Privacy Policy

1. Who we are

AI·Thoughts (“AiTo,” “we,” “us”) is a public community where people share how AI makes them feel — in words, voice, or video. Contact: keepers@ai-thoughts.app or the contact form.

2. Privacy by design (how we protect you)

Privacy is not only this page — it is built into how AiTo works:

• No passwords. Sign-in uses short-lived email codes. Codes are stored hashed and expire quickly.
• Email encrypted at rest. We do not keep your email in plain text in the database. Session cookies never carry your email.
• Public vs private split. Only what you publish (takes, handle, display name, likes, replies) is public. Email, push endpoints, digests, and reports stay private.
• Delete means delete. When you remove a take or wipe your account, we remove related database records and delete your voice/video/avatar files from our media storage when they are ours to delete.
• PII scrubbing outbound. If you use Translate, emails, phone numbers, and IP-looking strings are stripped before text leaves our servers. Report snippets for keepers are scrubbed the same way.
• No ad tracking. We do not sell your data, run ad trackers, or use your posts to train public AI models.
• Browser privacy headers. The site sends strict referrer, framing, and permissions policies (no geolocation; camera/mic only for recording you choose).

3. Information we collect

• Account. Email address (encrypted at rest), display name, handle, and when you joined. Sign-in uses a one-time code emailed to you — we do not store passwords.
• Content you share. Text, voice/video files, feeling, language, tags, replies, likes, and a content fingerprint used for integrity and abuse prevention.
• Activity. Reports you file, “feel with” relationships, optional push-notification subscriptions, and optional email-digest preferences.
• Technical. A signed session cookie after you sign in, plus basic request logs (e.g. approximate IP for rate limits and security). On your device we may use local storage for profile preferences and draft state. Browser timezone/language may be used on-device for regional ranking and are not stored as precise GPS location.
• Optional translation. If you choose “Translate,” a PII-scrubbed copy of that text is sent to our translation provider (emails/phones stripped first) to return an English version.

4. How we use it

• Run the service: accounts, publishing, feed, replies, and likes
• Send sign-in codes and (only if you opt in) digests or push alerts
• Keep the community safe: dignity checks, reports, rate limits, and integrity
• Improve reliability and fix bugs
• Respond to privacy or removal requests

We do not sell your personal information. We do not use your content to train public AI models.

5. What's public

Published takes, your handle, display name, likes, and replies are public — anyone can see them. Your email, push endpoints, digest settings, session cookie, and reports you file are private.

6. How media is handled

Voice and video you upload are stored in cloud object storage and served with a public URL so others can play them in the feed. When you delete a take or your account, we delete those media files from our storage when they are hosted by us. We may compute a SHA-256 fingerprint of media or text to help detect tampering or duplicates.

7. Cookies and similar tech

We use an essential session cookie so you stay signed in. We are not a tracking-ad product: we do not run third-party advertising cookies for cross-site ads. You can clear cookies and local storage in your browser or app settings; that will sign you out.

8. Service providers

We use trusted processors to host and operate AiTo, including hosting and serverless compute, database storage, media storage, transactional email (sign-in codes and digests), and optional on-demand translation. They process data only to provide those services to us, under their own terms and security practices.

9. Retention and your choices

Public posts stay until you delete them or we remove them for safety. Session data lasts while you stay signed in. OTP codes expire quickly. You can:

• Delete your own takes while signed in
• Download a copy of your data or delete your account from You → Your privacy
• Turn off push or email digests in You → Daily habits
• Ask for help via contact or keepers@ai-thoughts.app

10. Children and families

AiTo is meant for a broad audience. If you are under the age where you can agree to online services in your country, ask a parent or guardian before using the app. Do not post names, addresses, school details, phone numbers, or other identifying info about yourself or others. Parents can contact us to request removal of a child's account or content.

11. International users

We may process and store information in the United States and other countries where our providers operate. If you use AiTo from elsewhere, you understand that your information may be transferred to those locations.

12. Security

We use encryption in transit (HTTPS), encrypt emails at rest where designed, hash sensitive identifiers, and limit access to operational data. No method of transmission or storage is 100% secure — please use a strong email account and never share sign-in codes.

13. Changes

We may update this Privacy Policy. We will change the “Last updated” date above. Continued use after an update means you accept the revised policy. Material changes may also be noted in the app or by email when appropriate.

14. Contact

Privacy and data requests: keepers@ai-thoughts.app. Or use https://ai-thoughts-mu.vercel.app/contact.

Canonical policy URL: https://ai-thoughts-mu.vercel.app/privacy