Data Minimization

Our privacy-first stance means: we treat processing as a purpose-bound technical operation, not as an invitation to analyze your content.

No content analysis

We do not analyze documents or chat messages. Not for LLM training, not for advertising, not for profiling, and not for product analytics. When data is processed, it is processed for the function you are using.

No readable chat history on the server

We do not store chats as readable server history. This includes user messages and LLM responses. The chat state remains local on your device.

Temporary data instead of permanent storage

Server-prepared document and RAG data is stored only as long as needed for the concrete function. It is deleted afterwards. This temporary storage enables work with large documents, but it is not permanent document storage.

Metadata

A service cannot operate entirely without technical metadata. Depending on use, account ID, timestamps, file sizes, status values, quotas, error states, or expiration times may be processed.

We keep this data as purpose-bound as possible. It supports operation, security, quota accounting, and deletion, not content analysis of your chats or documents.

To detect waiting times and outages, our servers also measure operational values per request: for example the waiting time until the first answer, answer speed, token counts, how many history messages were sent along, and whether a request was rejected or failed. Content, file names, search queries, and an identifier of the individual chat are not part of this. Linked to your account, these values are kept for at most 90 days, afterwards only as daily totals without personal reference. The app sends nothing extra for this.

Web search

Web search is on by default; you can turn it off in the settings and for each message. When it is on, the AI model writes the search queries itself, and they can contain words from your current message. Before sending, a filter removes pseudonymization placeholders, contact details and identifiers such as phone, account or ID numbers, as well as names, numbers and longer passages from your documents and earlier messages. It does not detect names or health details that you write into the message yourself.

The search provider is Staan from Paris; German and English queries are currently answered mostly through a fallback operated in the USA. Only if Staan fails technically does the same filtered query go to Brave (USA). To check results, the model can fetch individual web pages from our server; the website sees the page address and our server IP, not yours. We do not store search queries or page addresses.

Your choice

You can combine functions according to your task: local document processing and optional server processing for large documents. The more confidential the content, the more strongly you should prefer local processing.

For documents with personal data, Pseudonymization adds an additional protective layer.