OZYRA PRIVACY POLICY

This Privacy Policy explains how Ozyra ("we", "us") collects, uses, shares, and protects information when you use our website, applications, AI features, billing flows, and related services ("Services").

Ozyra acts as the controller for account, billing, product, usage, support, and local-first sync data that we decide how to process. AI providers, payment processors, hosting providers, authentication providers, and other vendors may act as independent controllers or processors depending on the feature you use and their own terms.

Contact: ozyrachatapp@gmail.com. If you need the registered operator details for a formal legal request, include that in your message and we will provide the current details.

Information you provide

• Account data (e.g., email, name) when you sign up via supported providers.
• Messages, prompts, system/personality instructions, uploaded files, images, PDFs, notebooks, document text extracted for retrieval, and other content you submit.
• Feedback posts, votes, bug reports, support requests, feature requests, and any contact details you include in them.
• Billing details processed by Stripe (we do not store full payment card numbers).
• Optional bring-your-own API keys and tokens for supported providers. Local keys are stored on your device; cloud-synced API keys are stored as encrypted key material.

Information collected automatically

• Device and browser information, IP address, approximate location derived from network signals, language, timezone, and request metadata.
• Usage data such as pages visited, features used, selected models, quota usage, token or point estimates, generation IDs, errors, latency, and diagnostic logs.
• Local browser data such as IndexedDB, localStorage, sessionStorage, and cookies for local-first conversations, settings, preferences, anonymous quota, authentication, and security.

Information from third parties

• Basic profile information from authentication providers (e.g., Google, GitHub) when you sign in.
• Payment status and subscription details from Stripe.
• Model, search, image generation, embedding, reranking, and usage metadata returned by AI and search providers.

• Ozyra is local-first. Conversations, settings, profiles, notebooks, generated content caches, and mutation queues may be stored in your browser first using IndexedDB and related browser storage.
• If you sign in and enable or use cloud features, eligible data may sync to Supabase so you can access it across devices, recover work, and use premium features.
• Clearing browser site data can permanently remove local-only data that has not synced. Deleting synced data in-product removes it from our cloud systems subject to retention needs described below.

Depending on where you live, privacy law may require a legal basis for each processing purpose. We primarily rely on:

• Contract: to provide chat, AI generation, notebooks, image tools, account access, sync, subscriptions, and support you request.
• Legitimate interests: to secure the Services, prevent abuse, debug errors, measure reliability, improve product performance, and enforce reasonable usage limits.
• Consent: where required for optional analytics, non-essential cookies, marketing communications, or other optional features.
• Legal obligation: to keep required billing, tax, accounting, security, consumer protection, or legal records.

We use information to provide and improve the Services, authenticate users, sync data, process payments, respond to requests, operate AI and search features, monitor abuse, enforce quotas, and comply with law.

• Your prompts and context are routed via OpenRouter to AI providers including Google (Gemini), OpenAI (GPT), Anthropic (Claude), xAI (Grok), DeepSeek, Meta (Llama), Mistral, Moonshot (Kimi), MiniMax, and Zhipu (GLM).
• Image Studio and image generation may send prompts, reference images, previous image context, generated images, provider metadata, and model output text to OpenRouter and the selected image model provider.
• Notebook and document features may extract text from uploads, split it into chunks, generate embeddings, store chunks and vectors in Supabase, retrieve relevant excerpts, and optionally rerank results before sending context to an AI model.
• Web search sends the search query and related context to Tavily unless you use your own Tavily key, in which case Tavily processes the request under your account relationship.
• We have opted out of provider training programs where possible. Providers may have their own policies; review them if you use their models.
• If you bring your own API key or token (Anthropic, OpenAI, Google, GitHub Models, GitHub Copilot, or Tavily), requests go directly to that provider and you control that provider's data, retention, and training settings.
• AI outputs can be inaccurate or incomplete; do not rely on them as professional advice.

We do not sell your personal data.

• OpenRouter and AI model providers: to generate text, reasoning, embeddings, reranking, images, and related provider metrics.
• Supabase: Authentication, database, and cloud sync for your account data, conversations, notebooks, documents, generated images, usage, and settings.
• Vercel: Hosting, serverless execution, security, analytics, and performance measurement when enabled.
• Stripe: Payment processing and subscription management.
• Google and GitHub: Authentication, profile data, GitHub device flow, GitHub Models, and GitHub Copilot access when you use those features.
• Tavily: Web search queries and retrieved search results when web search is enabled.
• Legal and safety: When required by law, legal process, or to protect rights, safety, and integrity of the Services.

We use cookies and similar technologies for essential functions, preferences, security, anonymous quota, authentication, and analytics when enabled. Essential cookies are needed to run the Services; optional analytics cookies or scripts should only be used where permitted by law and your choices.

Current first-party cookies

• anon_id: signed anonymous identifier used for anonymous quotas and abuse prevention. Typical duration: up to 12 months.
• locale: language preference. Typical duration: up to 12 months.
• Supabase auth cookies: authentication/session management for signed-in users. Duration depends on Supabase session settings.
• csp_nonce: short-lived security value used for Content Security Policy support.
• gh_device_state / gh_device_rate_limit: temporary GitHub device-flow and rate-limit cookies when connecting GitHub Copilot. Typical duration: minutes.

You can control cookies through your browser and, where available, in-product controls. Blocking essential cookies may prevent login, language preferences, anonymous usage, or security protections from working correctly.

• Local data: kept on your device until you delete it in-product, clear browser site data, or the browser removes it.
• Cloud-synced product data: kept while your account is active or until you delete the item/account, subject to backup, security, and legal retention.
• Uploaded notebook files: may be stored temporarily while processing; extracted text, chunks, metadata, and embeddings can remain until the document, notebook, or account is deleted.
• Generated images and image inputs: stored while needed to provide history, editing, audit, and recovery features, until deleted or account deletion is completed.
• Usage and quota records: kept as needed for quota enforcement, abuse prevention, billing reconciliation, and analytics. Anonymous quota identifiers may be retained separately from account records.
• Billing records: retained as required by Stripe, tax, accounting, and legal obligations.
• Security and diagnostic logs: retained for limited periods based on operational, security, and provider log settings.

Account deletion removes the Supabase auth user, user-scoped usage rows, user storage objects, and cloud data that cascades from the account profile where supported by our database relationships. Some records may remain where required by law, retained in backups until they expire, or held by third-party providers under their own retention rules.

• Access, export, correct, or delete your data (where available in product or via request).
• Manage cookies in your browser.
• Disable cloud sync where available and keep data local to your browser.
• Remove optional API keys from your device or encrypted cloud sync.
• Opt out of non-essential communications; you will still receive transactional messages.
• If you are in the EEA, UK, Switzerland, or a region with similar laws, you may have rights to access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your local data protection authority.

We use industry-standard measures such as TLS encryption in transit, access controls, and monitoring to protect data. Cloud data uses provider-managed encryption at rest. API keys synced across devices are stored as encrypted key material, but local device security and your master password choices remain important. No method is 100% secure. See our Security Policy for details.

We and our providers may process and store information in countries outside your own, including the United States and other locations where Supabase, Vercel, Stripe, OpenRouter, AI providers, Tavily, Google, GitHub, or related infrastructure providers operate. Where required, transfers rely on adequacy decisions, standard contractual clauses, data privacy frameworks, contractual safeguards, or other lawful transfer mechanisms made available by those providers.

The Services are not intended for children under 13. If local law requires a higher age or parental/guardian consent for online services or personal data processing, you may use the Services only if those requirements are met. In Spain, children under 14 generally require consent from a parent or legal guardian for consent-based personal data processing. If you believe we have collected information from a child without required consent, contact us so we can review and delete it where appropriate.

We may update this Policy. Material changes will be communicated in-product or via email. The "Last Updated" date reflects the latest version.

For privacy questions or requests, email ozyrachatapp@gmail.com.