Privacy policy

• Account: your email address and a hashed password (we never store the password itself), the time you joined and your plan.
• Your chats and settings: conversations, projects, memory, custom assistants and preferences, saved to your account so they follow you to other devices.
• Files: files you upload and files or images created for you.
• Usage records: what kind of request was made, the model used, token counts, credits used and errors. They are used for credits, limits and fixing problems.
• Payments: the plan, amount, method (bKash, Nagad, Rocket, Binance Pay or USDT), sender number or ID and transaction ID you enter, so a person can check the payment.
• Connections: if you connect Google, Slack, Notion or an MCP server, the access tokens needed for it, stored encrypted. You can disconnect at any time.

We use a sign-in cookie to keep you logged in. Visitors without an account get a cookie that counts their free messages. At sign-up we also set a device cookie and keep a one-way hash of your IP address and device cookie so that one person cannot create many free accounts. The IP address itself is not stored, but it is checked once with a VPN and proxy detection service (proxycheck.io).

We do not use advertising cookies. If the site owner turns on analytics, that is stated in the site settings and uses Google Analytics.

To answer you, your messages and the text of files you attach are sent to our AI API providers, which run the GPT models. Web searches send your search words to our search provider. Image requests send your description (and the picture you edit) to our image provider. Password reset emails go through our email provider. Each receives only what it needs for that request.

If you connect Google, Slack, Notion or an MCP server and ask the assistant to use it, the assistant reads and sends data to that service on your behalf. Writing actions are shown to you for approval first.

We keep your data until you delete it or ask us to delete your account. Deleting a chat removes it from your account. Usage records and payment records may be kept longer where needed for accounting, security and fraud prevention.

You can delete conversations and files yourself, turn off memory, export your data from Settings, and disconnect any connection. To delete your account or ask for a copy of your data, use the contact page.

Do not put secrets such as passwords or card numbers into chats.

Passwords are hashed, connection tokens are encrypted, and access to files is limited to your account. No system is perfectly secure, so please use a strong password that you do not reuse elsewhere.

DupliChat is not meant for children under 13. If you believe a child has created an account, contact us and we will remove it.

We may update this policy. The date at the top shows the latest version.