Privacy Policy

Scope

This policy describes how the DreadAI application handles information. It covers what the application actually stores and transmits today. Where a capability is planned rather than implemented, it is described as such.

Account information

When you create an account we store your email address, the username you choose, the time your account was created and last updated, your account status, your role, and your interface theme preference.

Passwords are never stored by the application. Authentication is handled by the managed authentication service, which stores only a salted hash of your password.

Authentication and sessions

Signing in issues a session token held by your browser. The token is used to prove your identity to the application's server and database. Signing out invalidates the session on this device.

Chat data

Conversations you create, their titles, and the messages inside them are stored in the application database and linked to your user account. They persist so that you can return to them later.

Database access rules restrict every conversation and message row to the account that created it, so other users cannot access your conversations.

Monitoring and abuse prevention

To keep the Service secure and enforce our Terms of Service, we use automated and manual measures, including rate limiting, usage accounting, automated safety filters that screen prompts and responses, and investigation of suspected abuse or security incidents.

Prompts that are blocked by our safety filters are recorded, including the text of the blocked prompt, so that we can review attacks and improve our protections.

Authorized DREAD AI administrators can access account information and conversation content through restricted administrative tools. This access is limited to purposes such as investigating suspected abuse, security incidents, or violations of our Terms of Service, responding to support requests, and meeting legal obligations. Administrative access requires additional authentication, and privileged administrative actions are logged.

Support tickets and feedback you submit are visible to administrators so that we can respond to them.

AI processing

When you send a message, the server sends the conversation content, together with the administrator-defined system instructions, to OpenRouter, which routes the request to the configured model provider. The response is streamed back to you and stored with your conversation.

The API credentials used for this request are held server-side only and are never exposed to the browser. Message content is necessarily visible to OpenRouter and the model provider handling the request; their own policies apply to that processing.

Third-Party AI Processing

DREAD AI uses OpenRouter to route AI requests to the model provider selected for your request.

When you use the AI service, your prompts, relevant conversation context, and other information necessary to generate a response may be transmitted to OpenRouter and the selected model provider.

These providers may process or retain information according to their own privacy policies, service terms, and applicable settings.

DREAD AI does not control the independent data processing practices of these providers.

Cookies and local storage

The application uses browser storage for two purposes: keeping your session so you stay signed in, and remembering your theme preference. No advertising or cross-site tracking technologies are used.

Security practices

The application implements the following controls:

• Row-level access rules on every table holding user data
• Server-side authorization checks on every privileged operation, independent of the interface
• API credentials and model configuration kept server-side
• Input validation on account and message operations
• Markdown output rendered without raw HTML execution
• Basic request rate limiting on AI requests

Security and Data Breaches

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, and disclosure.

No online service can guarantee absolute security.

If a personal data breach occurs, we will assess the incident and take appropriate steps, including notifications where required by applicable law.

Data Retention and Deletion

Your conversations and messages are retained until you delete them or delete your account.

When you delete your account, we remove the associated profile, conversations, and messages from our active application database, subject to applicable legal requirements.

Certain records may remain in backups, security logs, or third-party systems for a limited period, where applicable.

How account deletion works

You can permanently delete your account yourself from Settings. You will be asked to confirm, and the deletion takes effect immediately and cannot be undone.

Deleting your account signs you out and removes your login, profile, conversations, messages, projects, and remaining token balance from our active application database. Any active subscription stops renewing, and unused subscription time or tokens are not refunded, as described in the Refund and Cancellation Policy in our Terms of Service.

Exceptions: we may keep limited records where needed to meet legal, tax, or accounting obligations, resolve disputes, prevent fraud or abuse, or protect the security of the Service. This can include payment and invoice records, records of security and abuse-prevention events, and audit logs of administrative actions. Payment details held by our payment processor are governed by its own retention policies.

Your rights

You can view and update your username and theme preference from Settings, delete individual conversations at any time, and permanently delete your account from Settings, as described in “How account deletion works”. Depending on where you live, you may have additional statutory rights over your personal data.

Third-party services

The application relies on a managed database and authentication provider for storage and sign-in, and on OpenRouter for AI inference. No other third parties receive your data.

Children's privacy

The application is not directed at children and accounts should not be created by anyone under the age required by their local law to consent to online services.

Acceptable use

DreadAI is intended for lawful technical work, including defensive security, education, capture-the-flag exercises and authorized testing. Using it to attempt unauthorized access or other illegal activity is not permitted.

Changes to this policy

This policy may be updated as the application changes. Material changes will be reflected on this page along with a revised effective date.