Privacy Policy

The controller of your personal data is Vladyslav Varshavskyi, Solonka, Lviv Oblast, Ukraine. Contact: [email protected].

This policy covers ExoCort, the service at the exocort.net website, including when it is installed on your device as an app. It does not cover Google or Discord, which are separate controllers with their own policies, even when you use Google to sign in.

Because ExoCort is an assistant with a memory, most of what it holds is what you gave it:

• Conversations. The messages you send to ExoCort and the answers it gives, including files, images and voice messages you attach.
• Notes and tasks you create, with their text, titles, dates and structure.
• Memory. Facts and connections the assistant draws from your conversations, notes and files, so that it can recall them later. This may include details about you and about people you mention.
• Identifiers from Discord, if you signed in with Discord when it was offered or a space of yours was moved to the website from a Discord server: your Discord user ID, the display name Discord shows and, for a moved space, the server and channel IDs it came from. We do not receive your Discord password or your email address from Discord.
• Website account. If you sign in to the website with Google, we receive your name, email address, profile picture and Google account identifier. If you sign in with a code sent by email, we receive that email address. If you turn on browser notifications, we store the delivery address your browser gives us for them.
• Consent records: when you accepted the Terms of Service, confirmed that you are 18 or older, and gave or withdrew consent to the storage of special categories of data (section 10).
• Settings and billing state: your plan, your allowance, language and time zone.
• Country you connect from. When you sign in and while you use the website, Cloudflare tells us the country of your connection as a two-letter code. We keep only the latest country with your account, not your IP address, and use it only to count in aggregate where our users are. This is our legitimate interest. It is erased when you delete your account.
• Saved card, if you keep automatic renewal on, start a free trial or pay after a card check. The bank holds your card. We hold the token the bank issues for charging it, the masked card number (most digits hidden), the country of the card's bank, and a record of your consent: what you agreed to, the wording and language shown to you, the amount, the time, the country of your IP address and the country you stated. We cannot see your full card number or security code.
• Countries for each purchase. To decide whether we can sell to you and to show that decision to tax authorities and advisers, we keep the country of your IP address, the state or region of your IP address, the country you stated (and, for Canada, the province), the country of your card's bank and our decision, with each payment and each refused attempt.
• Mark of a card used for a free trial. So that a trial is given once per card, we keep a one-way hash of the masked card number. It has no fixed end date: we keep it for as long as we offer trials, including after you delete your account, and it does not reveal the card or your identity to us.
• Evidence for card disputes. When you buy, confirm a plan change or link a card, we keep your IP address and your browser's identification string with that payment and consent, to answer a dispute with your bank and to fight card fraud. This is our legitimate interest. They are kept for 18 months after that payment or, for a subscription, after it ends, including if you delete your account, and then erased. Automatic renewal charges do not collect them.
• Technical logs kept for a limited time so that faults can be diagnosed. They can include your IP address (at our web server), the email address you write to support from, and error reports from your browser with your account ID and browser type.

We also keep product metrics, and these are deliberately built so that they do not point at you directly: identifiers are replaced by keyed hashes (pseudonymised, which is not the same as anonymous: whoever holds our key could link them back), and no message text, note title or name is recorded in them.

• To provide the service you asked for, which is the performance of our contract with you. Without holding your conversations and notes, an assistant with a memory cannot exist.
• To take payment and meet accounting obligations, which is a legal obligation and the performance of the contract.
• To keep the service working and safe, and to understand how the product is used in aggregate, which are our legitimate interests. The metrics described above are designed so that this interest does not come at your expense.
• To remember special categories of data about you, such as health, religion or sex life, only on the basis of your explicit consent, which you can withdraw at any time (section 10).

To answer you, ExoCort must send your message and the relevant material to a language model. The recipients currently include:

• OpenRouter, which routes requests to model providers, and through it the providers that actually run the models: OpenAI, Microsoft, Anthropic, DeepSeek, xAI, z.ai, Xiaomi, inclusionAI, Alibaba (Qwen), Krea, Perplexity, Inception and Google. Requests carry a pseudonymous tag of your account, not your name or email address, so that abuse can be traced. Every request through OpenRouter is sent with a setting that forbids the provider from using the content for training. For every provider except Google we also require zero data retention on these requests, which means the provider commits not to store the content once the answer is produced, under its own terms. Different models do different jobs: OpenAI, Anthropic, xAI, DeepSeek, z.ai and others write answers and notes; Perplexity and Inception read your message to work out what you are asking for; Xiaomi answers on the free plan and reads images there; Anthropic and, as a fallback, Alibaba read text from images; Claude models reached through OpenRouter run on Google Vertex, also under zero data retention; inclusionAI reads the tasks you create, checks facts before they are remembered and checks requests to draw a picture; OpenAI also turns the text of your messages, notes and files into the numeric vectors that memory search uses; Krea draws pictures on the free plan; Microsoft draws there as well and edits the pictures you supply as a sample on every plan.
• Google (Gemini models, through OpenRouter) is used for transcribing voice messages, for drawing pictures from your description (the text only, never a photo you supply), as a model you can choose for chat, and as a fallback for some chats and background tasks. Among the providers reached through OpenRouter, Google is the one for which we do not require zero data retention: it may keep these requests for a limited time under its own terms, for example for abuse prevention, and we cannot tell you exactly how long. That includes the audio you send to these functions. We still send the setting that forbids training on them.
• Anthropic may also receive requests to Claude models directly, without OpenRouter, with the same pseudonymous tag. Zero data retention does not apply to these direct requests. Under Anthropic's terms for commercial customers, it does not use them for training without permission and deletes them within 30 days. It may keep a request flagged as a breach of its usage policy for up to 2 years, and the related safety scores for up to 7 years.
• Exa (and Tavily as a fallback), search providers, and Jina Reader, which reads a public web page when our own reading of it fails. This happens only when a search is actually performed for your request. The search query, which a model writes from your message and which can therefore contain names or other details from it, goes to Exa or Tavily under their own terms; the address of the page goes to Jina under its terms. We cannot promise that these services do not keep queries or use them for their own purposes.
• Discord, for a space moved to the website from a Discord server, as the source of its earlier messages and files, which Discord keeps under its own policy. Our team also gets internal alerts in a private Discord channel when something breaks. A payment alert can include your account number and masked card number. These alerts are not deleted when you delete your account.
• Oracle Cloud, where our servers and our database run, in Stockholm, Sweden (European Union), and the provider of our off-site backup storage (section 7).
• Cloudflare, through which all traffic to this website passes (it sees what your browser sends, including your IP address and the content of your messages in transit), and which also receives mail sent to our support address.
• Resend, which sends our email: sign-in codes, replies from support, notices about your support requests, payment receipts and letters about automatic renewal.
• monobank (JSC Universal Bank, Ukraine), which processes payments. Your card details are given to the bank and never reach us. We send it the amount, the plan and a random payment number, not your name or email address. We receive back the result of the payment and the country of the card's bank. Before you pay, we also compare the country of your IP address, as reported by Cloudflare, with the country you state, to see whether we can sell to you. If they differ, or if you start a free trial or change your card, the bank places a hold of 1 UAH to check the card and we release it straight away. If you subscribe with automatic renewal, start a free trial or pay after such a check, the bank saves your card and gives us a token for it; we use that token only to make the charges you agreed to.
• Browser notification services (those of Google, Mozilla, Microsoft or Apple, depending on your browser), if you turn on notifications. They carry an encrypted message whose text can include the title or text of a task.
• Support correspondence. If you write to our support address, it is handled by our team inside Discord, which means the text of your letter is stored there as well, and a copy of each letter goes to a separate mailbox we keep as a safeguard. Files attached to your letter are not put into Discord: they are kept in Cloudflare's storage (R2), opened only by our support team through short-lived links, and we keep them for about 90 days.
• Sales log. Our team sees payment events in a private Discord channel: your display name, email and account number, the plan, the amount, the dates, the countries of your connection, your stated residence and your card's bank, the bank's decline code and the invoice number. Your IP address and card number are not in it. When you delete your account, we delete these messages.

Apart from these processors, we disclose personal data only where the law requires it, for example to a court or a public authority, or where it is needed to establish or defend a legal claim, including to our professional advisers. We check that such a request is genuine and has a lawful basis, disclose only what it covers, and tell the person concerned unless the law forbids it.

We do not sell personal data, we do not share it with advertisers, and we use no third-party analytics or advertising trackers anywhere in the product or on this website.

Your data is stored in the European Union. The database, your notes and your conversations live on servers in Stockholm, Sweden (European Union). Backups are covered in section 7.

It does not stay there when an answer is produced. The model providers listed above are located outside the European Economic Area, mainly in the United States, and your message and the relevant material are sent to them so that a reply can be generated. Those transfers rely on the standard contractual clauses used by those providers, together with the training and retention restrictions described in sections 4 and 5. We ourselves and monobank are in Ukraine, and our support and internal alerts run through Discord in the United States, so your data also reaches those countries.

If you would rather nothing left the EEA at all, ExoCort is not the right product for you today, and we would rather say so here than let you discover it later.

• Conversations, notes, tasks and memory are kept for as long as the space they belong to exists. They are not deleted by age.
• When a space is deleted, its data is deleted, including the vector memory built from it. This happens automatically and cannot be undone.
• Technical logs are rotated and kept for a limited time.
• Raw product metrics are deleted after 90 days. The aggregated daily figures derived from them are kept.
• Backups. We make backups every day, and before each update of the service, so that a failure does not lose your work. They are kept for a limited time: on our server we keep the latest 14 copies. A second copy is sent to separate off-site storage, and we do not promise a fixed period for it. A backup is a snapshot in time, so data you have deleted may remain inside backups until they are rotated out, and we do not edit backups.
• Payment records, including the countries and the decision for each payment, are kept by the bank and by us, also after you delete your account, for as long as tax and accounting law requires. Refused attempts, for which no money moved, are kept with the same period but are deleted with your account.
• A saved card stops being charged the moment you turn off automatic renewal, change your card or delete your account; a card used for one payment after a card check, without automatic renewal, is never charged again. The bank cannot process a refund without the card token, so we and the bank keep the token until your refund period is over: the end of your current period, or 14 days after your last payment by any card, whichever is later. Then it is deleted at the bank and by us; if you have never paid, it is deleted at once. When you delete your account, the masked card number and country are erased at once. To keep a free trial to one per card, we keep the bank's identifier for the card after that; your consent records are kept with the payment records.

You may ask us to give you a copy of your data, to correct it, to delete it or to restrict its processing, and you may object to its processing. Write to [email protected] and we will answer within one month. The product has no export button yet: to get a copy of your data, ask us at that address and we will send it to you within one month.

You can also delete most things yourself, without asking anyone: individual facts the assistant has remembered, notes, tasks and whole conversations can be removed from inside the product, and the settings panel has an option that deletes everything belonging to a space at once. Deleting a space does not remove your profile or the personal note about you that ExoCort keeps; those stay until you delete your account.

Letters you send to our support address are kept separately from your space, because a person who writes to us may not use the product at all. Ask us and we will delete that correspondence too.

If you think we have handled your data badly, please tell us first, and know that you also have the right to complain to the data protection authority in the country where you live.

The database is reachable only from the machine it runs on, administrative access is by key and not by password, and traffic to the website is encrypted. Access to production is limited to the people who operate the service. Data on our server and in backups is not additionally encrypted by the application itself.

No system is perfect. If a breach occurs that puts your rights at risk, we will tell you and the relevant authority without undue delay.

In a shared space ExoCort processes the messages of everyone who writes there, not only yours. If you invite people into a space, you are the one who decides that, and you should tell them how ExoCort works. Each person may ask us to delete what relates to them.

When ExoCort is used by a team, its memory is divided by meaning rather than by where something was said:

• Work matters (projects, decisions, deadlines, how things are done) go into the team's shared memory, which every member of the team can draw on. What comes from a private chat is stored there without the name of the person who said it.
• Personal matters stay with the person who said them and are recalled only in that person's own chat, without anyone else present.
• Special categories of data (such as health, religion, sex life or political opinions) are remembered only if the person has given explicit consent with a button, and that consent can be withdrawn at any time with the same button or simply by saying so. Without it, such details are not stored in the long-term memory at all. Opinions about other people and special categories of data about other people are not stored.

This rule is shown to every member before it applies. Through ExoCort an administrator cannot open another member's chat. For a space moved from a Discord server, messages written there before the move remain on Discord, where a server administrator may see them under Discord's own rules.

ExoCort is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has used it, write to [email protected] and we will delete the data.

This website uses only cookies it needs in order to work, and none for advertising or analytics:

• a cookie that remembers the language you chose;
• a sign-in cookie that keeps you signed in until 10 days after your last visit, and never longer than a year, and a short-lived cookie that protects the sign-in itself;
• small cookies that remember how you arranged the page, such as a collapsed panel.

Your account area also keeps some settings in your own browser, such as its appearance, unsent drafts and recent searches. They stay on your device and are not sent to us. When you pay for a plan, the bank may set its own cookies on its checkout, under its own policy.

When the product changes in a way that affects this policy, we update this page and change the date at the top. If a change is material, we will tell you through the product or by email before it takes effect.