Privacy Policy

Last updated: 6 November 2026

This policy explains what GARO AI collects, why, who handles it, and your choices. The service is run by Divinewill Gopeh Inyang, who is the controller of your data. Contact: garoai.003@gmail.com

1. What we collect

Account data: your email address, your name, a username, your country, your phone number (kept private; used to protect your account and for password recovery and, later, verification codes), your date of birth, an optional profile photo, your preferences (such as citation style and how you plan to use the service), and your password (stored only as a secure hash by our login provider, never in readable form).
Chats: the titles and messages (yours and the AI's) of conversations you save in your account.
Technical data: IP address, browser type and request times, which appear in hosting and server logs, plus short-lived counters used to enforce message-rate limits.
Browser storage: a login session and your last selected model, kept in your browser's local storage on your device. We set no advertising or tracking cookies.

2. Why we use it

To create and secure your account, verify your email, run the chat, save your history, prevent abuse, fix problems, and meet legal obligations. We do not sell your data and we do not show ads.

3. How your messages are processed

Your message travels over HTTPS to our own server, where open-source models generate the reply. Your messages are not sent to third-party AI companies and are not used to train models. Our gateway does not write message content to its logs.

Files and voice. If you attach a document, its text is read in your browser and sent with your message to our server. Only the file name is saved in your chat history, not the document text. The microphone button uses your browser's built-in speech recognition, which in most browsers sends audio to the browser maker (for example Google or Apple) to be turned into text. Audio files you upload are transcribed on your own device with a small speech model, and the audio is not uploaded to us. Profile photos you choose are stored with Supabase.

Research documents. In Deep Research, the documents you add are read in your browser and kept only in your browser's memory for that session. For each question, short relevant excerpts are sent to our server to produce the answer. The documents themselves, and the author and title details you type for citations, are not saved to your account.

Sneak Peek. You can try the assistant without an account. Those messages are processed to produce a reply and are not saved anywhere, and your IP address is used only to apply a free-use limit.

Groups, shared chats and projects. Messages, reactions, shared files and project files you post in a group are stored with Supabase and can be seen by the current members of that group. Your display name, username and profile photo are visible to people you share a group with. When you leave or are removed from a group you no longer see it. Files you share are stored privately and only group members can download them. When you share a chat, a copy is posted into the group you choose and your original chat stays private. When you ask @Garo in a group, a limited amount of recent group conversation, and your project files if it is a Developers project, is sent to Garo to answer.

Web search. When you turn on Web search, press "Verify with the web", or tell Garo that an answer is wrong or outdated, a short search query based on your message is sent to our own private search service. It asks public search engines for results from our server's address, not yours, and your account details are not sent with the query. Garo reads the top results to answer and shows its sources as links.

Moderation. Administrators can suspend or delete accounts that break the Terms of Use. We keep a log of each action (which administrator, which account, when and why) so that decisions can be reviewed. A suspended account cannot sign in until the suspension is lifted.

4. Who handles your data

Supabase provides login and stores accounts and saved chats, in the West EU (Ireland) region.
Oracle Cloud hosts the server that runs the AI models and the gateway.
GitHub hosts this website and may log visitors' IP addresses.
jsDelivr delivers script libraries (login, document reading, zip creation and speech-to-text code) to your browser, so it sees your IP address.
Hugging Face supplies the small speech model your browser downloads if you use audio-file transcription.
Our email provider sends verification and password-reset emails.

These providers process data on our behalf under their own terms and privacy policies.

5. Access by the operator

Saved chats are protected so that other users cannot read them, but they are not end-to-end encrypted. The administrator of the service can technically access stored data. We only do so to keep the service secure, investigate abuse, fix faults or respond to a legal duty, or when you ask us for help.

6. How long we keep data

Chats stay until you delete them or close your account. Deleting a chat in the app removes it from our database. Account data is deleted when you delete your account, or when an administrator deletes an account that broke the Terms of Use. Backups are kept for up to 14 days and then overwritten. Server logs are kept for a short period for security.

7. Security

We use HTTPS, email verification, per-user access rules on stored chats, rate limits, and a model server that is not directly reachable from the internet. No system is perfectly secure, so please use a strong, unique password.

8. Your rights

Depending on where you live, including under the Nigeria Data Protection Act 2023 and the EU and UK GDPR, you may have the right to access your data, correct it, delete it, receive a copy, restrict or object to some uses, and complain to your data protection authority. You can delete individual chats at any time, and you can delete your whole account yourself from your profile: this erases your account, saved chats, profile photo and the messages and files you posted in groups, and hands any groups you manage to another member. For other requests, such as a copy of your data, email us and we will reply within 30 days.

9. Children

The service is not for people under 16, and we do not knowingly collect their data. We ask for your date of birth at sign-up to check this. We store it with your account only to confirm your age and to show you a birthday greeting on your birthday. If you believe a child has signed up, contact us and we will delete the account.

10. International processing

Your data may be processed in Ireland (Supabase) and in the country where our server is hosted. We rely on our providers' safeguards for these transfers.

Cookies and local storage

GARO AI uses cookies and your browser's local storage (a kind of cache) only to make the service work and to remember your choices. We do not use advertising, tracking or analytics cookies. When you first visit you can accept all, keep essential only, or manage your choices, and you can change them at any time with "Cookie settings" in the footer or in your profile menu. Your choice is remembered for 12 months.

Essential (always on): your sign-in session (kept by our login provider, Supabase), your cookie choice, and short-lived session items such as an invite link or your admin mode choice.
Preferences (optional): your theme, your last selected model, recently used emojis, birthday message reminders and the reminder to add a phone number. If you choose "Essential only", these are not kept between visits.

11. Changes

If our practices change we will update this page and the date above.

Contact

GARO AI, garoai.003@gmail.com