Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Olace Pritam Chakraborty, with registered address at Witolda Budryka 2, 30-072 Kraków, Poland. For any privacy question or request, contact us at support@olace.app.

2. Our approach

Olace is local-first. Conversations you run on your own hardware or on a device you have paired stay on your devices. When you reach a paired computer over the internet, the conversation travels through our relay end-to-end encrypted, so we cannot read it. Encryption protects what you choose to sync or back up. Some features need the cloud, and those send only the content the feature requires. This policy explains, in plain terms, what we process and why.

3. The data we process

Account and identity

To create and secure your account we process your email address. We store it in encrypted form, and we keep a one-way hash of it to recognise duplicates and sign-in attempts. Because we use your email to send you sign-in codes and a few service emails, it is encrypted on our servers but is not zero-knowledge: we are able to decrypt it to run the service. We also keep a random account identifier and the date your email was verified.

If you choose Sign in with Google, Google confirms your email address to us. We keep a one-way hash of your Google account identifier and the email address Google reported, stored encrypted, so the same Google account signs you in next time. We receive no other data from your Google account.

Besides sign-in codes, we send a few service emails: security alerts, billing notices such as a reminder before a trial ends, and at most one getting-started note if you have not yet paired a device, which you can unsubscribe from with the link it carries.

Sign-in and security

When you sign in, we process one-time codes and sign-in links, which we store only as a short-lived one-way hash and which expire after ten minutes. We keep hashed session and refresh tokens so you stay signed in, and basic security signals for sign-in approvals, such as a one-way hash of the requesting IP address, the device name, platform, and browser user-agent. These protect your account against unauthorised access. We also use your IP address to rate limit requests and to spot abuse of free grants. What we keep for this is a keyed one-way fingerprint of the address or its network, never the address itself, and it expires on its own (see section 9).

Devices and pairing

To connect your devices we process a canonical device identifier (a one-way hash), the platform, a device label you can edit, and the public keys and fingerprints used to pair devices securely. For a computer that shares its AI, we also keep the list of models installed on it, a hardware tier and its GPU memory, and whether it is online, so your other devices can offer those models; and we keep a running count of messages per device. If you enable notifications, we store your push token in encrypted form to deliver them.

When a device cannot reach a paired computer directly, we check whether the two are on the same network, so the app can tell you when that network blocks direct connections between devices. We compare a keyed one-way fingerprint of each device's public IP address and keep the computer's only while it is connected. The address itself is never stored or shared with your other devices.

Subscriptions and credits

If you buy a plan, we receive subscription status and identifiers from our payment partners (for example a Polar or RevenueCat subscription and customer ID) so we can grant your entitlements and credits. We do not receive or store your full card number; payments are handled by the merchant of record. To prevent abuse of free trials and Starter Pack grants, we keep one-way hashed records of the email address or device identifier that received a trial or grant, even after an account is deleted, as described in section 9.

Conversations, files, and encrypted sync

Conversations and files you create locally or on a paired device stay on your devices. When you sync or back up to the cloud, your conversations are zero-knowledge encrypted on your device with a key that only your devices hold, protected by your recovery key and PIN, and we store only ciphertext we cannot read, along with the minimum metadata needed to sync, such as account, conversation, and message identifiers. Files are stored the same way, as encrypted objects in our object storage.

Cloud AI, search, and tools

When you use a cloud feature, we process the content that feature needs, only for as long as it takes to return the result:

• Cloud models. Your prompt and the relevant conversation context are sent to our inference provider to generate a response. We pin zero-data-retention on every request, so the provider does not log, keep, or train on what you send. The app asks before your first message to a cloud model, and you choose per conversation whether to use one; chats with local and paired models are not sent there.
• Web and image search. When you search, the model turns your request into a search query, and that query, along with the pages chosen to read, is sent to the search provider. Before the model sees the results, a cloud model condenses each result and page against the query, through our zero-data-retention cloud AI provider; it receives only the query and the public page text. On a cloud model, your message is used as the query only as a fallback, when one cannot be generated. On your own or a paired model there is no such fallback, as explained below.
• Vision and image generation. The image or prompt you provide is processed by the relevant model to produce the result.
• Weather and places. A location you ask about, such as a city name, is sent to a weather provider to fetch the forecast, and a place search, such as the kind of place and the area you name, is sent to our places provider. Olace does not read your device's location.
• Running code. When a cloud model runs Python for you, the code and the files it needs run in an isolated sandbox that is destroyed when the turn ends.

To keep search fast and affordable, results for a search, place lookup, or page read may be cached on our servers for up to 30 days, keyed to the query rather than to you and shared across all users. Images and site icons shown with results, place photos, and map icons load directly from the services that host them, which see your device's IP address as with any web request.

Tools on your own and paired models

On your own and paired models, your conversation never leaves your devices in readable form. When the model uses a tool, it writes the tool's input on your device and only that input is sent:

• Search: the queries your model writes, never your message itself. These also go to the cloud model that condenses results.
• Research: a short brief your model writes, and its search queries. Research reports are assembled on our servers, so the plan and report pass through them without being stored.
• Documents: the title, the instructions and any image searches. The document itself is written on your devices.
• Reading a page: the link the model opens.
• Your files: when the model reads part of an attached or project file, the file's name and which part. The contents stay on your devices.
• Weather and places: the city, or the kind of place and area.
• Images: sent only to a cloud vision model, and only if you chose one.

Python your model writes runs in a sandbox on your own computer. We never see the code, its output or your files.

Folders you share from your computer are browsed and attached over the end-to-end encrypted connection between your devices. We never see a folder name or a file.

A tool request also carries a few details your device works out itself:

• message lengths;
• yes or no flags, such as whether a message has a link, asks about something current or touches a sensitive subject;
• the names of local AI apps you mention when setting one up;
• one-way codes of your message and its links, made fresh each time, so we can keep your own words out of the shared search cache and tell whether a link the model opens is one you shared.

We do not store the content of these requests as readable conversation on our servers, and we do not use it for advertising or model training. If you use your own provider key (BYOK), your key stays on your devices (synced between them only zero-knowledge encrypted) and the call to the provider is made from your device. Our servers still coordinate the turn, so its content passes through them in the same transient way as a cloud model request, and that provider's own terms and retention apply. A few quick decisions in a turn, such as whether a research question needs scope questions first or what kind of change you asked for in a document, run on a cloud model through OpenRouter on our key, with zero data retention.

If you would rather no conversation content ever leave your devices, Direct Mode keeps a conversation entirely on your own and paired devices: cloud models, web search, and other external tools are turned off for it, so nothing is sent out for processing. Your conversations still sync across your devices, always encrypted.

Voice input

When you dictate a message with the microphone button, your speech is turned into text on the spot; we never receive or store the audio. On computers and on Apple devices, transcription happens entirely on your device. On Android, dictation is handled by your device's system speech service, the same one behind your keyboard's mic button, provided on most devices by Google. That service may use its servers to assist transcription for the best accuracy, under its own privacy policy; the audio goes directly from your device to that service and never touches our servers. If you would rather keep dictation fully on your device, Direct Mode conversations pin recognition on-device, where transcription quality may be a little lower.

Support and feedback

If you contact support or send feedback from the app, we receive what you write, including any details or attachments you choose to include, so we can help you. A bug report can also carry a diagnostic summary (app and system version, platform, device identifier, and the state of your local AI runtime), which you can review and switch off before sending, and reporting a response sends the text of that response. This is content you send to us on purpose, and our support staff can read it.

Operational metrics

To keep the service reliable and to improve it, we collect aggregate operational metrics, such as counts, error types, timing, crashes, and whether a step like setup, pairing, or checkout finished or failed. They are stored only as totals and are never tied to you: they never contain your identity, your account, your device identifiers, your IP address, or any conversation content, and each one is limited to a fixed set of non-identifying values. The complete list is published in our transparency repo. They are on by default, and you can turn them off in settings.

4. Cookies and local storage

Our website and web app set no cookies and run no advertising or third-party tracking scripts. That is why you see no cookie banner: consent banners are required for non-essential cookies and trackers, and we use none.

We do use your browser's own storage for things the product needs to work, all first-party and strictly necessary: a random device identifier so your browser can act as one of your devices, your session and settings, and, in the web app, your conversations and files kept zero-knowledge encrypted in the browser database (IndexedDB) as described below. None of this is used to track you across other sites, and clearing your browser data removes it.

The Ask AI box in our documentation sends your question to our servers and a cloud model to answer it from the docs. Your IP address is used only to rate limit it, and answers to repeated questions are cached for up to a day.

The one exception is payment: when you open checkout, Polar, our merchant of record, runs inside its own frame and sets the cookies it needs to process your payment securely. These are strictly necessary for the purchase you asked for and are governed by Polar's own privacy policy.

5. Encryption and zero-knowledge

Olace protects synced data with strong encryption (AES-256-GCM, with keys derived using HKDF and, for your PIN, Argon2id). Your master key is generated on your device and wrapped with a recovery key that only you hold; a server-held pepper hardens your PIN without ever learning it. For your synced conversations and files, we hold only wrapped keys and ciphertext and cannot decrypt them. If you set a Sync PIN, it is protected by a server secret kept apart from our database, and ten wrong tries lock it. A 6-digit PIN is still shorter than a recovery key, so in the unlikely event that someone obtained both our database and that secret, they could try to guess the PIN of one account at a time. For the strongest protection, sync without a PIN: then only your recovery key or a device you approve can unlock your data. Signing in to your account does not unlock this data on its own: the key moves only between your own devices, when you enter your recovery key or PIN or approve a new device from one already unlocked, end-to-end encrypted so it never reaches us in readable form. This also means that if you lose both your recovery key and PIN, we cannot recover that data for you. On the web, your key stays in memory for the browser session by default, so reopening the tab asks you to unlock again. If you choose to trust a browser, your key is stored there in the browser database (IndexedDB), wrapped under a non-exportable browser key, so it cannot be read or copied off that device. On the web, your conversations are likewise kept encrypted in IndexedDB, not in plain form.

6. Why we use your data, and our legal bases

Under the GDPR, and on equivalent grounds under other privacy laws, we rely on the following:

• To perform our contract with you: creating your account, signing you in, syncing and backing up your data, running the features you use, and managing your subscription and credits.
• Our legitimate interests: keeping the service secure, preventing abuse and fraud, understanding aggregate reliability and where the product gets in people's way through operational metrics you can turn off, and sending the few service emails described above, balanced against your rights.
• Your consent: for optional things such as push notifications, which you can withdraw at any time.
• Legal obligation: where we must keep certain records, for example for tax, usually handled by the merchant of record.

7. Who we share data with

We do not sell your personal data. We share data only with service providers (sub-processors) that help us run Olace, each handling only what their function needs:

• Hosting and infrastructure: Render (application hosting, database, and cache); Cloudflare (the web app, R2 object storage for encrypted sync data and support attachments, app downloads, the code sandbox, and routing of our support email); and Vercel (this website).
• Sign-in and email: Brevo (email codes, sign-in links, and service emails), and Google (Sign in with Google, if you use it).
• Notifications: Apple Push Notification service on iPhone, and Firebase Cloud Messaging (Google) on Android.
• Support: Google (Gmail), which hosts the mailbox that support@olace.app delivers to.
• Cloud AI: OpenRouter and the models it routes to, on a zero-data-retention basis.
• Search and tools: web search, image search, page reading, place lookups, and weather, through providers such as Tavily, Exa, Brave, Serper, Pexels, Foursquare, OpenWeather, and Open-Meteo, plus public sources such as Wikipedia, arXiv, Semantic Scholar, OpenAlex, and Crossref for scholarly search, used only for the request you make.
• Payments: Polar (web and desktop merchant of record), and the Apple App Store, Google Play, and RevenueCat for in-app purchases.

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a business transfer, in which case we will tell you.

8. International transfers

Some of these providers operate outside the European Economic Area. Where data is transferred outside the EEA, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, so your data keeps a comparable level of protection.

9. How long we keep data

• Account data is kept while your account is active and deleted when you delete your account.
• Sign-in codes and links expire after ten minutes; sessions rotate, and an unused session expires after 30 days.
• Encrypted sync data remains while the feature is enabled and your plan allows it. If you move to the free tier, syncing stops and we keep your cloud copy, still encrypted, for a limited time (currently 60 days) so that upgrading again within it restores your data with nothing lost. After that we delete it. If you turn cloud sync off yourself, your cloud copy is deleted shortly after, following a grace of five minutes so that turning it back on, or an accidental toggle, loses nothing.
• Support messages and their attachments are kept while your account exists, so we can follow up, and are deleted with it.
• Cached search results expire within 30 days and are not linked to your account.
• IP fingerprints expire on their own: rate-limit records within a day, the pairing network check within minutes of a computer going offline, and abuse-prevention records within 30 days.
• Short-lived operational data such as expired media and sync logs (kept 14 days) is pruned on a rolling basis.
• Anti-abuse records are kept after account deletion: a one-way, keyed hash of the email address or device identifier that received a free trial, Starter Pack, or discount, with the date and what was granted. They never hold the number or address itself, and we use them only to stop the same person claiming these again.

10. Deleting your account

You can delete your account from the app at any time, as explained on our account deletion page. We verify the request with a one-time code and then permanently delete your data, including your conversations, encrypted sync data, files, support messages, devices, keys, and plan and credit records, except the anti-abuse hashes noted above. Deletion of encrypted files from object storage is queued and completed shortly after. A Polar subscription is cancelled automatically; an App Store or Google Play subscription must be cancelled in that store. Polar, Apple, and Google keep their own records of your purchases, as tax law requires, under their own policies.

11. Your rights

Wherever you live, you can ask us to access, correct, delete, or export your personal data, or object to how we use it. Many of these you can do yourself in the app, for example by editing your details or deleting your account; for anything else, contact us at support@olace.app and we will help. We do not sell your personal information.

Depending on where you live, you may also have specific statutory rights:

• EEA and UK: under the GDPR, the rights to access, rectification, erasure, restriction, objection, portability, and withdrawing consent, plus the right to complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (UODO).
• United States: in California and other states with privacy laws, the right to know, delete, and correct your personal information and to opt out of its sale or sharing. We do not sell or share it, and we will not treat you differently for exercising these rights.
• Canada, Australia, and elsewhere: we honour equivalent rights to access, correct, and delete your data under your local law.

12. Permissions on your device

Some features ask for device permissions, only when you use them: the camera to add photos or scan a pairing code, the photo library to attach images or save ones you generate, the microphone and, on Apple devices, speech recognition for voice input, notifications for alerts, and local-network access so your device can reach your already-paired computer over the same Wi-Fi and run AI on its GPU. You can manage these in your operating system settings.

13. Children

Olace is not directed to children. You must be at least 16 to use the Service. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. If a change is material, we will give reasonable notice, for example in the app or by email. The date at the top shows when it was last updated.

15. Contact

For any privacy question or request, write to us at support@olace.app.