Privacy policy

There are two very different categories of data here, and we want to be precise about the difference:

• Hosted account data (on our servers, via Supabase): the email, password (stored as a salted hash, never in plain text), display name, country, and date of birth you provide at signup, plus your current plan, niche-switch state, and Free-plan usage counters (daily, lifetime, and hosted-demo task counts).
• Local application data (only on your computer, never transmitted to us): your conversations, agent memory, agent configuration, and settings, stored as plain JSON files in your app data folder. We do not have access to this data, cannot see it, and do not store a copy of it.

We do not sell your personal data. We do not use your conversation content or business information to train our own models. We do not read your local conversation files — we have no server-side access to them. AI providers may process content under their own terms, as described below.

• Email and password: to authenticate you and secure your account.
• Display name: shown back to you in the app and on the account page.
• Country: used for basic legal/tax compliance and to route support appropriately.
• Date of birth: to verify you meet our 18-and-over eligibility requirement. We do not use this for marketing or profiling.
• Plan and niche-switch state: to enforce what your plan entitles you to (for example, how many niche switches you have left this billing period).
• Free-plan usage counters: to enforce 5 tasks per day and 50 lifetime Free tasks across reinstallations and devices.

We rely on the following service providers to operate AverizOS. Each only receives the data necessary for its function:

• Supabase — hosts our account database and handles authentication (password hashing, sessions). Receives: email, password hash, display name, country, date of birth, plan, niche state, and Free-plan usage counters.
• Vercel — hosts our website and server-side application code. Receives: standard web request data (IP address, request logs) needed to serve pages and API routes.
• Google — Free BYOK tasks are sent directly from the desktop app to Gemini under the Google account that owns your key. Google's free-tier terms may permit submitted content to be used to improve its products, so do not submit sensitive data unless your Google terms are appropriate.
• Anthropic — if you connect your own Anthropic API key, prompts and responses are sent directly from the desktop app to Anthropic under its terms. We do not route that BYOK traffic through our servers or retain a copy.
• OpenAI — if you connect your own OpenAI API key, prompts and responses are sent directly from the desktop app to OpenAI through the Responses API under its terms. We do not route that BYOK traffic through our servers or retain a copy.

We use a small number of strictly necessary cookies to keep you signed in (session cookies managed by Supabase Auth). We do not use advertising or cross-site tracking cookies on the marketing site.

• Export your local data: from the app, one click exports all your agents, memory, and conversations as a JSON file.
• Erase your local data: one click wipes all local app data from your computer.
• Delete your hosted account: from the Account page, or by emailing averizos@proton.me, you can request permanent deletion of your account record (email, profile, plan, niche state, and app-usage counters) from our hosted database. We'll act on verified requests within 30 days.
• Access or correct your account data: your display name, country, and date of birth can be viewed and updated from your account; email us for anything not yet self-serviceable.
• If you are in the EU/UK, you have rights under the GDPR (access, rectification, erasure, portability, restriction, and objection) with respect to your hosted account data. If you are a California resident, you have similar rights under the CCPA/CPRA. Contact us to exercise any of these.

We retain hosted account data for as long as your account is active, or until you request deletion. If you delete your account, we remove your account record from our production database within 30 days, except where we must retain limited records to comply with law (for example, billing records required for tax purposes).

AverizOS is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If we learn that we've collected data from someone under 18, we will delete it.

We use industry-standard practices to protect hosted account data, including encrypted password storage and encrypted connections (HTTPS/TLS) for all data in transit. No system is perfectly secure, and we cannot guarantee absolute security.

Our hosting providers may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

We'll update the "Last updated" date above when this policy changes, and provide more prominent notice for material changes affecting your rights.

Questions, access requests, or deletion requests: averizos@proton.me. AverizOS is operated by Allen Max, based in Los Angeles, California.