Privacy policy

The controller of your personal data is the operator of Alex AI (registration details will be completed before payments go live). For anything to do with data: [email protected].

Account: your e-mail address and how you sign in (a password as a hash, or Google / Apple sign-in).

Profile: your first name and your answers to the opening questionnaire (an age bracket, confidence, what holds you back in conversations) plus your Alex settings (tone, how hard to play it). Those answers personalise the suggestions — nothing more. Your date of birthis given once, on the way in, so we can check you are an adult — it stays in your browser's storage and never reaches our servers. Only an age bracket derived from it is saved to the account.

Content: the text of your conversations with Alex, notes, sparring transcripts, profile scores — and text derived from the conversations you analyse (for example the message you are asking about). Screenshots and photos are point 03, because they work differently from most apps.

Payments: e-mail and transaction data; card details stay with Stripe.

Technical data: a device identifier (a cookie and an entry in browser storage), product events (for example “message sent”, “paywall opened”) in our own database — with no external analytics — and an IP address processed briefly for security limits.

If you create an account with the “Continue with Google” button, Google passes us your email address and whether it is verified, the name shown on your Google account, the address of your profile picture, and the identifier of that account. That is all of it: the scopes we ask for are email and profile. We never receive your password, and we have no access to Gmail, Drive, contacts, calendar or any other Google service.

The email address is what creates and identifies the account, and where account messages go. The name becomes the display name you see in the app, and you can change or clear it in settings. The profile picture is not displayed anywhere and is not used for anything.

We do not use data received from Google for advertising, we do not build marketing profiles from it, we do not sell it, and we do not share it with anyone outside the processors named in section 07, who handle it only on our instructions. Alex AI’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke that access at any time from the permissions page of your Google account. Disconnecting Google does not delete your Alex AI account: to remove the account and its data, use account deletion in settings (section 09).

Chat screenshots and profile photos are compressed on your device and sent over an encrypted connection to the AI model to generate a reply. We do not store full-size screenshots anywhere — our database is technically prevented from accepting them. What remains after the analysis is text (the quote, the read of the situation, the suggested replies) and a heavily compressed thumbnail of the screenshot (about 200 px, a few dozen kilobytes), which we keep in a private, encrypted store so your history looks the same on every device you sign in on.

The thumbnail goes when the conversation it belongs to goes (permanently, at the latest when the conversation is deleted server-side), and with the account. Thumbnails from the profile score stay in your browser's storage only and are not synced — you remove them with “Clear device” in your profile.

The conversations being analysed involve somebody else too. You upload them for your own private use and on your own responsibility — make sure you have the right to. On our side we minimise the trace: images are not stored (point 03), and the database keeps only the text needed to maintain your history (for example her first name as the conversation title, and the quote being analysed). That content can touch on private life — we process it solely on your explicit instruction and solely to generate a reply. The person it concerns can ask for it to be deleted by writing to [email protected].

Providing the service (Art. 6(1)(b) GDPR): analysing conversations, generating suggestions, the account, history, syncing between devices, running the subscription.

Legitimate interest (Art. 6(1)(f)): security and limits (protection against abuse), our own product statistics, pursuing claims.

Legal obligation (Art. 6(1)(c)): accounting and tax documentation.

We do not sell data, we do not show ads, and we do not train models on your content. No decisions about you are taken by automated means within the meaning of Art. 22 GDPR.

Supabase — database and authentication (region: Frankfurt, EEA). OpenRouter — access to the AI model (currently Google Gemini): it receives, in flight, the content needed to generate a reply — screenshots, text, context from the questionnaire — never your e-mail or account identifier; the model provider may not use that content for anything but generating the reply. Stripe — payments (e-mail, transaction data; the card stays with Stripe). Vercel (USA) — hosting. Resend — transactional mail (sign-in links, confirmations; it receives your e-mail address). If you sign in with Google or Apple, those providers act as independent controllers of their own sign-in services.

Transfers outside the EEA (OpenRouter, Vercel, Stripe, Resend) are made on the basis of standard contractual clauses or an adequacy decision (the Data Privacy Framework).

Account and content — until the account is deleted (removed immediately, cascading). A single deleted conversation disappears from the app at once, and its data is permanently erased from the database within 90 days at the latest. Product events — up to 180 days. The anonymous free-message counter — up to 90 days from the device's last activity. Billing documentation — for the period tax law requires. Full-size screenshots — not kept at all; thumbnails live exactly as long as the conversation they belong to (point 03).

You have the right of access, rectification, erasure, restriction of processing, portability and objection — and to complain to a supervisory authority. Ours is the Polish President of the Personal Data Protection Office (UODO); if you live in another EU country you may complain to your own authority instead. Two of these you can do yourself in your profile: download your data (the lot, as a JSON file) and delete your account. For the rest, write to [email protected].

Important: deleting your account does not cancel an active subscription — cancel it first under “Manage subscription”, or write to us and we will do it for you.

We use strictly necessary mechanisms only: a sign-in session cookie, a signed device-identifier cookie (free-message limits, valid for a year), an interface-language cookie (it records the language version you are reading so that the site and the app speak the same one; valid for a year, and changed with the language switch), and browser storage, where your conversations and thumbnails live. There are no advertising cookies and no third-party tracking scripts — which is why you will not see a consent banner. You clear the app's storage with “Clear device” in your profile.

Data travels over encrypted connections only. Access to the database is protected by row-level isolation (each account sees only its own data), and service keys never reach the browser. The most effective safeguard remains the architecture: what we do not store — full-size screenshots and card details — cannot leak, and thumbnails live in a private store fenced off per account.

We will give notice of material changes in the app, in advance. The date of the last update is always visible at the top of this page.