Privacy Policy

This Privacy Policy explains what information Alissu ("Alissu", "we", "us") collects when you use the Alissu mobile app, the website at https://alissu.com and related services (together, the "Service"), how we use it, who we share it with, how long we keep it, and the choices and rights you have.

Alissu is developed and operated by Falat Hüseyin Ekmen, an independent developer based in Türkiye, who is the data controller for the personal data described here. You can reach us at support@alissu.com.

In short: we collect what we need to run your account and your chats; your messages are sent to the AI model you choose so it can answer; we do not sell your data, show ads, use advertising or analytics trackers, or use your content to train AI models; and you can delete your chats or your whole account in the app at any time.

1. Information we collect

1.1 Account information

• Email sign-up: your email address, a display name (optional; if you skip it we use the part of your email before the @) and your password. We store only a one-way hash of the password, never the password itself. During sign-up and password reset we send a one-time code to your email address.
• Google sign-in: the email address, name and profile picture that Google shares with us.
• Apple sign-in: the email address (or Apple's private relay address, if you chose to hide your email) and name that Apple shares with us. We keep an encrypted token so we can revoke Alissu's access when you delete your account.
• Guest use: you can use the Service without an account. A guest account has no name, email address or password. Guest data lives under a random identifier on your device; if you remove the app or lose the device, the guest account cannot be recovered.
• Your profile picture, if you set one, and your settings: default model, default AI profile, context strategy and notification preferences.
• Your account status and role (guest, user, administrator), email verification date and last sign-in date.

1.2 Content you create

• Chats and debates: the messages you send, the AI responses, chat titles, the models you chose, system prompts and model settings, edits and alternative branches of a conversation, and pins.
• Conversation summaries: short summaries of long chats, generated automatically by an AI model so later messages can keep their context. Summaries are only produced if your plan includes a usage budget.
• Saved prompts, AI profiles (a name plus instructions for the model) and the categories you organize chats, prompts and profiles into.
• Files you upload: your profile picture and, where the app supports it, images, PDF documents and voice recordings you attach to a chat. We check each file's type and size and reject files that do not match.
• Support messages you send through the in-app support form or by email.

1.3 Technical and usage information

• Sessions: for each signed-in device or browser we record the platform (iOS, Android or web), app version, IP address, browser or device user agent, creation time and last activity. We use this to keep your account secure and to let you see and sign out of your active sessions.
• Security events: sign-in attempts, failed verification codes, token misuse and similar events, with the IP address they came from.
• Guest limits: to apply daily free limits to guests and to stop automated abuse, we count requests under a keyed hash of the IP address. The hash cannot be reversed to the address.
• Push notifications: if you allow them, your device's push token, a device identifier, platform, device language and app version.
• Usage records: counts needed to apply your plan's limits (such as messages sent today) and, for paid plans, the cost of each AI request charged against your usage budget.
• Crash and error reports: technical details about an error (stack trace, app version, device model and operating system version, the request that failed without its query string) together with your account identifier. They never contain your name, email address or the content of your chats.
• Server logs: request logs for security and troubleshooting, with IP addresses masked and no message content.
• Audit records of administrative actions taken on your account, such as a suspension.

1.4 Purchase information

If you subscribe, we receive your subscription status, plan, billing period, renewal and expiry dates and a transaction identifier from the store or payment provider that handled the purchase. We never receive or store your card number or bank details. If you redeem a gift code, we record the code and the usage balance it added.

1.5 Organizations

If you create or join an organization (team) on Alissu, we also store the organization's name, your role in it, the invitations you send or receive and the organization's branding assets.

1.6 Information stored on your device

The app keeps your sign-in tokens in the device's secure storage and your language, theme and similar display preferences in local app storage. The website does not set cookies and does not use analytics.

2. How we use your information

• To provide the Service: run your chats and debates, store your history and sync it across your devices, and deliver your files.
• To generate AI responses: send your messages, attachments, system prompts and the relevant chat history to the AI model you selected and return its answer (see section 3).
• To manage your account: create and secure it, verify your email address, let you reset your password and sign out devices.
• To keep the Service safe: detect and limit abuse, fraud, brute-force attempts and attempts to bypass free limits.
• To apply plan limits and manage your subscription, including gift codes and organization contracts.
• To send service emails: verification and password-reset codes, security notices (password changed, all sessions signed out, new sign-in method linked), account deletion confirmation, payment-problem notices and organization notices. These are not marketing emails and cannot be opted out of while you have an account.
• To send product announcements as push notifications or emails, only if you turned that category on. We do not send announcements by default.
• To answer your support requests.
• To find and fix errors and keep the Service reliable.
• To comply with the law and enforce our Terms of Use.

We do not sell or rent your personal data, we do not show ads, we do not use advertising or analytics trackers, we do not profile you for marketing, and we do not use your chats, files or other content to train AI models. We also do not make decisions about you with legal or similarly significant effects based solely on automated processing.

3. AI models and third-party AI providers

Alissu is a client for AI models built by other companies. When you send a message:

• the message, any attachments, the chat's system prompt or AI profile and as much of the earlier conversation (or its summary) as fits the model's context window are sent to the model you selected;
• the request travels through AimRoute, an AI gateway operated by the same developer as Alissu, which routes it to the provider of that model. AimRoute keeps request metadata (model, token counts, cost, timing) for billing and reliability and does not keep the content of your messages;
• the model's provider processes the content to generate the response. Depending on the model you pick, the provider may be OpenAI, Anthropic, Google, xAI, Mistral AI, Amazon Web Services (Bedrock), Microsoft Azure, Groq, Together AI, Cohere or another provider shown in the model list. Each provider processes the content under its own API terms and privacy policy; the current list of providers is always visible in the app's model selector.

We send a random account identifier with each request so the provider can apply abuse protection; we do not send your name, email address or device information. To our knowledge, the providers we use do not use API data to train their models, but we cannot control their practices. Do not include passwords, payment details, government identifiers or other sensitive information in your messages unless you are comfortable with the selected provider processing it.

4. Who we share information with

We share personal data only with the service providers below, who process it on our behalf and under contract, and with the parties you choose to involve.

• AimRoute and AI model providers (section 3): message content needed to generate responses.
• Railway (hosting, United States): runs our servers, database and private file storage.
• Cloudflare: serves the website, manages DNS and routes email sent to our support address.
• Sentry (error monitoring, hosted in the European Union): receives the crash and error reports described in section 1.3.
• Resend (email delivery): receives your email address and the content of the service emails we send you.
• Expo, Apple (APNs) and Google (FCM): deliver push notifications if you turned them on.
• Google and Apple: provide sign-in if you choose Google or Apple sign-in.
• Apple App Store, Google Play and RevenueCat: process and manage subscriptions bought in the app. RevenueCat receives your account identifier and purchase status, not your name or email.
• Lemon Squeezy: if you buy a subscription on our website, Lemon Squeezy sells it as the merchant of record and processes your payment under its own privacy policy.

If you join an organization, its owner and administrators can see your name, email address, profile picture and role in the member list. They cannot read your chats, prompts or AI profiles.

We may also disclose information if the law requires it, to respond to lawful requests from public authorities, to protect the rights, property or safety of Alissu, our users or others, or as part of a merger, acquisition or sale of the Service, in which case this policy will continue to apply to your information.

5. How long we keep information

• Account and content: for as long as your account exists. You can delete individual chats, prompts and AI profiles at any time, or all of them from Settings → Data controls.
• Account deletion: when you delete your account it is closed immediately and you are signed out everywhere. For 30 days you can restore it by signing in again. After that, your account and everything linked to it (profile, chats, debates, messages, files, prompts, AI profiles, settings, device tokens, support requests) is permanently deleted. See Delete your account.
• Incognito chats: deleted automatically 30 days after creation. You can keep at most 30 at a time; opening a new one beyond that deletes the oldest.
• Chat attachments: deleted when the chat is deleted. When your plan's storage limit is full, your oldest chat attachments are deleted to make room for new ones; the chat text is never deleted this way.
• Sessions and sign-in tokens: a session expires after 180 days without use. Expired tokens are removed after 7 days, revoked tokens after 30 days.
• Guest accounts: deleted after 180 days without use.
• Verification and password-reset codes: expire after a short time and are deleted once used or expired.
• Security events: 180 days.
• Crash and error reports: kept by our error-monitoring provider for 90 days.
• Purchase and usage records: for as long as needed for billing, accounting and tax obligations.
• Audit records of administrative actions: for as long as needed to investigate abuse and meet legal obligations.

Copies may remain in encrypted backups for a limited time before they are overwritten, and we may keep information longer where the law requires it or where it is needed to resolve a dispute.

6. Your rights and choices

You can do most things yourself in the app: update your name and profile picture, delete chats, prompts and AI profiles, sign out other devices, turn announcements on or off, and delete your account.

Depending on where you live, you also have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent where we rely on it, without affecting earlier processing;
• lodge a complaint with your data protection authority, for example the Turkish Personal Data Protection Authority (KVKK), an EU supervisory authority or the UK Information Commissioner's Office.

To exercise a right that is not available in the app, email support@alissu.com from the email address linked to your account. We reply within 30 days, may ask you to confirm that you own the account, and do not charge for requests unless they are clearly excessive. Guest accounts have no email address, so we cannot link a request to one; use the controls in the app instead.

Notice for residents of California and other US states: we do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act and similar state laws, and we do not use it for targeted advertising or profiling. You have the rights to know, delete, correct and obtain a copy of your personal information, and the right not to be discriminated against for exercising them. You may use an authorized agent to make a request; we will verify the agent's authority before acting.

7. Legal bases for processing

Where the EU or UK GDPR, Türkiye's Personal Data Protection Law No. 6698 (KVKK) or a similar law applies, we rely on the following bases:

• Performance of our contract with you: account, chats, AI responses, files, subscriptions, support.
• Legitimate interests: keeping the Service secure, preventing abuse, fixing errors and keeping records of administrative actions. We balance these interests against your rights.
• Legal obligations: accounting, tax and responding to lawful requests.
• Consent: product announcements by push or email, and access to your photo library to set a profile picture. You can withdraw consent at any time in the app or your device settings.

8. International transfers

We are based in Türkiye and our service providers operate in the United States, the European Union and other countries, so your information is transferred to and processed outside the country where you live. Where required, we rely on safeguards such as the European Commission's standard contractual clauses or equivalent mechanisms, and on the providers' own commitments to protect your data. You can ask us for more information about these safeguards.

9. Security

We protect your data with encryption in transit (TLS), hashed passwords, encrypted sign-in tokens, private file storage that is only reachable through short-lived signed links, rate limiting, and access to production systems restricted to the developer. No system is completely secure, so we cannot guarantee absolute security, but if a breach affects your personal data we will notify you and the relevant authorities where the law requires it.

10. Children

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, contact us and we will delete it.

11. Website

The website at https://alissu.com is informational. It does not set cookies, does not use analytics and does not require an account. It is served through Cloudflare, which may process your IP address to deliver the pages and to protect the site from attacks.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the date above. If the changes materially affect how we use your personal data, we will also let you know in the app or by email before they take effect.

13. Contact

If you have questions about this policy or your data, email us at support@alissu.com. Our postal address is available on request for legal correspondence.