Skip to main content
How it worksCollaborateAppsYour privacyPricing
Legal

Privacy Policy

Your privacy is our foundation. Learn how we protect your data and what our commitments mean for you.

Effective Date: October 19, 2026

Strongwall, Inc., a Delaware corporation ("Strongwall," "we," "our," or "us"), operates the website, web application, mobile and desktop applications, and developer API ("Services") available under the brand Private.ai.

Strongwall, Inc. is the data controller for the personal information described in this Policy, meaning we determine why and how it is processed. Our contact details are provided in Section 16.

1. Definitions

For purposes of this Policy:

  • "Services" means the Private.ai website, web application, mobile applications for iOS and Android, desktop applications, and developer API.
  • "User," "you," or "your" means any person accessing or using the Services.
  • "User Content" means any text, files, images, or other material that you input into or generate through the Services.
  • "Processing" means any operation performed on data, such as transmission, temporary caching, or deletion.
  • "Session" means a single instance of user interaction with the Services.
  • "Local Storage" means storage on your device or in your browser used by the Services. How information is used, transmitted, and protected depends on the type of information, as described in this Policy.

2. Introduction and Scope

Strongwall was founded on the principle that your data belongs to you. We minimize the information we collect and retain. Your chat history is kept on your device. To generate an AI response, the content needed for your request is transmitted over encrypted connections and processed transiently in memory; it is not retained after ordinary AI processing. If you choose to submit conversation content for support review, we retain it as described in Section 5. We also retain account, usage, and payment records and encrypted attachments for the periods described in Section 10. Device sync and person-to-person messaging use end-to-end encryption, as described in Section 11.

3. Information We Collect

We collect the following information to provide, secure, support, and measure the Services:

  • Account data: account identifiers, authentication credentials and verification data, email if you choose an email-and-password account, and payment confirmation status.
  • Device data: basic device information, OS type/version, and limited access logs for abuse prevention.
  • Messaging metadata: information needed to register your devices, route and deliver encrypted messages, and manage messaging groups.
  • Payment data: information received from payment processors and app stores, including payment confirmations, customer and transaction references, subscription plans and status, billing dates, amounts, and refund records. We do not store your payment card details.
  • Developer API credentials: a hash of each API key used to verify it, its display prefix and optional name, the associated account, and creation, last-use, expiry, and revocation dates where applicable. We do not store the full API key after issuing it.
  • Developer API usage and billing: account-linked records of the model used, request times, input and output token counts, credit balances, and credit purchases, usage charges, refunds, and adjustments, including associated payment references. These usage and billing records do not contain your prompts or responses.
  • Website analytics: visits to public pages, page addresses, selected button clicks, and signup steps, recorded with random per-tab identifiers and campaign information. Query parameters other than campaign tags and advertising click identifiers are removed from page addresses before they are recorded. This page measurement stops when you sign in, except that the signup steps completed at that moment are still sent, under the same per-tab identifiers, for up to 10 seconds afterwards. When you sign up or sign in, the tab's identifier is sent with the request so that what was recorded in that tab is linked to your account.
  • App usage events: short records of what happened in the app, each a name from a fixed list with values from fixed lists or small counts — for example a signup, checkout or onboarding step, a plan chosen, a payment started, completed or cancelled, a sign-in that worked or did not and the broad reason it did not (such as wrong details, too many tries or no network, never what you typed), a free-chat reply received, the app opened and roughly how long it took to appear, a feature used (such as a new chat started, an attachment sent, a chat exported, a folder created, or a search run, without what was searched for), an action used on an answer (such as copy or share, without the answer), the answer to a notification prompt, the end of a session in the app with roughly how long it lasted (in broad bands such as under a minute or 5 to 15 minutes, never the exact time) and whether anything was done in it, which screen you left the app from and roughly how long you had been on it (in the same kind of broad bands), the price and currency the app store showed for a plan when you started a purchase, whether app lock, memory and custom instructions are switched on (not the content of the instructions) and a rough count of folders, or, for a request that failed, which part of the service it was for, its status code and the kind of failure. They never contain your prompts, responses, file names, email address, account number or anything else you typed. They are sent to our own servers, not directly from your browser or device to an analytics provider. Before you sign in they are recorded under a random identifier (in the web app, the per-tab identifier described above); while you are signed in, including in the web app, they are linked to your account. In our iOS, Android and Mac apps, when you sign up, sign in, or create an account by buying a subscription in the app, the app sends its random identifier in the request, and the events recorded under it before you signed in are linked to your account, as they are for a web tab; if that request did not carry it, they are linked the first time the app sends events while you are signed in. To do this, we store a record pairing the random identifier (an app's, or a web tab's) with a random analytics identifier for your account, not your account number or email address. One app install or web tab can be linked to only one account. The record is deleted shortly after your account is deleted, as described in Section 10. The iOS and Mac apps start a new random identifier when you sign out, so the next person to sign in on that device is not linked to the previous one; the Android app keeps one identifier per install until the app is uninstalled or its data is cleared. In the web app nothing is stored in your browser for them beyond that per-tab identifier. In our iOS and Android apps, each event also carries the major version of the phone's operating system (for example Android 16), and in our Android app the phone's maker (for example Samsung or Google), never its model. In our iOS and Android apps, each event may also carry a number from 0 to 99 that the app derives from the random reminders identifier described below; it is used to compare people who are and are not shown reminders, and the identifier itself is never included.
  • Product tests (apps): we sometimes show different versions of a screen or feature to different app installs to learn which works better. Which version an install sees is worked out each time from a hash of the app's random install identifier; no record of who was shown what is kept. To do this, the apps send that random identifier with their requests to our servers, including while you are signed in. It is the same random identifier the app records its usage events under. For product tests it is used only to work out the version and to limit how often one install can ask (a counter that expires within an hour), and it is not logged with the request. Sign-up and purchase requests do not use it to link anything to your account; a sign-in request does when the app has not sent the identifier in the request itself, and it is then linked to your account as described under App usage events above. While a test is running, the app usage events described above, and account events recorded during a request from the app (such as a sign-up or a purchase), carry which version of the test was shown. The website does not take part in product tests. What We Measure lists this as exp_<key>.
  • Apple ad-attribution reports (iPhone app): when someone installs our iPhone app after seeing or tapping an ad, Apple may send us a report about it through its SKAdNetwork or AdAttributionKit systems. Apple's reports contain no device identifier, network address or information about the person: only the ad network, the campaign, our app, a reference number Apple creates for the report, the app or website that showed the ad when Apple discloses it, and a broad value the app sets to show how far the install went (such as whether a trial or subscription started). We verify Apple's signature and keep these reports to measure which campaigns lead to installs. They are not linked to your account or to the app's install identifier.
  • Reminders and offers (iOS and Android apps, only if you turn it on): if you turn on "Reminders and offers" in the app, it registers with our servers so we can send you occasional reminders (for example, that you still have free replies) and offers. We store a random identifier created by the app for this purpose only, a one-way hash of a secret the app keeps, your device's push notification token (encrypted, with the key held separately from the database), your platform, the app version, your language, your time zone offset, the account stage the app reports (guest, member, subscriber or lapsed subscriber), how many free replies you have left, the day you last opened the app, when you agreed and which wording you agreed to, and records of which reminders were sent to you and whether you opened them. This record is not linked to your account, your email address, the identifier used for app usage events, your network address or your device model, and it never contains anything you wrote. On iOS reminders are delivered through the Apple Push Notification service and on Android through Google's Firebase Cloud Messaging, which receive the token and the reminder text to deliver it. The text of a reminder is written by us, never by you, and never includes a price.
  • Live Activities (iPhone): while you use the app as a guest, it may show your setup progress (such as how many free replies you have used, or a reminder to save your account number) as a Live Activity on your Lock Screen. It is created and updated on your device only; we do not send it updates, and it never shows what you wrote, prices, offers or your account number. We receive only an app usage event saying that one was started or tapped. You can turn Live Activities off in iOS Settings.
  • Anonymous failure and speed counts: counts of errors the app could not handle, parts of the site that failed to load, stored data on your device (such as a saved chat) that could not be decrypted or opened, the steps of a chat export, and how quickly each page loaded and responded, recorded only as a verdict (good, needs improvement or poor) for each of four standard speed measures, never the timing itself. Each is a name and a kind from a fixed list with a number, kept only as a daily total. They are sent without any identifier — no per-tab identifier, sign-in token, device identifier or account — and without error messages, page addresses or details of what failed, so they are not linked to you. Nothing is stored in your browser for them.
  • Service usage and account events: records linked to your account, including the AI model used, request and processing times, input and output token counts (measures of text length), tool-call counts, and events such as account creation, sign-in, subscription activity, and your first AI message. These usage records do not contain your prompts or responses.
  • Campaign attribution: campaign tags, advertising click identifiers, promo codes, and the landing pages you first and most recently visited, obtained from links you follow and your visits to our site. This information is stored in your browser and sent with your signup to associate the campaign with your account. Section 9 and our Cookie Policy describe browser storage.
  • Support reports: conversation content and report details you choose to submit, linked to your account, together with information such as the AI model involved. If your sign-in has expired when you send a report from the web app, the report is sent without being linked to your account, and you are told so when it is sent. Section 5 explains how we use these reports and their retention period.
  • Website enquiries: the message and any contact or organisation details you provide through our website forms. Submissions are stored in our database and emailed to the relevant team to handle your enquiry.
  • Sign-up country: the country derived from your sign-up request's network address, recorded as a two-letter code in an account-linked signup event and used for aggregate reporting. The network address itself is not retained in that event.

Providing account information is not a statutory obligation. To create an email-and-password account, you must provide both an email address and a password; without them, we cannot create that type of account. You can instead choose an account-number account, which does not require an email address. To sign in, you must supply the credentials for your chosen account type; without them, we cannot authenticate you. To activate a paid subscription, we need confirmation of payment from your chosen payment provider. Submitting conversation content for support review is optional.

4. How We Use Information and Our Lawful Bases

We use personal information to provide and support the Services, prevent abuse, maintain performance, measure usage and marketing effectiveness, and meet our legal obligations. Where UK data protection law applies, we rely on the following lawful bases:

  • Providing the Services — contract: we use your account and subscription information, and process the content you submit, where necessary to authenticate you, administer your subscription, deliver the features you request, and provide support under our agreement with you.
  • Security and reliability — legitimate interests: we use device information, access logs, and service usage metadata where necessary to protect accounts, prevent abuse, diagnose faults, and maintain a reliable service.
  • Checking reported errors — legitimate interests: after investigating a support report, we may retain it for the period described in Section 5 where necessary to check whether errors recur and improve service reliability.
  • Service measurement — legitimate interests: we use service usage metadata, account events, and signup country information where necessary to understand adoption and performance and improve the Services. For website-improvement statistics, we rely on legitimate interests only where the browser storage and access qualify for an exception to consent requirements and the conditions of that exception are met.
  • Marketing measurement and other non-exempt analytics — consent: where browser storage or access requires consent, including for advertising attribution, consent is the basis for the associated processing of personal information. Legitimate interests do not replace consent where it is required.
  • Reminders and offers — consent: we send reminders and offers through push notifications only after you turn on "Reminders and offers" and allow notifications. You can withdraw consent at any time by turning the switch off in the app's Settings (which deletes your reminders record) or by turning off notifications for the app in your device settings.
  • Meeting legal duties — legal obligation: we process personal information where necessary to meet obligations under UK law or other law recognised for this purpose by UK data protection law, including responding to data protection rights requests and handling privacy complaints. Where necessary to establish, exercise, or defend legal claims, we rely on our legitimate interests in protecting our legal rights.

Where we rely on legitimate interests, we consider whether our use of the information is necessary and whether your interests, rights, and freedoms override those interests. Section 17 explains your right to object and how to withdraw consent where consent is the basis for processing. We do not engage in targeted advertising, profiling, or resale of data.

5. How We Do Not Use Information

Strongwall operates under an ephemeral-processing model for ordinary AI requests: we do not retain prompts after processing or store your chat history, except for content you choose to submit in a support report as described below. Stored attachments are encrypted as described in Section 10. We do not train AI models on user data or sell or share your data with third parties for their own purposes. Strongwall cannot recover chat history that exists only on your device.

If you choose to submit a conversation report for support, we receive and store the conversation content and report details you submit, linked to your account (or, if your sign-in had expired when you sent it from the web app, not linked to any account, as the confirmation tells you), so our support team can investigate the issue and check whether errors recur. We retain these reports only for as long as needed for those purposes, up to one year from submission, and then delete them. Your applicable data protection rights, including the right to request deletion in the circumstances described in Section 17, continue to apply.

6. Infrastructure Providers

We use cloud hosting and infrastructure providers to operate the Services. Where they process personal information on our behalf, they do so under data protection agreements. Push notifications to our mobile apps are delivered through the Apple Push Notification service (iOS) and Firebase Cloud Messaging by Google (Android), which receive the device's push token and the notification needed to deliver it. The content-processing limits in Sections 5, 10 and 11 apply to our use of this infrastructure. Section 14 explains our international transfer safeguards.

7. Authentication and Account Security

Users authenticate using Strongwall-issued account keys or usernames/passwords. Data is encrypted with AES-256 at rest and TLS 1.3 in transit. Pseudonymous and anonymous accounts are supported.

8. Data Breach Notification

If a personal data breach occurs, we will promptly investigate and take steps to contain it and reduce its effects. Where UK GDPR applies, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals' rights and freedoms. Where a breach is likely to result in a high risk to affected individuals, we will also notify them without undue delay, subject to applicable legal exceptions. We will meet any other breach notification obligations that apply.

9. Cookies and Analytics

We set no cookies, on any part of the Services, and we load no third-party advertising or analytics scripts. We use self-hosted analytics to produce aggregate statistics about visits to the marketing site. This measurement uses no cookies and uses random per-tab identifiers to record visits and interactions, as described in Section 3. It stops when you sign in, apart from the signup steps sent in the 10 seconds after it. The app usage events described in Section 3 continue while you are signed in to the web app: they are sent to our own servers, linked to your account, and nothing is stored in your browser for them. The anonymous failure and speed counts described in Section 3 are sent without any identifier and store nothing in your browser. We also collect account-linked service usage metadata and account events, as described in Section 3.

Our apps send their random install identifier with requests to our servers so that product tests can work out which version to show, as described in Section 3. It is the same identifier the apps record usage events under before you sign in, and it is linked to your account when you sign up, sign in, or create an account by buying a subscription in the app, also as described in Section 3. Apple's ad-attribution reports for our iPhone app, also described in Section 3, contain no device or personal data and involve no cookies or browser storage. Neither applies to the website.

We use browser storage to maintain your sign-in session, remember your settings, and keep your chat history on your device. These functions are separate from the marketing measurement described below.

We also store campaign attribution information, including campaign tags and advertising click identifiers, in your browser for up to 30 days to measure which campaigns lead to signups and subscriptions. Section 3 describes how attribution information is associated with your account.

Clearing site data removes the information stored in your browser, including your locally stored chat history, but does not delete information already sent to us. Our Cookie Policy lists the browser storage items and explains how to inspect them. What We Measure lists every usage event and counter we record, with its purpose and the details it carries.

10. Data Retention and Deletion

Retention depends on the type of information:

  • Account and service metadata: we retain account profiles and events, device registrations, messaging group membership, daily and monthly usage totals, and developer API credentials and request-usage records until account deletion. The shorter periods for detailed AI request usage and message delivery records are described below.
  • Invoices and payment transaction records: we retain these records for tax and accounting purposes for seven years after the filing date or due date of the relevant tax return, whichever is later, including after account deletion. We retain records longer where required by applicable law or where necessary for unresolved tax proceedings, and delete them when that additional need ends. They are separate from the account event records described above.
  • Detailed AI request usage records: records become eligible for automatic deletion 48 hours after the request begins. Cleanup runs as new requests are recorded, so deletion may occur later than 48 hours. This period does not apply to developer API request-usage records.
  • Developer API financial records: records of credit purchases, usage charges, refunds, and adjustments follow the seven-year tax and accounting retention schedule described above, including its exceptions and retention after account deletion.
  • Encrypted AI attachments: we retain images and documents uploaded for use in AI conversations until you delete your account, at which point we delete the stored attachments.
  • Device-sync data: temporary encrypted copies are deleted when both devices confirm that sync is complete. Sessions older than five minutes are cleared when a new sync session starts, so incomplete sessions may remain longer during periods of inactivity.
  • Encrypted message delivery: queued messages are deleted when the receiving device acknowledges receipt. Unacknowledged messages expire 30 days after being queued and are no longer available for delivery. Temporary signals, such as typing indicators and receipts, expire after 60 seconds. Expired records are removed by cleanup scheduled to run hourly; deletion may take longer if cleanup is delayed.
  • Person-to-person messaging attachments: encrypted attachments expire 30 days after upload is initiated. Cleanup is scheduled hourly to delete expired attachments and their server records. Deletion may take longer if cleanup is delayed or storage is unavailable; failed deletions are retried.
  • Support reports: we retain reports only as long as needed to investigate issues and check whether errors recur, up to one year from submission, and then delete them, as described in Section 5.
  • Reminders and offers records: deleted when you turn "Reminders and offers" off in the app, when the app finds that notifications have been turned off for it, when Apple or Google tell us the push token is no longer valid (for example, after the app is deleted), or 60 days after you last opened the app, whichever comes first. Records of individual reminders sent are deleted after 31 days. We keep daily totals of reminders sent and opened that are not linked to any device or person.
  • App and tab identifier links: the record pairing an app's or web tab's random identifier with your account's random analytics identifier, described in Section 3, is deleted when the usage data linked to your account is erased, normally about 15 minutes after your account is deleted. If that erasure is delayed, the record is kept until it completes, so that the identifier cannot be linked to another account in the meantime. When your account is deleted we also immediately remove the identifier from our records of your sign-up and of the request that linked it.
  • Website enquiries: both the database records and resulting emails are retained indefinitely.
  • Apple ad-attribution reports: retained indefinitely for campaign measurement. They contain no device or personal data and are not linked to any account.
  • Backups: after information is deleted from our active systems, copies may remain in backups for up to seven days.

Strongwall cannot recover chat history that exists only on your device. Attachments are stored encrypted. AI attachments are decrypted temporarily to process your requests. Person-to-person messaging attachments remain end-to-end encrypted and cannot be read by Strongwall.

11. AI Data Processing

Ordinary AI processing is ephemeral: your prompt is processed transiently in memory to generate a response and is not retained after that processing. If you choose to submit conversation content in a support report, we retain that report as described in Section 5. Stored attachments are handled as described in Section 10. Your content, including content submitted in support reports, is never used to train models. AI inference necessarily requires your prompt to be readable, briefly, by the systems generating the response; it is protected by ephemeral processing and no-retention terms. End-to-end encryption — where not even Strongwall can read content — protects device sync and person-to-person messaging.

12. Security

Strongwall employs encryption (AES-256/TLS 1.3), firewalls, and strict access controls. No system is completely secure.

13. Legal Requests and Warrant Canary

Strongwall cannot disclose data it does not store. Where required by law, Strongwall may disclose information retained under this Policy to courts, regulators, or law enforcement authorities, limited to what is necessary to meet the legal requirement. Strongwall maintains a Warrant Canary program and publishes regular confirmations that no secret data requests have been received.

14. International Use

Strongwall is based in the United States. All server-side processing of personal information takes place in the United States. Information stored locally on your device remains on that device unless you use a feature that transmits it, as described in this Policy.

For transfers to our service providers that require safeguards under UK data protection law, we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, incorporated into our agreements with those providers. You can contact us at legal@private.ai for information about these safeguards or to request a copy.

15. Updates

We may update this Policy to reflect changes in our Services or how we process personal information. We will publish the revised Policy with an updated effective date and notify you of material changes through the Services or other appropriate means before those changes take effect. Where a change requires your consent, we will ask for it separately before beginning that processing.

16. Contact Information and Privacy Complaints

To ask a privacy question, exercise your data protection rights, or make a complaint about how we handle your personal information, contact us using either of the following:

  • Email: legal@private.ai
  • Mail: Strongwall, Inc., c/o A Registered Agent, Inc., 8 The Green, Suite A, Dover, Delaware 19901 USA

We will acknowledge your privacy complaint within 30 days of receiving it, investigate it without undue delay, keep you informed of our progress, and communicate the outcome without undue delay. This complaint acknowledgement period is separate from the deadline for responding to a data protection rights request.

If UK data protection law applies to your personal information, you also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Information about raising a complaint is available at ico.org.uk/make-a-complaint.

17. Your UK Data Protection Rights

If UK data protection law applies to your personal information, you have the following rights, subject to the conditions and exceptions provided by law:

  • Access: ask whether we process your personal information and receive a copy of it, together with information about our processing.
  • Correction: ask us to correct inaccurate personal information or complete information that is incomplete.
  • Deletion: ask us to delete your personal information in circumstances where the law requires us to do so.
  • Restriction: ask us to limit our use of your personal information in certain circumstances, such as while we check its accuracy.
  • Portability: receive personal information you have provided to us in a structured, commonly used, machine-readable format where we process it by automated means on the basis of consent or a contract. You may also ask us to transmit it to another controller where technically feasible.
  • Objection: object, for reasons relating to your particular situation, to processing based on legitimate interests. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the information for legal claims. You can object to processing for direct marketing at any time.
  • Withdrawal of consent: where we rely on your consent, withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, use the contact details in Section 16. We normally respond free of charge and without undue delay, within one month. We may request information reasonably necessary to verify your identity. Where the law permits, we may extend the response period by up to two further months because of the complexity or number of your requests; we will notify you of the extension and our reasons within the initial one-month period. Any adjustment to the deadline for identity verification or necessary clarification will be made only as permitted by law.

If we cannot fulfil all or part of your request, we will explain why and tell you how to complain to the ICO or seek a judicial remedy.

18. Automated Decisions

We do not currently make decisions about you based solely on automated processing that have legal or similarly significant effects. If we introduce such decisions, we will update this Policy and provide the required information about their purposes, how they work, and their likely effects before the processing begins. Where UK data protection law applies, we will provide the required safeguards, including a way to make representations, request human review, and challenge a decision.

19. Age Requirements

The Services are intended for people aged 18 or older, as required by our Terms of Service. If you believe someone under 18 has created an account, please contact us using the details in Section 16 so we can investigate.