Privacy Policy

Scope

This policy describes how the DreadAI application handles information. It covers what the application actually stores and transmits today. Where a capability is planned rather than implemented, it is described as such.

Account information

When you create an account we store your email address, the username you choose, the time your account was created and last updated, your account status, your role, and your interface theme preference.

Passwords are never stored by the application. Authentication is handled by the managed authentication service, which stores only a salted hash of your password.

Authentication and sessions

Signing in issues a session token held by your browser. The token is used to prove your identity to the application's server and database. Signing out invalidates the session on this device.

Chat data

Conversations you create, their titles, and the messages inside them are stored in the application database and linked to your user account. They persist so that you can return to them later.

Database access rules restrict every conversation and message row to the account that created it. Administrators do not have a route in the application to read the contents of other users' conversations.

AI processing

When you send a message, the server sends the conversation content, together with the administrator-defined system instructions, to OpenRouter, which routes the request to the configured model provider. The response is streamed back to you and stored with your conversation.

The API credentials used for this request are held server-side only and are never exposed to the browser. Message content is necessarily visible to OpenRouter and the model provider handling the request; their own policies apply to that processing.

Cookies and local storage

The application uses browser storage for two purposes: keeping your session so you stay signed in, and remembering your theme preference. No advertising or cross-site tracking technologies are used.

Security practices

The application implements the following controls:

• Row-level access rules on every table holding user data
• Server-side authorization checks on every privileged operation, independent of the interface
• API credentials and model configuration kept server-side
• Input validation on account and message operations
• Markdown output rendered without raw HTML execution
• Basic request rate limiting on AI requests

Data retention

Conversations and messages are retained until you delete them. Deleting a conversation removes its messages. Deleting your account removes the associated profile, conversations and messages.

Your rights

You can view and update your username and theme preference from Settings, delete individual conversations at any time, and request deletion of your account. Depending on where you live, you may have additional statutory rights over your personal data.

Third-party services

The application relies on a managed database and authentication provider for storage and sign-in, and on OpenRouter for AI inference. No other third parties receive your data.

Children's privacy

The application is not directed at children and accounts should not be created by anyone under the age required by their local law to consent to online services.

Acceptable use

DreadAI is intended for lawful technical work, including defensive security, education, capture-the-flag exercises and authorized testing. Using it to attempt unauthorized access or other illegal activity is not permitted.

Changes to this policy

This policy may be updated as the application changes. Material changes will be reflected on this page along with a revised effective date.