Your data. Your decisions.
What we store
Account email, password hashes, original chat messages, compact conversation summaries, explicitly saved memories, private images/documents, extracted document text, source citations, previously submitted public search queries, request usage and financial records. The owner can also store an encrypted provider key; it is never returned through the settings API. Conversations sync using your account.
AI processing
When enabled, your selected provider (OpenAI, Google Gemini, Meta, Anthropic (Claude), xAI (Grok), DeepSeek or Alibaba Qwen) receives your message, relevant history, a compact incomplete summary, relevant original excerpts, opted-in memories and selected images. OpenAI, Meta and Grok responses are requested with provider storage disabled; Gemini, Claude, DeepSeek and Alibaba Qwen use stateless requests without a stored interaction ID; provider safety and retention policies still apply. Owner-enabled live testing sends real provider requests and costs real USD, even when using test app credits. Automatic compaction sends bounded older chat excerpts and the previous summary to the selected text model; original messages are retained.
With automatic images enabled, unclear image follow-ups may send your current instruction and a short recent text excerpt to OpenAI Luna to decide whether to edit or reply. This check excludes photo bytes, documents, saved summaries and cross-chat memories, including when you selected a different chat provider. A requested image uses your selected image model and one chosen reference. Confirmed intent checking and image processing use credits. Choose Text only to skip automatic image routing.
Image Studio and hairstyle helper (admin beta)
Studio requests send only the selected prompt, visual preferences and reference images to the chosen image provider, with no chat history, memories or public search. The optional hair check sends the chosen selfie to Luna for styling observations; you confirm hair preferences separately before generating. Studio uploads and generated files have a 250 MB account allowance and expire after 90 days unless a separately configured entitlement says otherwise. Favorites and folders do not extend expiry. Expired files stop being served and the worker removes them from active storage. Prompts, usage and financial history remain saved; normal backup rotation and provider retention policies still apply. Existing chat-media retention is unchanged.
Documents and public web lookup
Document uploads are privately stored and parsed on the server. Bounded extracted text can enter the current reply and later follow-ups in the same chat; the original document binary is not sent to OpenAI. Extraction can omit content and does not provide OCR. PDF answer exports are rendered on demand without another AI request and are not stored as another permanent file.
Web lookup is optional for each request. The app may choose a public query when sending, or the assistant may suggest one for a follow-up draft. The question supplies public search terms automatically; optional Web activity shows lookup context. Send authorizes lookup under your limits. A URL is optional. Only fixed instructions and public query data go to the separate OpenAI planning/search stage. If the administrator selects Brave, public search terms derived from that public input go to Brave Search; full private context does not. Brave ranking uses South Africa/English defaults, without sending GPS, client IP or browser cookies. For short follow-ups with Web enabled, this can include one verified earlier public query from the same chat, within the recent-message allowance. Full private history, summaries, memories and attachments are excluded. The public query is saved with its chat for later follow-ups and is deleted with the chat; backup copies remain until rotation. OpenAI may use search providers or indexed content. Bounded results and source URLs then enter a separate tool-free reply alongside normal private context. Keep secrets and private information out of questions intended for public search. Phone saving can open your device's share sheet; you choose whether and where to share a file.
Memory is optional
Memory starts off. Add, edit and remove facts yourself in Memory & preferences. Cross-chat memories are not saved automatically. Disabling memory excludes it from new requests globally or for a chosen chat. Saved memories are not erased by the switch. Already submitted provider requests cannot be unsent.
Retention and deletion
Chats and memories remain until you delete them. Deleting a chat removes originals, its summary, private files, quotes and chat-sourced memories. Retrieval uses original messages in this chat’s database records; there is no external vector index. Unsubmitted uploads are removed after 24 hours.
Account deletion removes account and conversation data after pending billing is resolved. Retained financial records are disconnected from the account. Final lawful financial-retention periods need owner approval. Proposed backup retention is 30 days. Backup copies persist until rotation; administrators must replay deletion records after a restore. Code and database rollback snapshots retain the last three updates and may also contain deleted data until removed. Removing the saved provider key or deleting its owner account removes active credential ciphertext; backup copies can remain until rotation.
Providers and responsibilities
Chatify runs on the owner’s server. Enabled AI processing uses OpenAI, Google Gemini, Meta, Anthropic (Claude), xAI (Grok) or DeepSeek as selected. Meta uses Standard-mode IDs; Contributor mode, which permits model training on submitted content, is not configured. Changing providers in a chat sends the selected history, summaries and attachment excerpts to that provider. The administrator must use a paid Google API project and review its data-processing terms; free-tier terms differ. All provider keys are encrypted on the server; Bob Pay supports separate sandbox checkout and owner-only real-payment testing. New Yoco checkout is paused; existing payment notifications remain supported. A checkout sends the payer email, purchase reference, amount and bundle description to the selected payment provider. Necessary encrypted payment credential revisions and frozen order details can remain for financial verification after account deletion; financial-retention periods require owner approval. Real Bob Pay payments are enabled only for the owner’s payment test, using a separate purchased-credit ledger. Ordinary invited users cannot start real checkout during this pilot. Before live launch the owner must confirm POPIA notices, responsible-party details, processor contracts, cross-border processing, backup location, a deletion register and the final retention schedule.
Contact and controls
Proposed support address: [email protected]. The owner must verify this mailbox before launch. Ask for access, export, correction or deletion there. Essential session and CSRF cookies keep sign-in secure. No advertising trackers are installed.