Privacy policy

The short version

Free stats are computed in your browser. Your chat file is never uploaded for them.

For the one free AI teaser, only the most recent ~3 months of messages (capped) are sent to our AI provider. We keep only the teaser text.

If you unlock a report, your messages are stored encrypted for 30 days so you can ask questions, then deleted automatically. The report, with the short quotes it shows, stays until you delete it.

We never sell your data or use it to train AI models, and our AI providers are instructed to retain nothing.

You can export or delete everything at any time from Settings.

Who we are

Chatlore ("Chatlore", "we") operates chatlore.co and is the controller of the personal data described here. Contact: privacy@chatlore.co.

What happens to your chat

Free results: the export is read and analyzed on your device (in a browser worker). Nothing about it reaches our servers. The results are saved only in your browser so you can come back to them.

Free teaser: whole conversations from roughly the last 3 months (at most about 45,000 words-equivalent) are sent over an encrypted connection to generate one teaser. Display names are sent with the messages so the AI can refer to people by name. We store the resulting teaser (encrypted), its cost, and a keyed hash of the chat so we don’t generate it twice. The messages are not stored.

Unlocked reports: the normalized messages (sender, time, text; never photos or media) are uploaded and encrypted with a key unique to that chat. We use them to read the chat in order and take notes, compute statistics, write your report and answer your questions. 30 days after purchase the messages, the notes and the search index are deleted automatically. The report and statistics remain until you delete them, and so do the messages the report quotes: each claim shows the few messages behind it, so those are kept inside the encrypted report. Uploads that are never paid for are deleted within 24 hours.

Deleting a chat destroys its encryption key first, then every stored item: messages, notes, embeddings, report and its quotes, questions and share links; its quotes also leave “Your lore”. Anything left in a backup can no longer be decrypted.

“Your lore”

If you buy “Your lore”, we build one page about you across your chats from your existing reports: what they say about you, the quotes of yours they keep, and their statistics. No message is read again. It is stored encrypted, rebuilt when you add a chat, and deleted with your account; deleting a chat removes its quotes from it right away.

Other people in your chats

Your chats include other people’s messages. Only upload chats you are part of, and think about the people in them before sharing. Share cards and public links use initials by default, never include message text, and are created only when you choose to share.

Other data we keep

Account: your email address if you sign in (by email link, Google or Apple). Without signing in, an anonymous session cookie links your purchases to this browser.

Purchases and credits: order records and your question-credit ledger. Order records are kept for tax and accounting even after account deletion, with the link to you removed.

Public links you create: the redacted summary (statistics, initials, role names) and its preview image, until you revoke them.

Usage analytics: cookieless, coarse events (for example "report ready", mode, language), with no message content and no IP address stored.

Security logs: rate-limit counters keyed by a one-way hash of your IP address, kept for up to two days. Error reports are scrubbed of message content.

Service providers

We use: Vercel (hosting), Supabase (database, EU region), OpenRouter routing to OpenAI and Anthropic models (AI, with zero data retention requested and providers that train on data excluded), Resend (sign-in emails), PostHog EU (cookieless analytics), Sentry (error tracking, content scrubbed), Cloudflare Turnstile (bot protection) and our payment provider (card details go directly to them, never to us). Where data leaves the EEA we rely on Standard Contractual Clauses.

Why we may process it (GDPR)

To provide what you asked for (contract): free results, the teaser, reports, questions. Legitimate interests: security, fraud and abuse prevention, basic product analytics without tracking. Your choices (consent): public links and sign-in. You can withdraw any time.

Your rights

Access and portability: Settings → Export my data. Erasure: delete a chat, or Settings → Delete everything (immediate). You can also ask us to correct or restrict processing, object to it, or complain to your data protection authority. Write to us at privacy@chatlore.co.

Age

Chatlore is not for anyone under 16.

Changes

If we change how your data is handled, we will update this page and the date above before the change applies.