Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address and name through Google, Discord, or Apple sign-in, or via an email one-time passcode. We also generate a unique user ID to identify your account. If you use ninja, our texting companion, or if we ask you to complete a security check to protect free access from automated signups, we collect and verify your phone number.

User-Generated Content

We store the content you create through our services — chat messages, prompts, generated and uploaded images, files, and any sites or projects you build. This content may be processed by our third-party AI providers to generate responses and to operate and improve their models. See Section 9 for details.

Connected Account Data

When you connect a third-party account — such as Gmail, Google Calendar, Google Drive, or Notion — to use integrations and automations, we access data from that account only to perform the tasks you ask for, such as drafting an email or checking your schedule. You can disconnect any integration at any time from your settings.

Messaging Data

If you use our text companion, we process the content of the messages you send and receive, along with your phone number, to operate the assistant and the automations you set up.

Device and Usage Data

We automatically collect device model, OS version, app interactions, session duration, and anonymous device identifiers via PostHog and Microsoft Clarity. On the website, we also create a random first-party device identifier and store hashed network and device signals to detect account abuse. We do not use these security signals to track you across other sites.

Camera, Microphone, and Photo Library

If you grant permission, we access your camera, microphone, or photo library so you can upload images, take photos, or record audio. We only access these when you explicitly initiate the action.

Purchase and Subscription Data

Subscriptions on iOS are processed through the platform's in-app purchase system via Superwall. Web payments go through Stripe. We never store your payment card details — only subscription status confirmation.

Crash and Performance Data

We collect crash logs and performance diagnostics to improve app stability. This data is not linked to your identity.

2. How We Use Your Information

We use the data we collect to:

• Provide, maintain, and improve our services
• Power the AI features, integrations, and automations you request
• Improve the quality, accuracy, and safety of the AI you interact with
• Process transactions and send related confirmations
• Send technical notices, security alerts, support messages, and (if you use our text companion) the messages you request
• Respond to your questions and requests
• Personalize and improve your experience
• Prevent spam, referral abuse, automated signups, and attempts to evade account restrictions

3. Chat Privacy & Data Access

Your conversations are private by default. NinjaChat staff have no routine access to your individual chat content. Your chats are yours.

The only circumstances under which a staff member may view specific content are: if you explicitly share a conversation link with us (for example, when contacting support about a specific chat); where access is necessary to investigate abuse or violations of our Terms; to comply with a legal obligation; or to keep the service safe and secure. In each case, access is limited to what is needed to resolve the matter.

Outside of those limited cases and the AI processing described in Section 9, we do not proactively read, sell, or mine your private conversations.

4. Data Storage and Security

Protecting your data is core to how we build NinjaChat. All data — including your chats, account information, and uploaded files — is encrypted at rest and in transit. Chat messages are stored encrypted in our database. Files and media are stored encrypted on Cloudflare R2, accessible only via authenticated requests. Database connections are encrypted, and we apply strict access controls to limit who within NinjaChat can interact with production data.

We do not sell your personal information. We never have and never will sell your personal information to advertisers or data brokers.

If you ever suspect unauthorized access to your account, contact us immediately at team@ninjachat.ai and we will act quickly.

5. Third-Party Services

We rely on the following third-party services to operate NinjaChat:

• Authentication: Google, Discord, and Apple sign-in
• Payments: Stripe (web), Superwall and the Apple App Store (iOS)
• Integrations: Composio — securely connects the third-party accounts you authorize
• Analytics: PostHog and Microsoft Clarity — usage patterns, session data, anonymous identifiers
• Infrastructure & processing: Cloudflare R2 (encrypted file storage), MongoDB, Upstash, Resend (email), Deepgram (speech-to-text), Gabber (text-to-speech), Firecrawl (web search), E2B (sandboxed code execution), Helicone (request logging), Expo (app updates)
• AI Providers: OpenAI, Anthropic, Google, Meta, Mistral, DeepSeek, xAI, Groq, Together AI, OpenRouter, Perplexity, Replicate, and Fal AI — your messages are sent to whichever provider powers the model or feature you use

All third-party services are bound by their own privacy terms and contractual data-protection obligations, which we recommend reviewing.

6. Connected Accounts & Integrations

NinjaChat can connect to third-party services you authorize — such as your email, calendar, and notes — so the assistant can take actions on your behalf. We request access through each provider's official, encrypted authorization flow and use it solely to carry out the tasks you request.

We never post, send, or change anything in a connected account without your instruction, and you can revoke access for any integration at any time from your settings. We do not use information from connected accounts to train AI models. Our use of information received from these services adheres to each provider's API and data-use policies, including any applicable Limited Use requirements.

7. ninja Text Companion

When you opt in to our text companion, you consent to receive messages from NinjaChat at the phone number you provide — including replies to your messages and occasional helpful follow-ups related to the features and automations you've set up. Message and data rates may apply, and message frequency varies.

You can stop messages at any time by replying STOP, or reply HELP for assistance. We use your phone number only for account security and to operate the assistant, and we never sell it.

8. Your Rights and Choices

You have the right to access, correct, or delete your personal information at any time. Account deletion — along with all associated data — can be initiated directly from your profile settings in the app. Deletion is processed within 30 days.

To exercise any rights or request data deletion, use the in-app feature or email team@ninjachat.ai.

9. Use of AI and Data Processing

NinjaChat is powered by the world's leading AI providers, and keeping your data secure is built into every step. Content travels between you, NinjaChat, and our AI providers over encrypted connections, and is encrypted at rest in our systems.

To generate responses and to keep making the AI you use more capable, accurate, and helpful, the content of your interactions — the messages, images, and files you submit, together with the AI's responses — may be processed and used by us and by our AI providers to operate, evaluate, and improve their models, including for model training and refinement. This is what allows the models to keep getting smarter and more tailored to how people actually use them over time.

We handle this responsibly:

• Secure by design: your content is transmitted over encrypted connections and stored encrypted at rest
• Content, not identity: what is shared is the content of your interactions, governed by our agreements with each provider and their published privacy and data-use terms
• Never sold for ads: we do not sell your personal information to advertisers or data brokers

Data we access from your connected third-party accounts (such as Gmail, Google Calendar, Drive, or Notion) is an exception: it is used only to perform the tasks you request and is not used to train AI models, consistent with each provider's API terms.

If you'd prefer to limit how your data is used, contact us at team@ninjachat.ai or manage your data from your account settings.

10. Aggregated & De-Identified Information

We may create de-identified or aggregated information from the data we collect — information that has been stripped of identifiers and can no longer reasonably be used to identify you. For example, we may combine activity across many users into statistics, or remove personal details from content to study how features are used.

We may use and share this de-identified and aggregated information for any purpose — including to operate, analyze, research, and improve our products, services, and AI — and this Privacy Policy does not restrict that use. Where we hold information in de-identified form, we will maintain it as de-identified and will not attempt to re-identify it, except as permitted by law to test our de-identification.

11. Analytics and Tracking

On our website and in our app, we use cookies and similar technologies, along with tools such as PostHog and Microsoft Clarity, to understand how our products are used and to improve them. This includes screen views, feature interactions, session duration, and anonymous device identifiers.

We do not use this data to track you across other apps or websites. You can limit analytics by adjusting your device privacy settings. Authentication tokens and user preferences are stored locally on your device using secure storage.

12. Data Retention

We retain your account information and user-generated content for as long as your account is active. Upon deletion, personal data is removed within 30 days except where retention is required for legal or regulatory reasons. Analytics data is kept in aggregated, anonymized form after deletion. Crash and performance logs are retained for up to 90 days.

13. California and International Privacy Rights

California Residents (CCPA)

You have the right to know what personal information we collect, request its deletion, and opt out of the sale of your data. We do not sell your personal information for advertising. As described in Section 9, the content of your interactions may be shared with our AI providers to operate and improve the service. Contact team@ninjachat.ai to exercise these rights.

EEA, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, you have additional rights: access, rectification, portability, erasure, and the right to restrict or object to processing. Our legal basis is your consent (account creation, AI data sharing) and our legitimate interests (analytics, product and model improvement). Contact team@ninjachat.ai to exercise these rights.

14. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have done so, we will delete that data promptly.

15. Changes to This Policy

We may update this policy from time to time. Changes are effective when posted, and the "Last updated" date will reflect the revision. We will notify you of significant changes via the app or email.

16. Contact Us

Questions about this policy? Reach us at team@ninjachat.ai. NinjaChat is operated by Helium Technologies, Inc.