Privacy Policy

This policy explains what Anphase Ltd (Auckland, New Zealand) collects when you use AIReader.xyz, why we collect it, and what you can do about it.

Information we collect

Account information

Your email address, your display name, and your password — stored only as a bcrypt hash, never in plain text. We can't read your password and can't recover it for you.

Content you bring

URLs you import, files you upload, and text you paste, along with everything you make from them: annotations, notes, drafts, reading progress, and your mode and dial preferences. This is your work; we hold it so the service can show it back to you.

Technical information

Your IP address and basic request logs, kept for security, abuse prevention, and rate limiting. A session token stored in your browser's localStorage so you stay signed in.

No advertising trackers. No analytics SDK at present. If we ever add product analytics, we'll say so here first.

How we use it

• To run the reader and the writer — storing, rendering, and syncing your documents and drafts.
• To generate AI assistance when you ask for it.
• To build knowledge connections between your documents using embeddings — vector representations of your text. A short excerpt is sent to OpenAI's embeddings API to compute the vector; the vector itself is stored in our own database, not theirs.
• To keep the service secure and available: authentication, abuse prevention, rate limiting, debugging.
• To contact you about your account or material changes to the service.

We do not use your content for advertising, and we do not sell or rent it to anyone.

AI processing

Text leaves our servers for an AI provider in two distinct situations.

When you ask for AI assistance

The text you asked the AI to work on is sent to an AI provider: OpenAI, and as a fallback Anthropic, processed under their API terms. Under those API policies, your content is not used to train their models.

We send only what the request needs — the passage, the draft section, or the question at hand, plus the instructions for the mode you chose. We don't send your whole library, and we don't send your email address or account details. In deep mode we make no such call at all: no model generates, suggests, or rewrites anything for you. See AI & your work for the detail.

When you save or import work

To make your library searchable and to link related material, we compute an embedding for each document, draft, and annotation. Doing that sends a short excerpt — the title plus roughly the first 400 characters — to OpenAI's embeddings API. It happens when you import, save, annotate, or autosave a draft, and it is independent of the dial: it still happens in deep mode. The resulting vector is stored in our own database. This is the one case where some of your text reaches a provider without you asking for AI help, and we'd rather say so plainly than bury it.

Third-party services

• DigitalOcean — application and database hosting, Sydney, Australia.
• Cloudflare — DNS, CDN, and TLS termination; sees request metadata in transit.
• OpenAI — primary AI provider, and the only provider used for embeddings (United States).
• Anthropic — fallback provider for AI assistance only; it is not sent embeddings (United States).
• Let's Encrypt — TLS certificates.

Cookies and local storage

Functional only. We use your browser's localStorage to hold your session token and your interface preferences, such as the dial position. There are no advertising or cross-site tracking cookies. Clearing your browser storage signs you out.

Your rights

You can ask us to:

• Access — tell you what we hold about you.
• Export — give you a copy of your documents, annotations, and drafts.
• Correct — fix anything inaccurate.
• Delete — remove specific content, or your entire account.
• Object or restrict — limit particular processing, where the law gives you that right.

Email [email protected] from the address on your account. We'll respond within 20 working days, and usually much sooner. There's no charge.

Data retention

We keep your content while your account exists. When you delete content or your account, we remove it from live systems promptly; encrypted backups containing it are purged within 30 days. Security and request logs are kept for a short period and then rotated out. We may retain the minimum needed to meet a legal obligation.

International transfers

We are based in New Zealand and host in Australia; our AI providers process in the United States. Those transfers are made under contractual protections with each provider — including standard contractual clauses where they apply — that require comparable safeguards to those under New Zealand and European law.

Regional rights

New Zealand. We handle personal information under the Privacy Act 2020 and its information privacy principles. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

EEA and UK. Where the GDPR or UK GDPR applies, our lawful bases are contract (running the service you signed up for), legitimate interests (security and abuse prevention), and consent where we ask for it. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority.

California. Under the CCPA/CPRA you may request disclosure of the personal information we collect and its purposes, request deletion or correction, and are entitled not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined.

Children

The service is not for children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has an account, email us and we'll delete it.

Changes

We'll update this policy as the service changes; the date at the top shows the current version. For material changes we'll notify you in the app or by email before they take effect.

Contact

Anphase Ltd, Auckland, New Zealand — [email protected].