Privacy Policy

Last updated: September 30, 2026

AI Spar (aispar.app) is a research tool that sends your question to multiple AI models and compares their answers. This policy describes what information we collect, how we use it, who we share it with, and the choices you have. Questions and requests: [email protected].

Information we collect

• Account information. If you sign in with Google, we receive and store your name, email address, Google account identifier, and the URL of your Google profile picture, which we refresh on each sign-in. We never see or store a password.
• Your content. The questions you ask, the AI models' responses, and the resulting analysis and synthesis. When you are signed in, these are stored in your conversation history. Files you attach (images and PDFs) are not kept there: only their filenames remain visible in the conversation, and the file itself is retained only as an encrypted operational copy that is deleted within about a day. Running a debate also places a temporary decrypted copy of each attachment on the server that executes it, for the duration of that run (see Retention and deletion). Questions asked without signing in are also stored, as an unclaimed conversation that is not linked to any account. Separately, running a question creates an operational copy of the request (question text, selected models, and encrypted attachments) in our job records, so a debate survives a restart; see Retention and deletion below.
• Messages you send us. If you use the contact form on the Help page, we receive the email address and message you enter and deliver them to [email protected] through Google's SMTP relay. Our application logs record the sender address you supplied (not the message body), and the message itself is retained in that mailbox.
• Payment records. Payments are processed by Stripe. We store transaction records (amounts, timestamps, and Stripe identifiers) and your prepaid balance. We never receive or store your card or payment-method numbers. When you open a checkout, we also record the two-letter country code that our network provider (Cloudflare) derives from your connection, to help us detect payment fraud. We do not store your IP address. If a card payment is declined, we record only whether the card's issuing country matches your billing-address country (a yes/no value, not either country).
• Provider API keys you supply (BYOK). If you store your own AI-provider API keys with us, they are encrypted with a cloud key-management service before being saved, and are used only to make requests on your behalf.
• Technical information. A session cookie keeps you signed in. It expires after 14 days without use and at most 30 days after you sign in, however often you use it, and signing out ends your sessions on all of your devices. A CSRF cookie tied to your session protects requests; interface preferences may be kept in your browser's local storage. To enforce fair-use capacity limits for anonymous use, we derive a keyed one-way hash from network and browser identifiers; our application records and request logs store hashed identifiers and route names — not raw IP addresses, and never the content of your questions.
• Advertising and conversion measurement. Our pages load Google's advertising tag (Google Ads) so we can tell whether our ads lead to visits and to sign-ups and purchases; we do not run Google Analytics. Beyond the page view, the tag reports a conversion event to Google in three places: when you complete sign-up, when a signed-out visitor starts a debate, and when a payment completes. The payment event also carries the amount, its currency, and the identifier of that Stripe checkout session. We never pass the tag your questions, your attachments, your conversations, or your email address. Our traffic is proxied by Cloudflare, which processes connection data to provide security and delivery.

How we use information

To provide the service (running your questions against the AI models and saving your conversations), to bill prepaid balances, to enforce capacity and abuse limits, and to keep the service reliable and secure. We do not sell personal information, and we do not use the content of your questions for advertising or to train models of our own.

Who receives your information

• AI providers. The content of your question, attachments, and the debate context are sent to the model providers you select — Anthropic, OpenAI, and Google — who process it under their own API terms and privacy policies.
• Debate checks. For some automated checks during a debate (whether a model conceded a point, which argument persuaded it, and whether it agreed with a point it had initially missed), we may send excerpts of the models' answers from that debate to TypeSafe (typesafe.ai). Those excerpts may reflect your question. TypeSafe processes them under its data processing agreement and states that it does not use customer data to train its models.
• Stripe for payments; Google for sign-in, advertising and conversion measurement (Google Ads, including purchase amounts), and delivery of contact-form email through its SMTP relay; Cloudflare as our network proxy; Google Cloud hosts our servers, encrypted keys, and database backups.
• We may disclose information if required by law.

Retention and deletion

Conversations in your history. While signed in, you can delete any conversation you own from the app. Deleting one clears its title and its question, answer, and analysis text, and removes its bookmarks and verification records; a usage record (token counts and amounts, with no content) is deliberately kept for billing and accounting.

Questions asked without signing in. These are stored as unclaimed conversations. Because there is no account to authenticate you against, the in-app delete control does not apply to them: to have one removed, email [email protected]. (You may instead sign in and claim such a conversation into your own history, which charges its cost to your balance and then makes the ordinary delete control available.)

Operational copies. The job record that lets a debate survive a restart holds the question text and is kept for 30 days after the debate finishes, then purged automatically — including when the corresponding conversation was deleted earlier. Encrypted attachment payloads are dropped sooner, within about a day of the debate's deadline. Because the AI providers need the file itself, the server that executes a debate writes a decrypted working copy of each attachment to its own disk and deletes it as soon as that run ends, whether the run succeeded or failed. If that process is killed before its own cleanup can run, the copy it left behind is removed by a background sweep: each debate worker runs that sweep when it starts and about every fifteen minutes afterwards, deleting any decrypted copy more than six hours old by default. That six-hour clock runs from when the copy was written and is independent of the encrypted payload's own expiry, and the sweep only runs while a worker is running on that host — so a copy left by a killed process stays until a worker next sweeps. Database backups and request logs are retained for a limited period and then removed.

Checkout fraud signals. The checkout country code and the card/billing country match flag are deleted by an automatic daily cleanup once they pass our configured retention period, which is at most 90 days and may be shorter. If a cleanup run fails or has an unusually large backlog, removal can be delayed until a later run.

Export. You can export any of your conversations as JSON at any time — directly in the app (right-click — or long-press on a touch screen — a conversation in the sidebar and choose Export JSON), or through the API or the aispar command-line tool.

Account deletion. Email [email protected] to request account erasure. After identity verification, an operator pauses application and worker writers, runs an account-specific dry-run, and executes the transactional erasure procedure. Your conversations are soft-deleted with their text, provider inputs, share access, attachment material, and durable replay payloads removed; the accounting ledger, checkout records, and content-free billing metadata are retained as required for accounting. Access tokens, API keys, bookmarks, preferences, and invitation state are removed, and the old Google subject is permanently tombstoned so a later verified login creates a new account under the current invitation and administrator policy. A completion audit is recorded only after each inventoried worker cache has verified cleanup and any share-cache purge has succeeded.

The operator procedure also covers cleanup retries and status checks after a partial failure. Database backups, request logs, and provider-side copies follow their separately configured retention limits; this page does not promise immediate removal from those independent copies. The in-app conversation delete control is a separate soft-delete operation and does not by itself erase an account or its durable operational records.

Security

Traffic is encrypted in transit (TLS). Stored provider keys are encrypted with a managed key service. Access tokens are stored only as one-way hashes. Database roles are separated so the running application cannot alter its own schema. To report a security issue, contact [email protected].

Children

AI Spar is not directed to children under 13, and we do not knowingly collect their information.

Changes

We will post any changes to this policy on this page and update the date above.