How your data is handled

This page explains what account and conversation data AI Chat Console collects, why, how it's used to provide the service, who it's shared with, how long it's kept, and the privacy controls available to you — including the optional chat encryption at rest feature described in detail below. This is a general-purpose policy covering the platform as a whole, not just encryption.

Last updated: August 15, 2026.

Jump to: Information we collect · How we use it · Chat encryption · Third-party AI providers · Payments · Retention & deletion · Security · Your rights · Children's privacy · Changes

Account information

• Username, email address, and password (stored as a salted bcrypt hash — we never store or can recover your plain-text password).
• Billing/company details you provide for invoicing, and your subscription plan.

Conversation data

• Your messages and the AI's replies, chat titles, and rolling context summaries generated to keep long conversations efficient. Optionally encrypted at rest — see below.
• Prompts and outputs for generated images, video, and audio, plus the generated files themselves (stored on disk, referenced by the database).
• Documents you upload for retrieval (RAG) and facts saved to long-term memory, if you use those features.
• Auto-memory (on by default — you can turn it off in Account → Preferences or Account → Memory): after a chat exchange, a background AI call reviews the recent messages and may save up to a few short, durable facts or standing instructions about you (e.g. stated preferences), plus a persistent seed/style note for image or video generation so repeat generations stay visually consistent. It never records one-off task content, and this background call is billed to your own AI credits like any other message. These entries are stored alongside — and are indistinguishable in storage from — memory facts you add yourself, and are used the same way (see below).
• Draw-mode follow-up detection: when you send a new image-generation request in a chat that already has a generated image, a background AI call reviews a few recent messages and the prior image's text prompt (never the image file itself) to decide whether your new request is a follow-up edit (e.g. "make it blue") — if so, it rewrites your prompt to be self-contained and automatically attaches the earlier image as a reference, the same as if you'd clicked "Use as Reference" yourself. This call is not billed to your credits; the model that handles it is chosen by the site administrator (either a dedicated low-cost model, or the same model generating your image), configurable in Admin → Settings.
• Chats you explicitly share via a public link, and any collaborators you invite into a shared session.

Usage, billing & technical data

• Credit balance, plan, and per-request metadata (provider, model, token/asset counts) needed to meter usage fairly — see the Fair Usage Policy.
• Payment records from our payment processor (Stripe, SSLCommerz, or manual/offline payment) — we do not store your full card number; the processor handles that.
• Standard request metadata such as IP address, browser/session identifiers, and timestamps, used for rate-limiting, fraud/abuse prevention, and troubleshooting. Session cookies and a CSRF token are used to keep you logged in and protect against cross-site request forgery — both are strictly functional, not used for advertising or cross-site tracking.
• Administrative action logs (an audit trail of admin panel actions like plan or setting changes) for accountability — this does not include your conversation content.

API keys (BYOK)

If your plan allows "bring your own key" and you choose to add your own provider API key, it is encrypted at rest (AES-256) using the same key-management approach described below, independent of whether you've turned on chat encryption.

• To operate the service — authenticate you, run your conversations through the AI provider/model you select, generate media, and keep your history available across sessions and devices.
• To meter and bill usage under your plan (credits, fair-use limits, subscription billing).
• To maintain and improve reliability and security — error/warning logs, rate limiting, abuse prevention. Error logs may include technical request metadata but are not a substitute for, or a copy of, your encrypted conversation content.
• To communicate with you about your account (billing receipts, security notices, support replies).
• We do not sell your personal data, and we do not use your conversation content to serve third-party advertising.

In Preferences → Privacy, you can turn on "Encrypt my chats". It is off by default — nothing changes for your account unless you explicitly enable it.

What it does

When enabled, your message content, chat titles, and image/video/audio generation prompts are encrypted (AES-256) before being stored in the database. If someone were to gain unauthorized access to a database backup or export — a stolen backup file, a leaked SQL dump, a compromised low-privilege database credential — your conversations would appear as unreadable ciphertext rather than plain text.

What it does not do

• It does not stop AI Chat Console's server-side code from reading a message while actively processing it (required to generate a response).
• It does not stop someone with legitimate administrative access to this service from reading messages the same way they always could.
• It does not encrypt generated image/video/audio files themselves — only the associated text (prompts, titles, captions) in the database.
• It does not cover saved long-term memory facts, or documents you've uploaded for retrieval — those are handled separately.

What you gain in exchange

• Search still works. Since the database can't pattern-match encrypted text, search is done by decrypting your own messages/titles at the moment you search — the same decryption the server already performs whenever you open a chat — rather than matching stored ciphertext. Nothing new is stored to make this work, so it doesn't add any new exposure. Very large histories (beyond a few thousand messages) may not have their oldest content included in a single search.
• Everything else keeps working normally: sending and receiving messages, sharing a chat via a public link, exporting your history, auto-generated titles and summaries, image/video/audio generation, and collaboration on shared chats.

Turning it on or off

Enabling it converts your existing chat history in the background (a progress bar shows how far along it is — safe to close the page and come back, it resumes automatically). Disabling it reverses the process and search comes back once decryption finishes.

⚠️ Software limits of this encryption feature

The technical constraints below apply regardless of your own setting, so you know exactly what "encrypted" does and doesn't mean here.

• One shared encryption key for the whole platform. All encrypted accounts on this installation share a single AES-256 key (ENCRYPT_KEY, held by the server operator) — there is no per-user key, and no password-derived key only you know. This is what makes server-side processing (sending your message to the AI) possible at all; it also means the operator technically holds the key that protects everyone's data, not just you.
• Algorithm: AES-256-CBC with a random IV per value, implemented via PHP's OpenSSL extension. This is a solid, industry-standard cipher, but this deployment is not run through a hardware security module (HSM), is not FIPS-140 certified, and keys are not automatically rotated.
• If the encryption key is ever lost, changed, or restored incorrectly (e.g. a misconfigured server migration), every encrypted user's conversation history becomes permanently unreadable — there is no recovery mechanism. This is a real operational risk you're trusting the operator to manage correctly (regular, matched backups of both the database and the key).
• Not applied everywhere. Only message content, chat titles, rolling summaries, and image/video/audio prompts are encrypted. Generated media files on disk, uploaded RAG documents, and long-term memory facts are stored as plain files/rows regardless of this setting.
• Search trade-off. Search decrypts a capped batch of your own recent messages/titles at query time instead of matching stored ciphertext — accurate, but bounded, so an extremely large history's oldest content may not surface in a single search.
• Guests cannot use it. The feature requires a registered account; anonymous/guest trial sessions are never encrypted.
• Administrator-controlled availability. The site operator can disable new opt-ins for this feature platform-wide from their admin settings at any time. If they do, anyone already encrypted keeps working normally (and can still turn it back off) — but new users/opt-ins are blocked until it's re-enabled.
• Not a substitute for end-to-end encryption. If you need guarantees that literally no one operating the server can ever read your messages, this feature does not provide that — see "What it does not do" above.

To generate a response, your message is sent to the AI provider/model you selected (OpenAI, Anthropic, Google Gemini, xAI/Grok, Cloudflare Workers AI, Mistral, DeepSeek, Pruna AI, OpenRouter, or others depending on what's configured on this instance). Each provider processes your request under its own data-handling and retention terms, which are outside our control — please review the provider's own policy if you have concerns about a specific model.

Some background features — rolling context summaries, auto-memory extraction, and Draw-mode follow-up detection (see above) — are not always sent to the same provider/model you picked for your reply. The site administrator can configure these to use a separate, typically lower-cost model instead; only a short excerpt of recent conversation (never full history, and never raw generated image/audio/video files) is sent for these specific calls.

Where a provider offers a Zero Data Retention (ZDR) option, you can enable ZDR mode in Preferences to request it be used wherever available, and optionally restrict the model picker to only ZDR-capable models.

If you bring your own API key (BYOK) on a plan that allows it, your requests for that provider are billed and rate-limited by your own account with that provider directly, not ours.

Subscription and pay-as-you-go payments are processed by a third-party payment gateway (Stripe, SSLCommerz, or a manual/offline method the operator has configured) — we never see or store your full card number. Only transaction metadata needed for billing records (amount, date, plan, status) is kept on our side.

• Your account data and conversation history are retained for as long as your account is active, so your chat history remains available to you.
• You can permanently delete your account from Account settings. This removes your account and associated data from active use; residual copies may briefly persist in routine database backups until those backups age out on their normal retention schedule.
• Individual chats can be deleted at any time from the sidebar, independent of deleting your whole account.

• Passwords are hashed with bcrypt (never stored or logged in plain text).
• All API keys — both the operator's pooled keys and any key you bring yourself (BYOK) — are encrypted at rest, independent of the chat-encryption toggle.
• Sessions use CSRF tokens on every state-changing request, and admin actions are recorded in an audit log for accountability.
• Requests are rate-limited to reduce abuse, and file uploads are validated and size-capped before storage.
• No security measure is perfect — see the encryption limits above for what this specific feature does and does not protect against.

• Access & export — your conversation history is always visible to you in the app; administrators can also provide a data export on request.
• Encryption opt-in/opt-out — turn "Encrypt my chats" on or off at any time in Preferences → Privacy (subject to the operator allowing the feature — see above).
• Zero Data Retention — request ZDR routing where your selected provider supports it, or restrict yourself to ZDR-only models.
• Deletion — delete individual chats or your entire account at any time from Account settings.
• Bring your own key — where your plan allows it, use your own provider API key instead of the shared pool key.

This service is not directed to children and is not knowingly used to collect personal information from anyone under the minimum age required by applicable law in their jurisdiction.

We may update this page as the service evolves (for example, adding a new AI provider or a new privacy control). The "Last updated" date at the top reflects the most recent revision. Continued use of the service after a change constitutes acceptance of the updated policy.