Privacy Policy

1. Who is responsible

RemainAI runs the hosted service and is responsible for the personal data it processes. Privacy questions and requests: [email protected].

If you run your own copy of RemainAI from its source code, you are responsible for the data in it, not us.

2. What we collect

Your account

Your email address, display name, and a one-way hash of your password (never the password itself). If you sign in with Google or GitHub: that provider's account id, the verified email it reports, and your name as a starting display name. When you agreed to these terms, and which version.

What you put in

Notes, todos, rituals, words, tags and their instructions, folders, images and drawings you upload, the feeds you follow, and what the AI features produce for you. If you publish: your handle, bio, posts and responses.

Sign-ins

For each signed-in device: the kind of client, a label built from the browser's user agent (like "Chrome on macOS"), the most recent IP address and the country it is in (from Cloudflare, country only, never a city or position), and when it signed in and was last active.

Sign-ups

When an account is created: the IP address it came from (for IPv6, only the network part) and how it signed up. Used only to stop one source from making accounts in bulk.

Usage records

For each AI action and connector call: what it was for, when, and the credits it used. Usage records do not contain your content or search terms.

Payments

Your deposit addresses, and for each payment the network, transaction hash, sending and receiving addresses, token and amount. We never see card or bank details.

Telegram

If you link it: your Telegram user id, chat id, username and display name, and the messages you send the bot.

Server logs

For each request: the address requested, the result, the time, the IP address and its country, the device label, and which account made it if one was signed in.

Android app

A random id for the install, sent when it checks for an app update, used only to roll updates out in stages.

Posts readers

Anonymous visitors to RemainAI Posts are counted with a salted hash of IP address and user agent that changes daily, so a visitor can be counted once a day without being recognized again.

3. How we use it

Only to run RemainAI for you: to store and show your library, run the features you use, keep your account secure, stop abuse, bill plans, and send you the few emails the service needs (a welcome when you join, and password reset links when you ask).

We do not sell personal data, show ads, or build profiles for anyone else. We do not use your content to train AI models. The people who run RemainAI do not look at your content, except when you ask us to, when a post or response is reported, or when the law requires it.

Under data protection law, we rely on our contract with you (running the service you signed up for), our legitimate interest in keeping it secure and free of abuse, and legal obligations such as keeping payment records.

4. Who else processes it

These providers receive data needed for their part of the service. AI features send the relevant captured text, tag instructions and taxonomy, questions, attached or retrieved notes, words or articles. This also applies to Telegram, the command line and connectors. If an AI provider is unavailable, the same request and any tool results already retrieved may be sent to another configured provider. Your entire library is not sent automatically.

Anthropic

Runs the AI model. It receives the content an AI feature works on: a capture being filed under a tag, a note and its tag's instructions, a question and the notes it is answered from, a word being defined, an article being summarized. This includes captures sent through Telegram, the command line and connectors. We use Anthropic's commercial API: it does not train models on what we send, and keeps it only for a limited time under its own retention policy.

OpenAI

May run those AI features as a fallback. API data is not used for model training by default. We request that completions not be stored, but this does not disable abuse monitoring: OpenAI normally retains abuse-monitoring logs for up to 30 days, with exceptions under its data controls policy.

DeepSeek

May run those AI features as a fallback. DeepSeek is based in China and data may be processed there. Its handling of API data depends on the terms applicable to our API account; we do not promise zero retention or exclusion from training for DeepSeek. See its Privacy Policy and Terms. Do not put sensitive personal information into AI inputs.

Groq

Transcribes voice input, from the app or a Telegram voice message. The audio passes through our server to Groq and is not stored by us; only the text is kept.

Resend

Delivers our emails: your address and the message.

Cloudflare

Sits in front of every RemainAI address, so it sees each request and IP address in transit.

Hosting

Our hosting providers run the application and its database, and store encrypted backups in the EU.

Alchemy

Watches the blockchains we accept payment on for transfers to your deposit addresses. It sees those public addresses and transactions, not your account.

Only if you use them

Google or GitHub, when you sign in with them. Telegram, when you link the bot. dev.to, when you choose to cross-post there with your own key.

Some providers process data in the United States, China or other countries outside yours. Applicable safeguards depend on the provider and our agreement with it. Contact us for information about a transfer affecting your data.

The server fetches the feeds and articles you add directly from their sites, so those sites see a request from our server, not from you. Blockchain payments are public by nature: anyone can see a transaction on the chain.

5. Google user data

If you choose "Continue with Google", RemainAI asks Google only for the basic sign-in permissions: openid, email and profile. We do not ask for access to Gmail, Drive, Calendar, Contacts or any other Google service.

What we receive

Your Google account id, your email address and whether Google has verified it, and your name. Google also offers a profile picture; we do not use or keep it.

How we use it

Only to sign you in: the account id links your Google account to your RemainAI account, the verified email identifies the account and is where our few service emails go, and your name becomes your starting display name, which you can change.

What we store

The account id, the email and the display name, in our database with the rest of your account. The token Google gives us is used once to read these details and is not stored.

Who we share it with

Nobody. Your Google user data is not sold, not used for ads, not sent to the AI providers, and not used to train AI models.

Deleting it

Deleting your account removes it. You can also remove RemainAI's access at any time from your Google Account, under Security, Third-party apps and services.

RemainAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. What is public

Nothing, until you publish. A published post shows your handle, display name, bio, the post and its earlier versions, and the responses to it. Responses you write show your handle. All of it can appear in RSS feeds and search engines. Nobody else can see who you follow or which posts you reacted to.

7. How long we keep it

Your library is kept for as long as your account exists. Some things go sooner:

Trash

Deleted items are removed for good after 30 days.

Feed articles

For an article you have read and not saved, the stored text goes 14 days after reading and the rest after 30 days. Unread and saved articles are kept.

Connector log

30 days.

Sign-up records

30 days.

Sign-ins

A sign-in lasts at most 90 days. Ended ones are deleted about a week later.

Password reset links

Work for 30 minutes, once.

Backups

Rotate out after about two weeks.

Server logs

Kept for about a month, for security and fixing problems, then deleted.

8. Export and deletion

Settings, under Your data, has two buttons. Export downloads everything in your account as one file. Delete account removes your account and everything in it at once, including uploaded images. It cannot be undone.

A little outlives the account, by design:

• Payment records, no longer linked to you, kept for accounting. The transactions are on a public chain anyway.
• If someone replied to one of your responses, the response stays as an empty "deleted" marker so their reply still makes sense. Your words are removed.
• Anonymous read counts on other people's posts.
• Backups, until they rotate out.

9. Cookies and local storage

RemainAI uses no tracking or advertising cookies. This site sets none at all.

• The web app keeps you signed in with one secure, http-only cookie, and keeps a short-lived access token, a copy of your profile, your theme and a few display preferences in your browser's local storage.
• RemainAI Posts sets cookies only when you sign in there: a short-lived one while signing in, then one that keeps you signed in.
• The Android app keeps its sign-in in the phone's secure keystore. The command line keeps its sign-in in a file only your user can read.

10. Security

Everything travels over HTTPS. Passwords and sign-in tokens are stored only in hashed form, and third-party keys you give us are encrypted. Backups are encrypted before they leave the server. Any sign-in can be ended from Settings.

11. Your rights

You can see, export, correct and delete your data yourself in the app. You can also ask us to do it, ask what we hold, or object to how we process it, by writing to [email protected]. We answer within a month. You can also complain to your data protection authority.

12. Children

RemainAI is not meant for children. If we learn that an account belongs to a child too young to agree to the Terms, we delete it.

13. Changes

When this policy changes, the version number above goes up. If a change matters to you, we will say so in the app or by email before it takes effect.