Privacy Policy

1. Overview

Our core data promise:

We do not sell your personal data to third parties, ever
We do not use your conversations to train AI models
We do not share your data with advertisers
We collect only what is necessary to operate the Service
You can delete your account and all data at any time

This Privacy Policy explains how Aelius AI ("we," "us," "our") collects, uses, stores, and protects your personal information when you use the Aelius AI Service. It also describes your rights regarding that information.

By using the Service, you agree to the collection and use of information in accordance with this Policy. This Policy is incorporated by reference into our Terms of Service.

Your conversations may contain sensitive or otherwise private content. Please read §3 (Chat Data Storage) carefully to understand exactly how your conversations are stored and protected.

2. Data We Collect

We collect the minimum data necessary to operate the Service. Here is a complete breakdown:

Category	What it covers
Account Information	Username, email address, hashed password (bcrypt), unique account ID, account creation date, email verification status. We never store your password in plain text.
Chat & Message History	All conversations you have with the AI, including your messages, AI responses, timestamps, and chat titles. Stored to enable persistent conversation history. See §3 for full details.
API Keys	A unique API key generated for your account to authenticate API requests. Stored securely and associated with your account.
Usage Data	Usage patterns monitored for policy compliance and service improvement. This includes general interaction patterns, not detailed behavioral profiling.
Uploaded Files	Files and images you attach to a message. They are kept with the conversation, so the picture is still there when you reopen the chat, and documents you attach are listed under Files, where you can download or delete them. They are deleted when you delete the message, delete the chat, delete them from Files, or close your account. So that the assistant can read a document and look at its pages and slides, our own servers convert it and keep the converted copy, its page text and the words read from its pictures beside the file, and these are deleted with it. Pictures of pages the assistant was shown are saved with the chat message they belong to, and are deleted with that message, the chat or your account. Nothing you attach in an incognito chat or without an account is kept, and a file you attach but never send is removed within 48 hours, together with anything made from it. Turning off “Keep images and files you send” in your settings stops attachments, and pictures of their pages, being kept at all. They are private to your account: nobody else can see them unless you share them yourself.
Documents Aelius Writes	Word, PowerPoint, PDF, Excel and text files the assistant writes for you in a saved chat, and the edited copies it makes when you ask it to change a Word, PowerPoint or Excel file you attached (the file you attached stays as you sent it). They are listed under Files, kept with up to five earlier versions of each and the converted copy and page text the assistant uses to check its work, and all of it is deleted when you delete the document from Files, delete the chat it was made in, or close your account. Incognito chats and guests cannot create them.
Projects	A project you create: its name, icon and colour, description, instructions, starter prompts, which tools it may use, its memory setting, whether it is shared, and which of your chats are in it. Private to your account unless you share it (see §3.8). Guests and incognito chats cannot create projects.
Project Knowledge	Files you add to a project, text you paste into it, and copies of documents Aelius wrote that you add to it. We keep the file, the text read from it and a count of its length, so the assistant can use it in every chat in the project: a short file is given to the assistant in full with each message, a long one is searched when a question needs it. They are listed under the project and under Files. They are deleted when you remove them from the project, delete them from Files, delete the project, or close your account. Deleting a chat, deleting all your chats, or auto-delete does not delete project knowledge, because it belongs to the project, not to a chat.
Project Memory	Things the assistant saves to remember while you chat in a project, and things you add yourself on the project's Memory tab. They are used only in that project's chats, are listed on its Memory tab where you can edit, move or delete each one, and are deleted with the project or your account. If you turn off assistant memory in your privacy settings, nothing is saved to project memory either. With “Default memory” a project can also use what the assistant remembers about you from other chats; with “Project-only memory” it uses only its own.
Pictures You Edit	When you change a picture with the picture editor (select part of it, remove something, change or remove the background, extend, upscale or restyle it), the work is done on our own servers: selecting, small removals, cut-outs and upscaling on our processors, other changes by the image model that makes Aelius's pictures. Each version is saved with the chat message it belongs to, or in your picture library when you edit there, and is deleted when you delete that message, the chat or the picture, or close your account. So that you can step between versions, we also keep a short record of each one with your account (which picture it came from, the kind of change and the words you typed), deleted when you close your account. In an incognito chat, or with “Keep images and files you send” off, nothing is kept. Edited pictures pass the same safety checks, and carry the same AI marker, as any picture Aelius makes.
Location	Only when you share it, and only to answer things that need it, such as local weather and the correct local time. Two levels, and you control both. Approximate location, roughly the city your network connection appears in, is derived from the connection while “Use my approximate location” is switched on in your privacy settings; switch it off and we stop. Precise location, your device's coordinates, is never taken unless you grant your device's location permission, and you can withdraw it at any time in your device settings. You can also just type a city instead, or clear a stored location entirely under Settings → Location. The assistant works normally with no location at all.
Aelius Pro and Billing	Only if you buy or give Pro. From Link and Stripe we receive a customer reference, your subscription status and renewal date, and, for each payment, the amount, currency and the email address on the receipt. We never receive your card number. We keep whether your account is Pro and until when. For a gift, we keep who sent it, the username or email address the sender entered for the recipient, the number of months, the amount, and whether it was accepted, declined or refunded; the recipient's address is used only to send the gift email. We also record which Pro offers are shown to you in the app and whether you open, close or follow them (the offer, the time it was open, your device type and your country as reported by our network provider), so we can tell whether the offers are useful or annoying; this is never shared and never used for advertising. If you buy Pro in the iPhone or iPad app, Apple sells it: from Apple we receive a signed record of the purchase (a transaction number, the product, the purchase and renewal dates, your App Store country and whether it was renewed, cancelled or refunded), tied to your account by a random identifier the app gives Apple at purchase. We never receive your card or your Apple Account details.
Email Tokens	Temporary verification and password reset tokens associated with your email. These expire after use or after a time limit and are then deleted.
Server Logs	Our servers keep operational logs so we can find faults and abuse. For each message they record timing and routing details, and the logs include the first part of the message itself (up to about 120 characters), including in incognito chats. Logs are kept on our own servers, are never shared, and are overwritten automatically, currently after about a month.
Abuse-Prevention Signals	To enforce usage limits (Terms §7.6) and stop one person running several free accounts, we keep: the network addresses (IP addresses) your account signs up and signs in from, and uses Aelius Code from; a random identifier stored in a cookie in your browser (see §8.1); and, for free Aelius Code accounts, one-way hashes of the working folder your coding tool reports and of small samples of the code it sends. The hashes cannot be turned back into the folder name or the code; they can only show that two accounts sent the same thing. We compare these between accounts only to find accounts used by the same person to get around limits, keep them for up to 30 days of inactivity, and never use them for anything else.
Safety Counts	When a message looks like its sender may be thinking about suicide or self-harm, we note that a crisis referral was made on that turn (see §6.2 of the Terms), without keeping any extra copy of the message. We use the count only to check the protocol works and to report totals where the law requires it.
Picture Reports and the Adult-Pictures Setting	If you report a picture from the web (see §12.3 of the Terms) we keep a record of the report: your account, the chat and message it was in, the reason you chose, the picture's caption, site and page address, a fingerprint of the picture's web address, the time, whether you were in the app, and whether the report could be matched to a picture we showed you. For a report that a picture shows a minor we also keep the picture's own web address and a fingerprint of the picture (a short number computed from it, from which the picture cannot be rebuilt). When such a report blocks a picture, federal law (18 U.S.C. § 2258A) requires us to preserve it, so we keep one encrypted copy of the picture with the report’s details, which only our operators can open, and we may share them with NCMEC and law enforcement. So that a picture you reported is not shown to you again, we keep a list of the pictures you reported (a fingerprint of each one's web address) with your account. Whether you turned on Show adult pictures (18+), and when, is stored with your account settings.
How You Found Us	When you create an account we store, with it, where it came from: the site or campaign that first brought your browser here and the page you landed on (read from the referral-source cookie in §8.1), how you signed up (email, Google or Apple), your country as reported by our network provider, your browser language, and your device type, operating system and browser. We use this only to understand which pages and sources bring people who find Aelius useful, and it is deleted with your account. Separately, we count visits to our pages by day, page, source, country and device type; those counts contain nothing that identifies you or your browser.

2.1 Data We Do NOT Collect

We explicitly do not collect the following:

Card numbers. The optional paid subscription, Aelius Pro, is sold to you by Link (a Stripe company) on Stripe's own checkout page. We never see or store your card details; see the “Aelius Pro and Billing” row above for what we do receive.
Government-issued identification or age verification documents (beyond checkbox confirmation)
Location you have not shared. We do not track your movements, we keep no location history, and nothing about location is used for advertising. See the Location row above for what is collected when you do share it.
Device fingerprints or hardware identifiers. The random browser identifier described in §8.1 is a cookie we set, not a fingerprint of your device, and it is deleted when you clear your cookies.
Social media profile data. Signing in with Google or Apple tells us your email address and a stable account identifier, and nothing more. We cannot read, post to, or see anything else in those accounts.
Biometric data of any kind

3. Chat Data Storage

Important, your conversations are stored. Conversations may contain sensitive or otherwise private content, and they are stored in our database to provide persistent conversation history. Please read this section carefully before sharing sensitive personal information in the chat interface.

3.1 What Is Stored

When you use the chat interface, the following data is stored in our database:

Every message you send, including the full text content
Every AI response, including the full text content generated by the Model
Chat metadata: title, creation timestamp, last updated timestamp
Association with your account: each chat and message is linked to your user ID

3.2 Why It Is Stored

Chat history is stored to allow you to:

Resume conversations across sessions and devices
Review and reference past AI responses
Manage your conversation history (rename, delete individual chats)

3.3 Who Can Access Your Chats

Your chat history is private to your account. We implement access controls to prevent other users from accessing your conversations. Aelius AI operators may access chat data only in the following circumstances:

In response to a valid legal order, warrant, or subpoena from law enforcement
To investigate a reported violation of our Terms of Service
To comply with mandatory CSAM reporting obligations under federal law
For security incident investigation with your consent, or where required by law

Chats in a project you share are still private: people who use your shared project (an Orbit) cannot see your chats, your project memory or your general memory, and you cannot see theirs.

3.4 How to Delete Your Chat History

You can delete individual chats at any time through the chat interface using the delete option on any conversation. Deleting a chat permanently and irreversibly removes all messages in that chat from our database. You can also delete your entire account (see §9), which removes all associated chat history.

3.5 Sensitive Information Warning

Do not share information in the chat that you would not want stored in a database, such as: full Social Security/National Insurance numbers, complete payment card numbers, passwords, or highly sensitive personal secrets. While we secure your data, no digital storage system is immune to risk.

You can choose to publish a read-only copy of a chat at a link, with Share in the chat. Nothing is published unless you create a link, and guests and incognito chats cannot create one.

What is published: the messages you typed and Aelius's replies, up to the point you shared, and pictures Aelius generated in those replies. Not published: the contents and names of files you attached, including the pictures of their pages the assistant was shown, videos, images you uploaded (unless you tick "Include images I uploaded"), Aelius's reasoning, tool records, your memory and saved facts, and your name, username and email address (unless you tick "Show my name", which shows your display name).
Who can see it: anyone who has the link. Links are long random addresses that cannot be guessed, and shared pages tell search engines not to index them. We cannot control what the people you send a link to do with it, including copying what it shows.
A snapshot: messages you send after sharing are not added unless you update the link.
Continuing a shared chat: someone who opens your link and chooses "Continue this chat" gets their own copy of it in a new chat in their own account: its text and the pictures the page shows, which are copied into their account and stored there like their own (so a photo you uploaded is copied only if your link includes your uploaded images). Your later changes do not reach that copy, and deleting your link or your chat does not delete it.
Removing it: delete a link from the Share dialog or in Settings > Shared links. A link also stops working at once if you delete the chat or a message it shows, if auto-delete removes the chat, or if you close your account. The address then says the link was removed; we keep only its random identifier for 90 days, then delete that too.
What we record about a link: how many times it was viewed and continued, with nothing about who viewed it. Anyone can report a shared page; a report stores the reason, any note, and a one-way hash of the reporter's network address (to stop repeat reports). A reported link is taken down at once until our operators review it; they may restore it or remove it for good. Reports are kept as safety records with no fixed end date.
A chat that our safety checks read as sexual content, or as touching on self-harm, cannot be shared as a public link. You can still save it as a PDF.

3.7 Shared File Links

You can publish a read-only copy of one file from Files, with Share. Nothing is published unless you create a link, and guests and incognito chats cannot create one.

What is published: the file itself (anyone with the link can view and download it), its name as Files shows it, its type, and whether the link shows the latest version or a saved copy. Before a shared file is downloaded we remove the author and editor names stored inside it, the camera and location details of pictures in it, and any files attached inside a PDF. Not published: your other files, the chat it came from, your memory, and your name, username or email address.
Two kinds of link: "Always the latest version" shows the file as it is when someone opens the link, so later changes by you or Aelius appear there too. "This version only" keeps a copy of the file as it was when you chose it, stored beside the file and deleted with it.
Pictures of pages: for a PDF or an office file, the page shows pictures of its pages, drawn on our server from the file and kept beside it until the file or the link is removed.
Who can see it: anyone who has the link. Links are long random addresses that cannot be guessed, and the page tells search engines not to index it. We cannot control what people do with a file once they have downloaded it.
Removing it: Stop sharing in the Share sheet. A link also stops working at once if you delete the file, delete the chat a document was made in, or close your account. The address then says the link was removed; we keep only its random identifier for 90 days, then delete that too.
What we record about a link: how many times it was opened, with nothing about who opened it. Anyone can report a shared file; a report stores the reason, any note and a one-way hash of the reporter's network address. A reported link is taken down at once until our operators review it. Reports are kept as safety records with no fixed end date.
A file that our safety checks read as sexual content, or as touching on self-harm, cannot be shared as a link, and a "latest version" link stops showing the file if a later version fails that check. A file whose text we cannot read (a scan or a picture-only file) cannot be shared yet.

3.8 Shared Projects (Orbits)

You can share a project with a link (“Anyone with the link can chat”). A shared project is called an Orbit. Nothing is shared unless you switch this on, and guests and incognito chats cannot share.

What people with the link see: the project's name, icon, description and starter prompts. Anyone with the link can see those and chat with the Orbit, with or without an account. Someone who is not signed in chats as a guest: those chats are kept like any guest chat (deleted after 24 hours) unless they sign in or create an account, which moves them into that account. If they choose to sign in first, their browser remembers the link for 24 hours so that they land in the Orbit afterwards.
What they never see: your instructions, your knowledge files or their text, your project memory, your general memory, your chats, and your name, username or email address. The assistant answers them using your instructions and knowledge and is told not to reveal or quote them. Like any AI it can be wrong, so do not put anything in a shared project's instructions or knowledge that you would not want a determined visitor to learn.
Their chats are their own: each person who uses your Orbit gets chats in their own account (or guest session). You cannot read them; we record only which accounts and guest sessions opened it and when they last did, and show you how many people have. In an Orbit chat the assistant uses neither their memory nor yours and saves nothing to memory, and it is not given their “About you” settings, their location or any account they have connected.
What the assistant shows them: its answers. Not its thinking, and not the files it looks things up in or what it read there. In an Orbit chat it opens only web links the person sent, links a web search returned in that chat, or links written in the project itself, never a link it made up, and a shared project's instructions cannot ask it to put what people say into a link, so a project cannot send what a person tells it to another website.
Stopping it: switch sharing off, make a new link (the old one stops working at once), or delete the project. The old link then says it is no longer shared. People who used it keep their chats, which become ordinary chats.

4. How We Use Your Data

We use the data we collect exclusively for the following purposes:

Providing the Service: Processing your prompts, delivering AI responses, and maintaining your conversation history.
Account Management: Creating and managing your account, verifying your email, and handling password resets.
Authentication & Security: Verifying your identity when you log in and protecting your account from unauthorized access.
Policy Compliance Monitoring: Reviewing usage patterns to detect violations of our Terms of Service, including comparing the abuse-prevention signals in §2 between accounts to find several accounts used by one person to get around usage limits.
Service Communications: Sending email verification links, password reset links, and material policy update notifications.
Legal Compliance: Fulfilling mandatory reporting obligations (e.g., CSAM to NCMEC) and responding to valid legal requests.
Service Improvement: Analyzing aggregate, anonymized usage patterns to improve the Service.

What we will never do with your data:

Sell, rent, or trade your personal data to any third party
Use your conversations to train AI models
Share your data with advertisers or data brokers
Use your data for purposes beyond those listed in §4
Build individual behavioral profiles for commercial purposes

5. Data Sharing and Disclosure

5.1 No Commercial Sharing

We do not share, sell, rent, or otherwise disclose your personal data to any third party for commercial purposes.

5.2 Service Providers

We may share limited data with carefully selected service providers who assist us in operating the Service, including email delivery (SMTP). These providers are contractually obligated to use your data only for the purpose of providing services to us and to maintain appropriate security standards. Current key providers:

Email delivery: Gmail (Google), used for transactional email (verification, password reset). Subject to Google's privacy policy for outbound email transmission only.
Payments and the sale of Pro: Stripe and Link (a Stripe company). Link is the seller of record for Aelius Pro: it collects your name, email, billing address and payment details directly on Stripe's checkout page, handles tax, receipts, refunds and payment support, and processes that information under its own privacy policy as the seller (link.com/privacy). We send Stripe your account ID and email address when you start a checkout, so the payment can be matched to your account. If you give Pro as a gift, Stripe also receives the recipient's username or email address in the payment's details.
In-app purchases: Apple, if you buy Pro in the iPhone or iPad app. Apple is the seller of that purchase, handles its payment, tax, receipts and refunds under its own privacy policy, and sends us the purchase record described in §2.
Networking and security: Cloudflare, which carries traffic to the Service and provides the approximate, city-level location described in §2.
Weather data: Open‑Meteo, which receives a location when you ask a question that needs the forecast, and nothing that identifies you.
Sign-in: Google and Apple, if you choose to sign in with either.
Web research: Parallel, Brave, Exa, Tavily and Browserbase. When the assistant searches the web or reads a page for you, the search words or the page address it chose are sent to one of these services so it can return results. They receive the query only, not your name, email or account, and we do not send them your conversation. When the assistant shows pictures from the web in a reply, the picture search goes to Tavily or Exa (or, when both are unavailable, Wikipedia), and our server then fetches small copies of the pictures from the sites they are on and checks them on our own servers, so your device never contacts those sites; the copies are kept with the message and deleted with it, and a shared store of the checked pictures, not linked to you or your chat, keeps each one for up to 7 days.
Human check: Cloudflare Turnstile, which may run an invisible check in your browser to confirm a person rather than a bot is using the Service.
Notifications: if you turn on notifications, Apple's push service (for the iOS app) or your browser maker's push service carries the notification text to your device.

The AI models themselves, image generation, voice transcription, and the reading, text recognition and page rendering of files you attach run on hardware we operate, not on a third party's AI service. Some replies are written by a smaller model on a second machine we operate; your messages are sent to that machine only to produce the reply.

None of these is an advertiser or a data broker. We do not link data from the Service with data from other companies' apps or websites, and we run no advertising, analytics or attribution software of any kind.

5.3 Legal Disclosure

We may disclose your data where required by law or in good faith belief that such disclosure is necessary to:

Comply with a legal obligation, court order, warrant, or subpoena
Fulfill our mandatory CSAM reporting obligations to NCMEC under 18 U.S.C. § 2258A
Protect and defend the rights or property of Aelius AI
Prevent or investigate potential wrongdoing in connection with the Service
Protect the personal safety of users of the Service or the public

Where legally permitted, we will attempt to notify you of a legal data request before complying. We cannot guarantee such notice in all cases.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of the transaction. We will notify you via email or prominent notice on the Service of any change in ownership or uses of your personal data.

6. Data Retention

We retain data only for as long as necessary for the purposes described in this Policy or as required by law.

Data Type	Retention Period	Deletion Trigger
Account Information	Until account deletion, plus any legally required retention period	Account deletion request
Abuse-Prevention Signals	Up to 30 days after the account last showed each one	Automatic
Chat History & Messages	Until manually deleted by user, or until account deletion	User-initiated chat/account deletion
Uploaded Files	Kept with the conversation they belong to, with the converted copy, page text and words read from their pictures made from them; pictures of their pages are kept with the message they were shown in	Deleting the message, deleting the chat, deleting it from Files, or account deletion; attachments never sent, and anything made from them, are removed within 48 hours
Documents Aelius Writes	Until you delete them, with up to five earlier versions of each	Deleting it from Files, deleting the chat it was made in, or account deletion
Projects	Until you delete them	Deleting the project, or account deletion. Its chats are kept and leave the project.
Project Knowledge	Until you remove it	Removing it from the project, deleting it from Files, deleting the project, or account deletion. Not by deleting chats or by auto-delete.
Project Memory	Until you remove it	Deleting it on the project's Memory tab, deleting the project, or account deletion
Pictures You Edit	Each version is kept with its chat message or in your picture library; the record of versions is kept with your account	Versions: deleting the message, the chat or the picture, or account deletion. Record of versions: account deletion
Billing and Gift Records	For as long as tax and accounting law requires (seven years), even after account deletion, in which case they are kept without your chats or files. Records of which Pro offers you saw are deleted with your account.	Expiry of the legal retention period; offer records on account deletion
Email Verification Tokens	Until used or expired (typically 24 to 72 hours)	Token use or expiry
Password Reset Tokens	1 hour from creation	Token use or expiry
API Keys	Until account deletion or key regeneration	Account deletion or user-initiated key reset
Legal Compliance Data	As required by applicable law (varies by jurisdiction)	Expiry of legal retention obligation
CSAM-Related Reports	Retained as required by federal law and law enforcement direction	Direction from law enforcement or legal expiry
Picture Reports	Report records are kept as safety records with no fixed end date. The preserved copy of a picture reported as showing a minor is kept for one year from the report (or from our report to NCMEC), or longer if law enforcement asks us to, then deleted. A picture reported as showing a minor stays blocked unless an admin lifts the block after review, by its web address and a fingerprint of the picture, not the picture itself. The list of pictures you reported is kept with your account.	The list of pictures you reported: account deletion. Report records: none automatic. Preserved copy: one year, unless law enforcement asks us to keep it longer

7. Security Measures

7.1 Technical Safeguards

We implement industry-standard security measures to protect your data:

Password hashing: Passwords are hashed using bcrypt with appropriate work factor, never stored in plain text
API key security: API keys are generated using cryptographically secure random number generation
Email token security: Verification and reset tokens are generated using secrets.token_urlsafe() (CSPRNG)
Database access controls: Database access is restricted to the application layer; no direct public database access
Transport security: Data transmitted between your browser and our servers is protected by TLS/HTTPS encryption
Session management: Session tokens are managed securely with appropriate expiry

7.2 Limitations

No system is perfectly secure. Despite our security measures, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee the absolute security of your data. In the event of a data breach that affects your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

7.3 Your Role in Security

You are responsible for maintaining the security of your account credentials. Use a strong, unique password and do not share your login details with anyone. Enable any security features we may offer. Contact us immediately if you suspect unauthorized access to your account.

7.4 Data Breach Response

In the event of a data breach, we will: (a) investigate promptly; (b) notify affected users via email within the timeframe required by applicable law (typically 72 hours under GDPR, where applicable); (c) notify relevant supervisory authorities as required; and (d) take appropriate steps to contain and remediate the breach.

8. Cookies and Tracking Technologies

8.1 What We Use

We use a minimal set of cookies and browser storage technologies:

Sign-in cookies: Strictly necessary cookies that keep you signed in, including across browser restarts, for up to a year or until you sign out.
Browser identifier cookie: a strictly necessary cookie holding a random value with no information in it, kept for up to two years, used only to recognise when several accounts are used from the same browser to get around usage limits (see §2).
Referral-source cookie: a first-party cookie, kept for up to 180 days, noting how your browser first reached Aelius and how it most recently arrived from somewhere else: the website that linked to us (its address, not anything you typed there), the first page you landed on, any campaign tags in the link (such as utm_source), whether the link came from an ad (the kind of ad, never the ad's identifier), and a count of visits. It is read once, when an account is created, to record where that account came from (see §2, “How You Found Us”). It is never shared with anyone and never used to follow you on other sites.
Human-check cookie: a strictly necessary cookie recording that your browser passed the human check. The check is repeated silently about every 12 hours, and the cookie is kept for at most 7 days. While a pass is in use, the server briefly remembers, in memory only and for about an hour, which networks and countries it was used from, so that one pass cannot be copied to many machines; this record is never written to disk.
Flask session cookies: Used to maintain application state and authentication between page loads. These contain a session identifier, not personal data.
localStorage (browser): We use browser localStorage to store your TOS agreement state (so you are not prompted to agree on every visit after first acceptance) and, when you open a shared project link while signed out, that link for 24 hours (see §3.8). This data is stored on your device, not our servers.

8.2 What We Do NOT Use

Third-party advertising cookies or trackers
Analytics cookies from services like Google Analytics
Social media tracking pixels
Cross-site tracking technologies

8.3 Cookie Control

You can control cookies through your browser settings. Note that disabling session cookies will prevent you from logging in to the Service. Clearing localStorage will reset your TOS agreement state and require re-acceptance on next visit.

9. Your Rights and Controls

Regardless of your jurisdiction, we respect the following data rights:

Access. Request a copy of the personal data we hold about you.
Correction. Request correction of inaccurate personal data associated with your account.
Deletion. Request deletion of your account and all associated personal data.
Portability. Request your data in a machine-readable format where technically feasible.
Objection. Object to processing of your personal data where we rely on legitimate interests.
Restriction. Request restriction of processing of your personal data in certain circumstances.

Projects, their knowledge and their memory are deleted with your account. “Download my data” includes your projects: their settings and instructions, the names of their knowledge files, their memory, and which chats are in them (the files themselves download from Files).

To exercise any of these rights, contact us at the address in §16. We will respond within 30 days, or within the timeframe required by applicable law. We may need to verify your identity before processing your request.

10. GDPR, for EU and EEA Users

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) applies to our processing of your personal data. This section describes your specific GDPR rights and our legal basis for processing.

10.1 Legal Basis for Processing

Contract performance (Art. 6(1)(b)): Processing your account data and chat history to provide the Service you have contracted for
Legal obligation (Art. 6(1)(c)): Complying with mandatory reporting laws (e.g., CSAM reporting)
Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement
Consent (Art. 6(1)(a)): Where you have provided explicit consent, including agreement to these Terms at registration

10.2 GDPR Rights

Under GDPR, EU/EEA users have the rights described in §9, plus:

Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting lawfulness of prior processing
Right to lodge a complaint: you have the right to lodge a complaint with your national data protection supervisory authority
Automated decision-making: we do not make decisions about you solely by automated means that produce legal or similarly significant effects

10.3 International Transfers

If your data is transferred outside the EU/EEA, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions. See §13 for details.

10.4 Data Protection Authority

You have the right to lodge a complaint with your national data protection supervisory authority if you believe our processing of your personal data violates GDPR. A list of EU supervisory authorities is available at edpb.europa.eu.

11. CCPA, for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information.

11.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information: identifiers (name, email, account ID), internet/network activity (usage data), and content you provide (chat messages).

11.2 Purposes of Collection

Personal information is collected and used for the business purposes described in §4 of this Policy.

11.3 "Do Not Sell or Share My Personal Information"

We do not sell or share your personal information with third parties for cross-context behavioral advertising. You do not need to opt out because we do not engage in this practice.

11.4 Your CCPA Rights

Right to Know: Request disclosure of personal information collected, used, disclosed, or sold about you
Right to Delete: Request deletion of personal information we have collected about you
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing: (We do not sell or share, so this right is already honored)
Right to Limit Sensitive PI Use: Request that we limit use of sensitive personal information to only what is necessary to provide the Service
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at the address in §16. We will respond within 45 days (with a possible 45-day extension when reasonably necessary).

12. Children's Privacy

Strict age restriction. This Service is strictly for users aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. The Service is designed for adults and is not appropriate for minors.

If we discover or are notified that we have inadvertently collected personal information from a minor, we will:

Immediately terminate the associated account
Delete all personal data associated with the account
Report to relevant authorities if required by applicable child protection law

If you are a parent or guardian and believe your child has created an account on this Service, please contact us immediately at the address in §16.

Pictures from the web that could show anyone under 18 are never shown in replies, and a report that one does blocks it for everyone at once (see §12.3 of the Terms).

This Service is not subject to COPPA (Children's Online Privacy Protection Act) in the context of deliberate child-directed collection, because we do not direct the Service at children. However, we comply with COPPA's requirements regarding inadvertent collection from minors under 13.

13. International Data Transfers

The Service is operated from the United States. If you are located outside the United States, your personal data will be transferred to, stored in, and processed in the United States. The data protection laws of the United States may differ from those in your country.

For users in the EU/EEA or UK, where we transfer personal data internationally, we will ensure appropriate safeguards are in place, which may include:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where the recipient country has been deemed adequate
Other lawful transfer mechanisms under applicable data protection law

By using the Service, you consent to the transfer of your personal data as described in this section.

14. Third-Party Links and Services

The Service may contain links to third-party websites, services, or resources. This Privacy Policy applies only to the Aelius AI Service. When you click on a link to a third-party site, you are subject to that third party's privacy policy, which we encourage you to review.

We have no control over and accept no responsibility for the content, privacy policies, or practices of any third-party sites or services.

The AI Model may reference or discuss third-party services, products, or websites in its responses. These references are not endorsements by Aelius AI, and we take no responsibility for the privacy practices of any services mentioned by the AI.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

Material changes will be notified via email to your registered address at least 30 days before taking effect, where reasonably practicable
The "Last revised" date at the top of this Policy will be updated
For significant changes, we may require you to re-confirm your acceptance

We encourage you to review this Policy periodically. Continued use of the Service after the effective date of any changes constitutes acceptance of the updated Policy.

16. Contact Us, Privacy Inquiries

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

Email: [email protected]
Subject line for access/deletion requests: Privacy Request — [Your Username]
Subject line for GDPR requests: GDPR Request — [Your Name]
Subject line for CCPA requests: CCPA Request — [Your Name]

We will respond to privacy inquiries within 30 days, or within the legally required timeframe for your jurisdiction. For urgent matters relating to children's data or security incidents, please mark your email as urgent.