Privacy Policy

1. Data stored on your device

Characters, chats, personas, settings and provider API keys are stored on your computer.

That data is encrypted at rest with AES-256-GCM. The encryption key is wrapped by your operating system keychain, and a recovery key lets you restore access.

We cannot read this data, and we cannot recover it for you.

2. Data we collect

We collect the following, and only for the purposes stated.

• App usage statistics: a randomly generated installation identifier, the app version, your operating system and version, processor architecture, package format and language. This is sent when Rin Chat is installed and when it is launched, and it cannot be switched off — see the Usage statistics section of the Terms. Optionally, and only if you agree to each separately in the app: which AI providers and models you use, the size of your card library, and which features you have enabled.
• Support messages that you send us.
• Website analytics: the rin.chat website uses Google Analytics. See the Website analytics section below.
• Account protection, for Rin Chat accounts that use the subscription: we briefly check network addresses to detect account sharing, and store a pseudonymized network identifier only when unusual use is detected. The identifier is derived from your network, not your full address, and cannot be turned back into an address from our records alone.

3. Prompt content

When you generate a reply, the prompt is sent to the AI provider that you selected so that it can produce the response.

The request goes directly from your device to that provider. It does not pass through us.

Usage statistics never include prompt content. They also never include your characters, chats, personas or lorebooks — not their text, and not their names, tags or creators — nor your API keys, file paths, or the addresses of AI providers you connect to.

4. Website analytics

The rin.chat website uses Google Analytics to count visits and to see which pages people read and which downloads they start. The desktop app does not use Google Analytics — the app's own reporting is described above and is separate.

In the EU, the EEA, the United Kingdom and Switzerland, analytics is switched OFF until you accept it: we ask before a single cookie is set, and if you decline or ignore the request, nothing is collected. Everywhere else it is on by default, and the Cookie settings link at the bottom of any page turns it off.

Google Analytics sets cookies in your browser and receives your IP address, which it uses to approximate your location and then discards. We see aggregate reports; we do not use it to identify individual people, and we never send it your email address, your characters, your chats or anything you type.

When you click a download button we record which platform you chose and which version, so that we know which builds to keep supporting. That event carries no information about you.

Google deletes the user-level and event-level analytics data after 14 months. We keep only the aggregate reports built from it, which cannot be traced back to a person.

We have turned off Google's advertising features for this property: no Google Signals, no cross-device tracking, no demographics or interest reporting, no audience export to any advertising account, and none of the optional data sharing Google offers itself. We have signed Google's data processing terms.

You can opt out for every site by installing Google's browser add-on at https://tools.google.com/dlpage/gaoptout, or by blocking cookies and trackers in your browser. Nothing on this website stops working if you do.

5. Why we process data

Each purpose below is paired with the legal basis we rely on under the UK and EU General Data Protection Regulation.

• To provide the app and keep it working on the platforms people actually use — our legitimate interest in running and supporting the software.
• Website analytics, and the optional reporting you can switch on in the app — your consent, which you may withdraw at any time.
• To answer support requests — our legitimate interest in helping you, and performance of our agreement with you.
• To detect account sharing and abuse of the subscription: our legitimate interest in protecting accounts and preventing fraud.
• To meet legal obligations, and to establish or defend legal claims.

6. Sharing

We share data only with the service providers we need in order to operate.

• Consul Hosting (consulhosting.com), based in the Netherlands. They host the website, the installer and update files, and our database.
• Google, for the website analytics described above.
• Authorities, where the law requires it.

7. Retention

We keep usage statistics indefinitely so that we can see long-term platform and version trends. They are not tied to your identity.

Support messages are kept for as long as we need them to help you and to keep a record of the issue.

A pseudonymized network identifier recorded for account protection is kept until we have reviewed it, and then deleted. Network addresses checked in passing are held in memory for a few minutes and never stored.

Email us at any time to have the reports from your installation, or your support messages, deleted.

8. Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct it, ask us to delete it, or ask for a copy of it.

To make a request, email [email protected]. We may need to verify your identity first. We answer within 30 days, and sooner where we can.

• In the EU and the UK you also have the right to restrict processing, to object to processing we base on our legitimate interests, to data portability, and to withdraw a consent you previously gave — withdrawing it does not affect what we did before you withdrew it.
• You may complain to your data protection supervisory authority. In the UK that is the Information Commissioner's Office; in the EU it is the authority for the country you live in.
• In California you may ask what we hold, ask us to delete it, and ask us to correct it. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. We will never treat you differently for exercising any of these rights.

9. EU and UK Rights and Requests

Rin Chat LLC is established in the United States. We do not restrict the app from download or use by people in the European Union and the United Kingdom and we intend to meet our obligations to them under the GDPR.

Requests, complaints and enquiries from data subjects and from supervisory authorities should be sent to [email protected], and we will respond to them.

10. Security

Local data is encrypted at rest on your device. Traffic to our service is encrypted in transit.

No system is perfectly secure. Protect your password and your recovery key.

11. Children

The app is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child under 13 has used the app and sent us data, email us and we will delete it.

12. International transfers

Our infrastructure is in the Netherlands. Consul Hosting runs the website, the installer and update downloads, and our database there, so if you are outside the Netherlands the data described in this policy is stored there.

Because our infrastructure is inside the EU, data from users in the EU is not transferred out of it in order to run the website, the downloads or our database.

Google Analytics is operated by Google, which may process data in the United States and elsewhere. Google states that it relies on the European Commission standard contractual clauses and on the EU-US Data Privacy Framework for those transfers.

13. Changes

We will post any update to this policy here and change the effective date.

14. Contact

Questions about this document go to [email protected]. Postal address: 7533 S Center View Ct #6256, West Jordan, UT 84084, USA.