Privacy Policy

The short version

The desktop app is local-first: your files, prompts and model outputs are processed on your machine by default. Data leaves your device only when you choose a cloud model, sign in, or buy credits.

What we collect

We keep the data needed to run your account and, if you buy credits, to bill them correctly.

• Account data: email address, password hash, role and account status.
• Usage data: which official model was called, token counts, credits charged, and a request identifier used for idempotent billing.
• Billing data: plan, order status and amounts. Card details are handled by our payment processor and never reach our servers.
• Technical data: IP address and basic request metadata kept for security and rate limiting.
• Local data: models, conversations and assets you create on your device stay there unless you enable a cloud feature.

How we use it

We use account and usage data to provide the service, settle credits, prevent abuse, troubleshoot, and meet legal obligations. We do not sell personal data.

Legal bases (EEA/UK)

Where the GDPR applies, we rely on contract performance for core features, legitimate interests for security and abuse prevention, and consent where we send product emails you can unsubscribe from.

Sharing

We share data with service providers that help us run the product, and with model providers only for requests you route to official models.

• Hosting and CDN: Cloudflare.
• Payments: Stripe.
• Transactional email: our email service provider.
• Official model requests: the upstream provider that serves the selected model.

Retention

Account data is kept while your account is active. Billing and usage records are kept as long as needed for accounting, dispute resolution and legal compliance. Deleted accounts are soft-deleted so that ledgers stay consistent, then purged on a schedule.

Your rights

Subject to your jurisdiction, you may request access, correction, export or deletion of your personal data, or object to certain processing. Contact us and we will respond within the period required by law.

International transfers

Our providers may process data outside your country. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

Security

We use encryption in transit, hashed passwords, least-privilege access and audit logs for administrative actions. No system is perfectly secure; report concerns to the address below.

Children

The service is not directed at children under 16, and we do not knowingly collect their personal data.

Changes and contact

We will post changes on this page and update the date above. Questions or requests: support@starole.com.