Privacy Policy
1. The short version
Your chats belong to your account alone. We do not sell your data, we do not use your conversations for advertising, and we do not read them except where you ask us to (a report or support request) or the law requires it. We collect only what the service needs to run, and you can see and delete what we hold.
2. What we collect
- Account details: username, name, email address, and the optional location and timezone you enter, plus an invite code if you used one.
- How you found us: if you arrive by clicking one of our ads or a tagged link, we keep the click identifier the ad platform adds to that link (for Google Ads, the “gclid”) and the campaign tags, with your account, so we can tell which ads actually brought people who signed up. We use it only to measure our own advertising, never to profile you, and it is not linked to your conversations.
- Your content: your conversations with the AI, files you attach, and the optional memory notes the assistant keeps for you (which you can view and delete at any time in My settings → Memory).
- Billing records: when you buy Loony, we record the amount, date, card brand and last four digits, and the payment reference. We never see or store your full card number — payment is handled entirely on Square's hosted checkout page. Canadian tax law requires us to keep purchase and usage records for seven years; if you delete your account, those records are kept but anonymised so they no longer identify you.
- Technical basics: IP address and browser type for security, fraud prevention, and rate-limiting; error logs (which never include your conversation content).
3. How your conversations are used
To answer you, your messages (and attached files, and your saved preferences and memory notes) are sent, by way of OpenRouter — the routing service we use to reach model providers — to the AI model provider you selected for that chat. Providers process them to generate the reply. We choose provider configurations aimed at your messages not being used to train their models; the providers' own terms govern their processing. We do not use your conversations to train anything, and we do not sell or rent any of your data to anyone.
The models we offer are configured for zero data retention: the provider keeps nothing once the reply has been generated. That is a configuration we set, not a guarantee about a provider's future terms — so the retention period for every model is shown on the Models page, next to the model, before you choose it, and it is updated there if a provider's terms change.
Some replies are helped by an automatic web search, which we run for you without being asked. Before answering, a model we use for background tasks decides whether a search would help; it sees your message and your approximate region, taken from your profile or your timezone and never from GPS. If it decides to search, it writes a short search query, which may fold in that approximate region — for example “events in Ajax, Ontario” — and only that query is sent to our search provider, currently Brave Search, which handles it under its own terms. Your conversation itself is never sent to the search provider. The chat tells you when a search runs, and the charge for it appears in your ledger.
4. Who else touches your data
- OpenRouter — the routing service every model request passes through on its way to the provider that answers it.
- AI model providers — receive the content of the specific chat you send, as described above.
- Brave Search — receives the search query described above whenever an automatic web search runs. Tavily is a configured alternative we may switch to for the same purpose. Neither receives your conversation.
- Square — processes payments; your card details exist only there.
- Resend — delivers our emails (verification, password reset, receipts, and the welcome and tips described in §6). Emails never contain your conversation content.
- Railway (hosting) and Cloudflare (encrypted backups) — infrastructure on which the service and its encrypted backup copies run.
- Google Ads — when you arrive from one of our ads, Google's conversion tag records that a visit or sign-up happened, so we can tell whether the ad worked. It does not receive your conversations.
We do not use your conversation content for analytics, advertising, or profiling, and we do not sell or share it with data brokers.
5. Security and retention
All traffic is encrypted in transit (HTTPS). Passwords are stored only as salted hashes. Off-site backups are encrypted before they leave the server. Your conversations stay in your account until you delete them; deleting a chat removes it from the live service, and backup copies age out on a rolling schedule of roughly 30 days. Financial records are retained for seven years as Canadian law requires, in anonymised form after account deletion.
If something goes wrong. No safeguard is perfect, so here is what happens if ours fail. We keep an internal register of every security incident affecting personal information — whether or not it turns out to be serious — and we keep those records for at least 24 months, as Canadian law requires.
When we find an incident, we assess whether it creates a real risk of significant harm to anyone affected. If it does, we report it to the Office of the Privacy Commissioner of Canada as soon as feasible, and to the Commission d’accès à l’information du Québec where Quebec residents are affected. We also notify you directly, by email to your account address.
That notice will tell you what happened and when, which of your information was involved, what we have done about it, what you can do to protect yourself, and how to reach us with questions. We will not wait for certainty about the cause before telling you that your information was involved.
6. Your choices and rights
- See and delete individual chats, files, and memory notes at any time in the app.
- Turn the assistant's memory off entirely in My settings → Memory.
- Emails from us. Once your account is verified and approved we send one welcome email, then a short tip about using Ehi about every two weeks, in your interface language. Every one has a one-click unsubscribe link, which stops them for good; account emails such as receipts and password resets still arrive. We keep your email address on our mailing list together with whether you unsubscribed, including after you delete your account (deleting it also unsubscribes you), so that we never email you again against your wishes.
- Ask for a copy of the personal information we hold about you, or ask us to correct it.
- Delete your account: your chats, files, and profile are removed; billing records are anonymised and retained as described above; any unspent purchased balance is handled under the Refund Policy first.
7. Children
Ehi requires users to be at least 13, with parental consent below the age of majority. Child-designated accounts run with additional content restrictions. We do not knowingly collect personal information from children outside these controls.
8. Changes and contact
If this policy changes materially, we will tell you in the app or by email before the change applies. Questions and requests: support@ehi.chat. You may also complain to the Office of the Privacy Commissioner of Canada.