Privacy Notice
The short version
- We collect what we need to run Avxor: your account details, your chats, security records, and billing records.
- Your prompts are sent to AI model providers to generate replies. We don't sell your personal information, don't show ads, and don't use your content to train AI models.
- The website uses one essential sign-in cookie. No advertising, analytics, or tracking cookies.
- You can export your data and delete your account yourself in Settings.
- Questions or requests: support@avxor.com.
This summary is for convenience; the full notice below applies.
1. Who we are and what this notice covers
Avxor is provided by an independent operator based in Canada ("Avxor", "we", "us"), who is responsible for personal information under this notice. Our Privacy Officer can be reached at support@avxor.com. This notice applies to the avxor.com website, the Avxor apps, the Avxor API, and our account, security, and payment systems (the "Service"). It does not apply to third-party websites, services, or integrations, which have their own policies. This notice explains our practices; it is not a contract and does not create contractual rights or obligations beyond those in our Terms of Service or required by law.
2. Information we collect
| Category | What it includes |
|---|---|
| Account | Email address, username, a salted and keyed hash of your password (never the password itself), email-verification status, your two-factor method (emailed codes or an authenticator app, with the authenticator secret stored encrypted), sign-in sessions (stored as hashes), and the date you accepted our Terms and confirmed your age. |
| Profile and preferences | Optional profile picture and color, theme, compact layout, and Enter-to-send settings. |
| Content | Your prompts, attached images, Avxor's replies and reasoning summaries, chat titles, folder names, and conversation summaries created when a long chat is compacted. In Work mode (Windows app), the contents of files, command output, and web pages that Avxor reads for a task are sent to the AI model as part of that task. |
| Usage and billing | Your credit balance, a ledger of credits added and used, a record of each model request (the model and thinking level used, how it was paid for, its cost, token counts reported by the model, and the time, but not its content; kept for 90 days), your plan (if any), its status, renewal date, and usage in each 5-hour and weekly window, your "use credits when I reach a limit" setting, and payment records from Stripe (amount, currency, status, date, and Stripe customer, subscription, payment, and checkout identifiers). Stripe collects your card or payment details on its own checkout page; Avxor never receives your full card number or security code. |
| Security records | Hashed one-time codes (sign-up, sign-in, password reset, and email change; each valid for 10 minutes), hashed rate-limit and failed-attempt counters, and records of security emails we send you. |
| API keys | Key name, prefix, a hash of the key, and creation, last-use, and revocation dates. The full key is shown to you only once. |
| Referrals | Your personal invite code, which account invited you (if any), whether accounts you invited have subscribed and renewed, and the referral rewards you have earned. A person you invite can't see your account details, and you only see counts, not who your friends are. |
| Bug reports | The title and description of bug reports you send from Settings, the app or browser version, and the time. They are read by Avxor's operator to fix problems and are deleted if you delete your account. |
| Safety records | Messages our automated safety check flags as attempts to get around Avxor's rules (the text of the flagged message, the model and thinking level, and the time), and any resulting review decisions and suspension case numbers. These are reviewed by Avxor's operator to decide whether to take action on an account, and kept for as long as needed for that purpose and to handle appeals. |
| Technical information | IP address and request metadata processed by our hosting provider to deliver the Service, protect it from abuse, and apply rate limits. |
| Communications | Messages you send to support and related correspondence. |
Interface preferences such as your selected model, thinking level, and (in the Windows app) approval mode are stored on your device (the model and thinking level of each request are also kept in the request record described above). The website offers Chat mode only and does not access files on your device.
Please don't send us sensitive information you don't need to. Do not submit passwords for other services, full payment card numbers, government identifiers, health information, or personal information about other people unless you have a lawful basis and their permission. You are responsible for the content you choose to submit.
3. How we use information
- To create, verify, secure, and authenticate your account, including two-factor sign-in.
- To generate AI responses, run the tools you allow in Work mode, and save and sync your chats across the website and the apps.
- To screen requests automatically for content that breaks our acceptable use rules.
- To measure usage, apply plan limits, charge credits, process payments, subscriptions, refunds, and chargebacks through Stripe, prevent fraud, and keep accounting and tax records.
- To send service and security emails, such as verification and sign-in codes, password resets, and alerts when your password, email, or two-factor settings change. We do not send marketing email.
- To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms; to fix problems; and to enforce our agreements.
- To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
- To understand and improve the reliability and performance of the Service using aggregated or de-identified information that does not identify you (never to train AI models on your content).
We rely on your consent (given when you sign up and when you use particular features), on the need to provide the Service you requested, on our legitimate interests in operating, securing, and improving the Service and protecting our rights (where applicable law recognizes this basis), and on legal obligations. You may withdraw consent by deleting your account, subject to the retention described in section 8 and any legal or contractual restrictions; withdrawing consent may mean we can no longer provide the Service to you.
4. AI processing and automated screening
To answer you, the relevant part of your conversation (including attached images, summaries of earlier messages, and any tool results) is sent to third-party AI model providers that power Avxor's models. They process it to generate the response under commercial terms that do not allow them to use it to train their models, and they may retain it for a limited time for safety and abuse monitoring under their own policies. We do not use your content to train AI models and we do not sell it.
Requests are screened automatically, and some may be declined. This screening only decides whether a request is processed; it does not produce decisions with legal or similarly significant effects about you. If you believe a request was blocked in error, contact us.
5. Who we share information with
We share personal information only as described here:
| Recipient | Purpose |
|---|---|
| Cloudflare | Hosting, website and app delivery, network security, our database, file downloads, and email routing. |
| AI model providers | Generating responses (see section 4). |
| Resend | Sending verification codes, sign-in codes, password-reset codes, and security alerts. |
| Stripe | Processing payments, recurring plan billing, refunds, and disputes, and preventing payment fraud. Stripe receives your payment details and email address and handles them under its own privacy policy (stripe.com/privacy). |
| Websites and search engines (Windows app only) | In Work mode, web searches and pages are requested directly from your own computer, so those sites receive your device's request under their own policies. |
| Professional advisers | Lawyers, accountants, and similar advisers, under confidentiality, where needed to operate the business or protect our rights. |
We may also disclose information: (a) if we believe in good faith it is required by law, regulation, court order, subpoena, or other legal process, or requested by a government authority with appropriate authority; (b) to investigate, prevent, or respond to fraud, security incidents, illegal activity, or violations of our Terms; (c) to protect the rights, property, or safety of Avxor, our users, or others; (d) to establish, exercise, or defend legal claims; and (e) in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of the Service, in which case the information remains subject to protections at least as strong as this notice. We may share aggregated or de-identified information that cannot reasonably identify you. We do not sell or rent personal information, and we do not share it for advertising.
6. Cookies and similar technologies
The website sets one strictly necessary cookie, __Host-avxor_session, which keeps you signed in. It is HttpOnly (page scripts can't read it), secure, limited to avxor.com, and expires after 30 days or when you log out. The website also uses your browser's local storage for interface preferences. We do not use analytics, advertising, or third-party tracking cookies, and our website blocks third-party scripts. Because we don't track you across sites, we don't respond differently to "Do Not Track" signals.
7. Security
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including: HTTPS everywhere; salted and keyed password hashing; required two-factor authentication; hashed session tokens, API keys, and one-time codes; encrypted authenticator secrets; HttpOnly sign-in cookies; strict content-security policies; rate limits and lockouts for repeated failed attempts; security alert emails; and access controls. The Windows app stores its sign-in token and connected-tool settings encrypted for your Windows account.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password, two-factor methods, email account, and devices secure, and for using the Service on trusted devices and networks. If we learn of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the appropriate authorities as required by law.
8. How long we keep information
| Information | Kept |
|---|---|
| Chats, folders, profile | Until you delete them or your account. |
| Sign-in sessions | Up to 30 days, or until you log out or revoke them. |
| One-time codes | 10 minutes, or until used. |
| Sign-in challenges, rate-limit and failed-attempt counters | Minutes to one hour; removed automatically. |
| Accounts never verified by email | Deleted after 2 days. |
| Payment records and credit ledger | As long as needed for accounting, tax, fraud prevention, and legal claims (generally up to 7 years), including after account deletion, linked to an anonymized account record. |
| Support correspondence | As long as needed to resolve the matter and for related legal or accounting purposes. |
| Database backups | Up to 30 days, after which deleted data is no longer recoverable. |
We may keep information longer where required by law, to resolve disputes, to enforce our agreements, or to preserve evidence of suspected fraud or abuse.
9. Deleting your account
You can delete your account in Settings → Data. Deletion immediately removes your chats, folders, profile, API keys, authenticator, and sign-ins on all devices, and replaces your email address and username with an anonymous placeholder. Payment and credit records are kept as described in section 8. Deleted data may remain in backups for up to 30 days. Information already shared with service providers, such as Stripe, is handled under their policies.
10. Where information is processed
We and our service providers may process and store information in Canada, the United States, and other countries where they operate. Information processed outside your country may be subject to the laws of that country and accessible to its courts, law enforcement, and national security authorities. By using the Service, you acknowledge this processing. We use providers that protect information with contractual and technical safeguards.
11. Your rights and choices
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to withdraw consent, and to object to or restrict certain processing. You can export your data and delete your account yourself in Settings; for anything else, email support@avxor.com. We will need to verify your identity before acting on a request, and we may decline requests that are manifestly unfounded, excessive, or that would affect others' rights or our legal obligations, as permitted by law. We respond within the time required by law (generally 30 days). Never send us your password. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy authority where you live.
12. Age requirement
The Service is only for people aged 19 and older. We do not knowingly collect personal information from anyone younger. If you believe someone under 19 has an account, contact us and we will delete it.
13. Third-party links and integrations
The Service may link to, or let you connect, third-party websites, tools, and services. We are not responsible for their content or privacy practices. Information you give to them, or that Avxor sends to them at your direction in Work mode, is governed by their policies.
14. Changes to this notice
We may update this notice. We will post the updated version here with a new "Last updated" date and, for material changes, notify you in the Service or by email before they take effect and, where required, ask for your consent again. Your continued use of the Service after an update takes effect means you acknowledge the updated notice.
15. Contact
Avxor Privacy Officer · support@avxor.com