Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and profile image (provided by you or your OAuth provider). We also store your authentication method and account role.

Usage Data

We collect information about your interactions with the Service, including conversation content, uploaded files, extracted file text, images, generated artifacts, tool inputs and outputs, request logs, AI model usage, token consumption, IP addresses, and related metadata for service operation, security, troubleshooting, abuse prevention, and rate-limiting purposes.

Security Tool and Sandbox Data

If you use security, reconnaissance, file analysis, code execution, MCP, or sandbox features, we may process targets, domains, URLs, IP addresses, file names, file contents, commands, generated files, tool results, and execution logs needed to perform the requested action.

Payment Information

Payments are processed by Stripe. We never receive or store your card details — all payment information is handled directly by Stripe and subject to their privacy policy.

2. How We Use Your Information

• To provide, maintain, and improve the Service
• To process your prompts, files, images, tool calls, and generated outputs
• To generate AI responses and route requests to selected or configured model providers
• To run security tools, sandbox commands, file analysis, web search, image generation, and related workflows
• To manage your account and subscription
• To enforce our Terms of Service
• To prevent abuse and protect against unauthorized access
• To communicate with you about your account when necessary

3. Data Sharing

We do not sell your personal data. ShadeGPT processes your prompts, conversation history, uploaded files, images, tool outputs, generated artifacts, and related metadata to provide AI responses and app functionality. When you use hosted AI models or external tools, this content is sent to the selected model provider or tool provider as necessary to fulfill your request.

• AI Providers: Prompts, relevant conversation context, files, images, and tool outputs may be sent to hosted model providers to generate responses
• Custom Endpoints: If you configure a custom model endpoint, content is sent to that endpoint according to your configuration
• Search, Image, and Security Tool Providers: Queries, files, URLs, domains, IP addresses, hashes, or other inputs may be sent to providers such as search, image generation, malware scanning, vulnerability, breach, or reputation services when you use those features
• OAuth Providers: Minimal profile data is exchanged during authentication
• Email Providers: Email addresses and message content may be processed to send verification, password reset, and account-related emails
• Payment Processors: If paid billing is made available, billing information is shared with the applicable payment provider for subscription management

Local or self-hosted model endpoints may keep requests within infrastructure you control, depending on how you configure them. You are responsible for the privacy and security of custom endpoints, MCP servers, proxies, and third-party services you choose to connect.

4. Data Storage and Security

All data transmitted between your browser and ShadeGPT is encrypted in transit using HTTPS/TLS. Code execution and file analysis run in isolated sandbox containers that are scoped per user and per conversation — your files and execution environment are not accessible to other users.

We do not sell your personal data. We do not use your conversations or uploaded content to train AI models.

We take additional technical and organizational steps to protect stored data. As a security-focused platform we treat this seriously — but no system is completely immune to risk, and we cannot guarantee absolute security.

5. Cookies

We use essential cookies to maintain your session and preferences (personality, model selection). These cookies are necessary for the Service to function and cannot be disabled. We do not use tracking or advertising cookies.

6. Data Retention

We retain account data, conversations, preferences, subscription records, request logs, usage records, uploaded files, extracted file content, generated artifacts, sandbox session files, and security logs for as long as reasonably needed to provide the Service, maintain account history, troubleshoot issues, enforce limits, prevent abuse, and comply with legal obligations.

Sandbox session files and temporary generated files may be removed during routine cleanup or server maintenance. Some records may be retained after account closure where needed for security, abuse prevention, billing, legal compliance, backups, or dispute resolution.

7. Your Choices and Requests

You may contact us to request access to, correction of, export of, or deletion of personal data associated with your account. We will review requests based on the information available to us and applicable legal, security, abuse-prevention, and operational requirements.

• You can delete individual conversations or content where the Service provides that option
• You can delete your account at any time from the Plans & Billing page ("Account & Data" section), which closes your account and cancels any active paid subscription
• You can export a copy of your account-related data from the Plans & Billing page ("Account & Data" section)
• You can choose which model provider, custom endpoint, MCP server, and tools to use where those options are available

8. Third-Party Services and Links

The Service may connect to or link to third-party websites, model providers, APIs, MCP servers, search providers, image providers, security data providers, OAuth providers, email providers, and payment providers. We are not responsible for the privacy practices, security practices, content, retention policies, or terms of third-party services. We encourage you to review the policies of any third-party services you access or configure.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 13. We do not knowingly collect personal data from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after any changes constitutes acceptance of the updated Policy. We will update the "Last updated" date accordingly.

11. Contact

If you have questions about this Privacy Policy, your data, deletion/export requests, or abuse reports, please contact us at admin@mail.shadegpt.app.