ai account pseudonym is attached. Do not put secrets, an Account ID, or anything you would not hand to the operator into portal content.

2.8 Rate limiting. A SHA-256 hash of your IP address and of your account reference, with a counter and a reset time, kept only for the length of its own window. Hashing an IP is obfuscation rather than anonymisation — the address space is small enough to search against a known digest — which is why these rows are short-lived rather than retained.

Referrals. Participation is optional. A public random referral code maps to a referrer account; accepting it at signup records a relationship between the two account references. The operator can see that relationship and the payment values needed to calculate rewards. An unaccepted invitation code is kept only in this tab’s session storage and removed from the URL fragment. No third-party affiliate tracker or device fingerprinting is used. Referrers see aggregate counts and reward totals, not referred account identifiers, wallet addresses, transactions, or usage. With few referrals, those aggregates can reveal approximate deposit values.

Deleting either account removes the referral relationship and cancels pending rewards. Already-issued credits belonging to another account remain, with their source account and deposit links removed. Allocation records without the deleted account’s identifiers remain for aggregate accounting reconciliation. Your own reward activity and remaining credits are removed when you delete your account.

2.9 Attachments. An image you attach is stored encrypted on your device and is not stored on the server unless you turn on attachment sync for that device — with sync on, it travels as ciphertext inside the message, like everything else in 2.3. A PDF, DOCX, or text document is handled differently. Its original source file is stored encrypted only in this browser for preview and download; it is never synced, stored on the server, or sent to a model provider. Text extracted from that document is stored in the encrypted message, travels with that message when conversation history syncs, and reaches the model as clause 4 describes.

Your IP address is necessarily visible to the server and to any hosting or network provider in front of it while a request is being made. Application logs record only the request method, path, response status, and elapsed time — no bodies, no headers, no cookies. Nothing sensitive is ever placed in a URL, because the path is the part that gets logged.

Infrastructure providers may keep their own connection logs under their own policies, and the operator does not control those.

Model providers. Your prompt, its conversation context, image attachments, and text extracted from document attachments pass through our self-hosted AI gateway to upstream routing services and the selected model provider in a form they can read. The original PDF, DOCX, or text source kept for local preview and download is not transmitted. Routing is restricted to endpoints declaring zero data retention and no training on your data, and a request that cannot be routed that way is refused rather than sent. This is a contractual and routing guarantee, not encryption: there is no trusted execution environment and no encrypted inference here.

Price data. XMR/USD quotes and model prices are fetched by the server on a schedule. These requests carry no information about you and are not made per user.

Nothing else. The browser is prevented by Content-Security-Policy from connecting anywhere except this app and its own API. There is no analytics, no error reporting service, no font or avatar CDN — avatars are generated locally in your browser.

• One session cookie: HttpOnly, Secure, SameSite=Strict. It carries an opaque token and nothing else.
• Local storage: a device identifier, your sidebar preference, your acceptance of the terms, and your attachment-sync setting for this device.
• IndexedDB: your encrypted conversation history, original document files retained locally for preview and download, your encrypted image attachments if attachment sync is off for this device, and — only if you chose “Remember this device” — your Account ID wrapped by a non-exportable browser key.

There are no advertising or tracking cookies, so there is no consent banner to dismiss.

• Deleting a thread or message destroys its ciphertext immediately, in the same transaction — not on a later sweep.
• The deletion markers that stop a deleted item reappearing from another device are kept for 90 days.
• Idempotency records for synchronisation are kept for 30 days.
• Sessions are deleted once expired or revoked, rather than left in place to record that an account was active.
• Payment, ledger, and usage records are kept for as long as the account exists, because they are what a balance is made of.

• Temporary chat writes nothing anywhere, locally or on the server.
• Deleting a thread deletes its ciphertext on the server too.
• Signing out erases every byte of local data for that account from this browser.
• Signing out everywhere revokes all sessions on all devices.
• Revoking an API key takes effect immediately for new requests.
• Deleting the account, from the account dialog, removes every record attached to it, including the credit balance — see clause 10 of the Terms.

The operator cannot read your conversations, cannot identify you, cannot tell whether two accounts belong to the same person, cannot recover a lost Account ID, and cannot restore data whose key only you hold. These are properties of the design, not promises of good behaviour — but they also mean there is no support path that can rescue you from a lost Account ID.

A legal demand can compel what the operator holds, which is the material listed in clause 2. It cannot compel plaintext the operator has never had.

This policy carries the version number and effective date shown at the top of the page. It describes the system as it is built today; if the implementation changes, this page is updated with it and the version advances.