Privacy Policy

Who we are

This instance of ClearAI is operated by ClearAI, based in Slovenia (“we”, “us”) at clearai.website. If you have any questions about this policy or your data, contact us at hello@clearai.website.

Information we collect

• Account information — your email address, display name and, if you sign in with a third-party account, the profile picture it provides. Authentication is handled by Supabase Auth.
• Content you create — conversations and messages, files and images you upload, custom assistants, saved prompts, folders, memory and custom instructions, and your settings.
• API keys you add — encrypted with AES-256-GCM before they are stored. Keys are decrypted only on the server at the moment a request is sent to the matching provider, and are never sent back to your browser.
• Usage data — message counts, token usage and estimated cost per model, used to enforce free-tier limits and to power your usage statistics.
• Technical data — essential cookies that keep you signed in, and basic request logs (such as IP address and user agent) kept by our hosting provider for security and abuse prevention. Your theme preference is stored only in your browser.

How we use your information

We process account and content data to provide the service you request, and security and usage data for our legitimate interest in protecting it. Optional features are under your control. You can contact us about your data rights or complain to the Slovenian Information Commissioner.

• To provide the service: store your chats, run your requests and show you the results.
• To send your prompts to the AI provider you choose (see below).
• To enforce the free-tier allowance, prevent abuse and keep the service secure.
• To send essential service messages, such as sign-in and password-reset emails.

We never sell your data, we don’t show ads, and we don’t use your conversations to train AI models.

Where your data goes

Supabase

Your account, conversations, files and encrypted API keys are stored in a Supabase project (PostgreSQL database and file storage) operated on our behalf. Row-level security ensures each account can only access its own data.

AI providers

When you send a message, the conversation context — your prompt, earlier messages in the chat, attachments, and any custom instructions or memory you enabled — is sent to the AI provider behind the model you selected:

• Free tier: requests are sent to OpenRouter, which routes them to the provider hosting the free model. Some free-model providers may log or retain prompts, so avoid sharing sensitive information with free models.
• Your own keys: requests go directly to that provider (for example OpenAI, Anthropic, Google, xAI, Mistral or DeepSeek) or to the custom endpoint you configured, under your own account with them.

Each provider processes your data under its own terms and privacy policy, which we encourage you to review.

Web search

When web search is used, your search query is sent to the search provider (such as Tavily or Exa) to fetch results.

Hosting

The application is hosted by Vercel, which processes requests and logs on our behalf.

Shared links

Service email

Supabase sends authentication messages through Resend. Cloudflare Email Routing forwards messages sent to our support address to our support inbox. These providers process delivery and email metadata.

Shared links

If you create a share link, a snapshot of that conversation becomes readable by anyone who has the link until you revoke it. Signed-in users with the link can copy the conversation into their own account.

Retention and deletion

We keep your data for as long as your account is active. Deleted conversations and files are removed from the database and storage; service logs and any backup copies follow our providers’ retention policies. Contact us for information about a specific deletion request. When you delete your account, your profile, conversations, files, API keys and share links are deleted.

Your controls and rights

• Export all of your data at any time from Settings → Data.
• Delete your account and all associated data from Settings → Data.
• Remove or replace API keys, and revoke share links, whenever you like.
• Turn memory off or clear what it has saved.

Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you may have additional rights to access, correct, restrict or object to processing of your personal data. To exercise them, contact hello@clearai.website.

Security

Data is encrypted in transit with TLS. API keys are encrypted at rest with AES-256-GCM, and database access is restricted with row-level security. No system is perfectly secure, but we work hard to protect your information and will notify you of any breach as required by law.

Cookies

We only use cookies that are strictly necessary to keep you signed in. We don’t use advertising or third-party tracking cookies.

Children

ClearAI is intended for adults aged 18 and over, and we don’t knowingly collect children’s personal information.

International transfers

Our service providers and the AI providers you choose may process data in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Changes to this policy

We may update this policy from time to time. We’ll change the date at the top and, for material changes, let you know in the app or by email.

Contact

Questions or requests: hello@clearai.website. See also our Terms of Service.