Privacy Policy

1. What we collect

When you sign in with Google, we receive your name, email address, and account id from Google. We store the prompts, chats, follow-ups, and any images you attach in the Service, tied to your account. We also collect basic usage data (timestamps, error logs, rate-limit counters) needed to operate and secure the Service.

2. How we use it

To operate your account, save and display your chat history, and generate responses to your prompts (sent to Anthropic's Claude API for that purpose — see section 6 on subprocessors). We also use it to secure the Service (e.g. rate-limiting abuse) and, on the free plan, as described in section 3 below.

3. Free plan vs. paid plan: how we fund the Service

RabbitHole offers a free plan and a paid plan. On the free plan, we may use the content of your prompts and chats — in de-identified or aggregate form where feasible — for [purpose(s), e.g. improving the Service, product analytics, training or fine-tuning our own models, or sharing with partners]. This is what funds free access to the Service. On the paid plan, we do not use your chat content for any of those purposes — it is used solely to provide the Service to you.

You can opt your account out of this free-plan data use at any time, with no effect on your ability to use the Service, from Privacy Choices. We also honor the Global Privacy Control browser signal as an opt-out request.

Legal note (not filled in yet): exchanging a discount or feature (the paid plan) for a person's consent to use their data is treated as a "financial incentive" / "pay-or-consent" program under CCPA/CPRA and has been the subject of specific EU regulatory guidance (the EDPB has found that, for large platforms in particular, this structure can fail the GDPR's "freely given" consent requirement). Before launch this section needs: (a) the actual purpose(s) of the data use spelled out precisely, not in brackets, (b) a CCPA financial-incentive notice with a good-faith estimate of the value of the data, and (c) a GDPR-compliant consent flow captured separately from account creation — not bundled into agreeing to the Terms of Service. This is the single highest-risk piece of this policy and the one most worth paying a lawyer to get right.

4. Sharing

We don't sell your data to data brokers. We share prompts with Anthropic (our AI provider) to generate responses, and rely on Google for authentication and Turso for database hosting. On the free plan, per section 3, your content may also be shared or used as described there. We don't share your data with anyone else except as required by law.

5. Data retention

We keep your chats until you delete them, delete your account, or ask us to remove them. You can export or permanently delete all of your chat data yourself at any time from Privacy Choices, or contact us to request deletion of your account itself.

6. Subprocessors

We use the following third parties to operate the Service, each of which processes your data under their own terms and only for the purpose of providing their service to us: Anthropic (generates responses to your prompts), Google (sign-in/authentication), Turso (database hosting), and our hosting provider (e.g. Vercel). [List any others actually in use, and confirm data-processing agreements are in place with each before launch.]

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or opt out of certain uses of it.

• All users: export or permanently delete your chat data, and opt out of free-plan data use, from Privacy Choices.
• EEA/UK residents (GDPR): you additionally have the right to restrict processing, to lodge a complaint with your local data protection authority, and — where we rely on consent — to withdraw it at any time.
• California residents (CCPA/CPRA): you have the right to know, delete, correct, and opt out of the sale/sharing of personal information, and the right not to be discriminated against for exercising these rights. See the "Do Not Sell or Share My Personal Information" link in the footer of every page.

To exercise any right not self-serviceable above, contact us (section 9).

8. Children's privacy

The Service is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children. [Confirm the actual minimum age with legal counsel — 13 vs. 16 changes which laws (COPPA vs. GDPR "digital age of consent") apply and what parental-consent flow, if any, is required.]

9. Security

We take reasonable measures to protect your data — access to it is scoped to your own account at the database level, and traffic to the Service is encrypted in transit — but no method of storage or transmission is 100% secure. If we experience a breach affecting your personal data, we will notify affected users and any authorities required by law without undue delay.

10. International transfers

Our subprocessors may store or process data outside your country of residence, including in the United States. [Confirm the transfer mechanism — e.g. Standard Contractual Clauses — with each subprocessor before serving EEA/UK users.]

11. Changes to this policy

We'll update the date at the top of this page when this policy changes, and notify users of material changes (e.g. a new use of free-plan data) before they take effect.

12. Contact

Questions about this policy or a privacy request: anandsbhavsar01@gmail.com.