Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Unlocked AI (“Unlocked AI,” “we,” “us,” or “our”) collects, logs, uses, retains, discloses, and protects information when you visit https://unlockedai.net or use our web application, AI chat studio, image generation studio, and related services (collectively, the “Service”). This Privacy Policy forms part of our Terms of Service.

2. Information We Collect & Log

We collect and log the following categories of information when you use the Service:

• Account & Authentication Information: When you sign in using Google OAuth or an Email Magic Link (via Google Firebase Authentication), we collect your email address, unique Firebase User Identifier (uid), email verification status, account creation timestamp, and—if you use Google Sign-In—basic profile metadata provided by Google (such as display name).
• Chat Transcripts, Prompts, AI Outputs & Attachments: We log and store the text prompts you submit, the conversation titles, the AI model and reasoning effort selected, and the responses (including text, reasoning blocks, and generated images) returned by the AI models. If you attach files to a prompt (up to 3 attachments per prompt, including images compressed in your browser, PDF documents up to 4MB, or text/code files up to 500KB), the text content or binary payload is transmitted to the upstream AI model for analysis and attachment filenames/context are recorded in the chat transcript.
• Credit Balance & Billing Records: When you purchase a one-time Credit Pass or subscribe to the All-Access Monthly Membership, your payment is processed directly by Stripe, Inc. Unlocked AI does not receive, process, or store your full credit/debit card number, expiration date, or security code (CVV). We store your spendable credit balances (permanent credits and monthly subCredits), membership status (isSubscriber), and Stripe customer/transaction identifiers in our database for accounting and fulfillment.
• Usage, Token & Telemetry Logs: For each completed AI generation turn, we record an operational usage log containing your user ID (uid), the model ID used, the number of credits deducted, prompt and completion token counts, upstream inference cost (in USD), and timestamp. Standard server logs may also temporarily record IP addresses and HTTP user-agent headers to prevent fraud, rate-limit automated attacks, and troubleshoot errors.
• Cookies & Local Storage: We use strictly necessary browser storage—specifically Firebase Authentication session persistence (IndexedDB / localStorage) to keep you signed in, a temporary localStorage key (unlockedai_email_for_signin) when you request a passwordless Email Magic Link so we can complete your sign-in when you click the link, and a first-party campaign attribution key (unlockedai_ad_attribution) if you arrive via a referral or campaign link (utm_* / click ID) to measure signup and purchase conversion. We do not display third-party ads on our site or use cross-site behavioral advertising cookies.

3. Why We Log Chats & Who Can Access Them (Purpose Limitation & Legal Basis)

Under applicable data protection laws (including the EU/UK General Data Protection Regulation (GDPR) and US consumer protection laws), we process and retain chat logs only for specific, documented legal bases and purposes:

• Contractual Necessity (Providing the Service): Storing your chat threads and messages so you can view your conversation history across devices, switch models mid-conversation while maintaining context, and manage your credit balance.
• Legitimate Interests (Safety, Abuse Monitoring & Security): Detecting, investigating, and preventing violations of our Acceptable Use Policy, including Child Sexual Abuse Material (CSAM/CSAE), self-harm, cyberattacks, automated scraping, or multi-account starter-credit farming.
• Legitimate Interests (Debugging & Customer Support): Troubleshooting failed generations, investigating billing or credit-deduction inquiries, and maintaining service quality and cost controls.
• Legal Obligations (Mandatory Reporting & Lawful Requests): Complying with applicable federal, state, and international laws, including mandatory reporting of apparent CSAM/CSAE to the National Center for Missing & Exploited Children (NCMEC) CyberTipline under 18 U.S.C. § 2258A and responding to valid court orders or subpoenas.

Strict Rules on Authorized Administrative Access: Unlocked AI strictly prohibits arbitrary or curiosity-driven browsing (“snooping”) of user chats. Access to backend user records, usage logs, and stored chat transcripts is restricted exclusively to designated, authenticated Unlocked AI administrators who require access to: (1) investigate flagged, reported, or anomalous activity indicating abuse or policy violations; (2) resolve a technical bug or support/billing request; or (3) fulfill a legal obligation. Administrative actions (such as credit adjustments, account bans, and configuration changes) are recorded in an internal server-side audit log (adminLog).

No Proprietary AI Model Training: Unlocked AI does not use your private chat transcripts, code, or file attachments to train proprietary foundation AI models.

4. Data Retention Periods (“User Deleted” vs. “Safety Retention”)

In accordance with data minimization and storage limitation principles, we separate active user chat history from backend safety and operational retention:

• Active Chat History: Saved conversations remain accessible in your Chat Sidebar for as long as you maintain an active account with Unlocked AI, unless you delete them earlier.
• User-Deleted Chats & Safety Retention Window (30–90 Days): You can delete any conversation thread at any time by clicking the trash icon in the Chat Sidebar. Deleting a chat immediately removes the thread from your active account view. To prevent abuse, investigate Terms of Service violations, resolve billing disputes, and comply with upstream provider safety requirements, residual message records and operational telemetry may be retained in backend storage or backups for a limited safety retention window of thirty (30) to ninety (90) days following deletion, after which they are permanently purged or anonymized (unless preservation is legally required for an active abuse investigation or legal proceeding).
• Full Account Deletion: You may request complete deletion of your account and personal data at any time by emailing support@unlockedai.net from your registered email address. Verified account deletion requests are completed within thirty (30) days, except for minimal financial transaction records (`transactions` ledger) which must be retained for tax, audit, and accounting compliance (typically up to 7 years under applicable tax laws).

5. How AI Prompts & Attachments Are Processed by Upstream Providers

When you submit a message in the Chat Studio, our server constructs a bounded context window (consisting of up to the 10 most recent messages or 8,000 characters from that specific chat thread, plus your current prompt and any attached files) and transmits it over an encrypted HTTPS connection to our inference routing partner, OpenRouter (openrouter.ai), which routes the request to the upstream AI provider for the model you selected (such as Anthropic, OpenAI, Google, DeepSeek, Meta hosting providers, or Black Forest Labs).

When we transmit your prompt and attachments to OpenRouter and upstream AI providers, we authenticate using Unlocked AI’s server-side API key—we do not include your email address, name, or Stripe payment details in the AI inference payload. Upstream providers may temporarily retain API inputs and outputs (typically for up to 30 days) for their own automated abuse monitoring and safety enforcement in accordance with their respective API data privacy policies.

6. Subprocessors & Third-Party Service Providers

We share data only with trusted infrastructure and inference subprocessors necessary to deliver the Service:

7. Data Security & Access Controls

We implement technical and organizational safeguards designed to protect your information, including:

• Encryption in Transit & at Rest: All traffic between your browser, our servers, Firebase, Stripe, and OpenRouter is encrypted using HTTPS/TLS, and data stored in Google Cloud Firestore is encrypted at rest.
• Strict Database Isolation: Our Firestore security rules enforce strict tenant isolation so that regular authenticated users can only read or delete their own chat documents, while credit balances, usage telemetry, and admin audit logs can only be written by verified server-side transactions.
• Cryptographic Token Verification & Admin Allowlisting: Every API request to /api/chat, /api/image, /api/checkout, /api/portal, and /api/admin requires a cryptographically signed Firebase ID token verified on the server, and administrative endpoints additionally enforce a strict verified-email allowlist.

8. Your Privacy Rights (GDPR, UK GDPR, CCPA/CPRA & Global Users)

Depending on where you live (including the European Economic Area, the United Kingdom, Switzerland, California, and other U.S. states with consumer privacy laws), you may have specific statutory rights regarding your personal information:

• Right to Know & Access: Request confirmation of whether we process your personal data and receive a copy of the personal data we hold about you.
• Right to Correction (Rectification): Request correction of inaccurate or incomplete personal data.
• Right to Deletion (Erasure / “Right to be Forgotten”): Request deletion of your account and personal information, subject to narrow legal and safety exceptions.
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Right to Restrict or Object to Processing: Object to processing based on legitimate interests where applicable under GDPR/UK GDPR.
• Right to Opt Out of “Sale” or “Sharing”: Unlocked AI does not sell your personal information and does not share your personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CCPA/CPRA).
• Right to Non-Discrimination: We will never discriminate against you or charge different prices for exercising your privacy rights.

To exercise any of these rights, please email us at support@unlockedai.net. To protect your privacy and security, we will verify your identity (by confirming control of your registered email address) before fulfilling the request.

9. International Data Transfers

Unlocked AI and its primary subprocessors (Google Cloud/Firebase, Stripe, and OpenRouter) operate servers located in the United States and other jurisdictions. By using the Service, you understand that your information may be transferred to, stored, and processed in the United States and other countries where data protection laws may differ from those of your home jurisdiction. Where required by law, our subprocessors rely on Standard Contractual Clauses (SCCs) or equivalent lawful transfer mechanisms.

10. Children’s Privacy

The Service is not directed to children under the age of 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from children. If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us at support@unlockedai.net and we will promptly delete the account and associated data.

11. Changes to This Privacy Policy & Contact Us

We may update this Privacy Policy periodically to reflect changes in our technology, retention practices, subprocessors, or legal obligations. When we make updates, we will revise the “Last Updated” date at the top of this page.

If you have any questions, concerns, or data requests regarding this Privacy Policy, please contact us at: support@unlockedai.net