This policy describes how X-ion handles information when you use Scrutium, its chat and build features, and related websites. It describes the current product, not the separate privacy policies of third-party providers.
Information you provide
Depending on how you use the service, this can include your email, profile details, prompts, conversation history, AI responses, custom instructions, feedback, project files, published apps, and files you upload. If you use Memory, saved facts are stored with your account; Memory is enabled by default unless you turn it off in Settings.
When you add a provider API key, the key is encrypted by the server using AES-256-GCM before it is stored. You can remove a saved key in Settings. The product is not end-to-end encrypted: service infrastructure must process content to provide the requested features.
Files and browser storage
Uploaded attachments are stored in private Supabase Storage and associated with your chat. The app creates signed file links that expire after 24 hours. Text extraction for supported documents happens in the browser; extracted text is included in the request sent to the AI provider when you send that chat message. Scanned PDFs are not OCR processed. A chat deletion removes its database records, but the app does not currently provide a separate attachment-storage deletion control or a complete file export.
The app uses browser storage for preferences, guest identifiers, limited guest-use state, and some locally cached app data. Sign-in and security also rely on essential cookies. Optional performance analytics are loaded only on the official deployment when you enable Performance Analytics in privacy choices. That analytics service may receive technical usage information. Advertising and targeting trackers are not currently enabled by Scrutium.
How AI processing works
When you send a message, Scrutium sends the conversation context needed for that response, your current instructions and preferences, relevant saved Memory when enabled, and any included attachment text to the provider serving the selected model. The provider returns a response that may be saved in your chat. If you use web search or a live-data tool, the relevant query may also be sent to that tool's provider to retrieve results.
Scrutium does not operate its own foundation-model training pipeline or use chats to train a Scrutium model. This is not a promise about third-party model providers: their retention, training, and handling practices depend on the provider, product, and applicable account terms. Review those terms before sending sensitive information. Your prompts may be processed outside your country.
Why information is used
We use information to provide chat, file, memory, and build features; authenticate accounts; save and sync chats and projects; enforce usage limits; prevent abuse; maintain service security; respond to feedback and support requests; and operate optional performance analytics when you consent.
Guest requests are not saved as chat records in the Scrutium database. Guest limits use the request IP address and a browser guest identifier to enforce quotas and rate limits. Hosting and service providers may process technical request data to operate and protect the service.
When information is shared
Information is shared with infrastructure providers that host the app, database, and files; the AI model provider for your request; and search or live-data providers when you invoke those tools. These providers process information under their own terms and privacy practices. We do not sell personal information. We may also disclose information when required by law or needed to protect users, the service, or its security.
Apps you publish as Public are accessible to anyone and may be indexed by search engines. Link-only apps can be opened by people who have their URL. Do not publish content you intend to keep private.
Retention and your controls
Signed-in chats, projects, profile information, and settings are kept in the service while needed to provide your account and features. There is no published fixed retention schedule for provider logs or backups. Deleting a chat removes its database chat and message records; it may not immediately remove associated storage objects or copies held in provider backups.
The current Download My Data control exports profile information and chat-list metadata, not conversation message contents or every category described above. There is no self-service account deletion or complete data-request workflow in the app yet. Contact support to request access or deletion. We may need to verify your identity, and we will explain what we can fulfill and any applicable retention limits.
You can review, disable, or delete saved Memory in Settings. You can change optional performance analytics consent through Privacy Choices. Deleting your browser's local storage also removes locally saved preferences and guest state from that browser, but does not delete account data held by the service.
Children and age requirements
The minimum age is configured for the deployment and defaults to 13. Additional age checks and guardian controls may apply. Do not use the service if you do not meet the age requirement that applies to you.
Changes and contact
We may update this policy as the product changes. For privacy questions or requests, visit the Scrutium Help Center or contact page.