Privacy policy

1. What we collect

When you sign in with Google (or an email/phone), we store your name, email address, and profile picture to identify your account and sync your chat history across devices. If you sign up with a password instead, we store a one-way cryptographic hash of it (via Node's scrypt) — never the password itself, and never in a form we or anyone else could recover.

We also store what you'd expect from using the product: your conversations, generated images, credit usage, and current plan. Guests who aren't signed in have their history kept only in their own browser's local storage — we don't see or store it on our servers.

2. How responses are generated

When you send a message, prompt, or upload a file, ShadowAI sends the content needed for your request to the AI provider used by that feature. Email drafting and Workspace content generation and editing use Groq. Other features may use other providers. Processing a request is inference, not model training; provider retention terms and account settings also apply.

3. Google account connections (Gmail & Workspace)

Connecting Gmail or Google Workspace is optional and off by default. When you choose to connect, ShadowAI requests only the narrowest permission each feature needs:

• Gmail — gmail.send only. This lets ShadowAI send an email on your behalf when you ask it to. It does not grant read access — we cannot see your inbox, your messages, your contacts, or your labels.
• Workspace — drive.file only. This lets ShadowAI create and edit the documents, sheets and slides that ShadowAI itself creates, or that you explicitly open with it. We cannot see the rest of your Google Drive.

The access tokens Google issues are stored encrypted at rest and are used solely to carry out the actions you request inside ShadowAI. Drive search reads metadata for files available to the app. When you request an edit, we read the selected Google Doc's text or Sheet's cell values and send that content with your instructions to Groq to produce the revision. The revised content is written back to that file. This editing path uses Groq's chat completions API with the openai/gpt-oss-20b model; it does not use a model gateway or fall back to another provider. Google access tokens are not included in model prompts.

Google API data is used only to provide the feature you request, not for advertising, sale, profiling, or training generalized AI models. Groq's service terms prohibit training on inputs and outputs without customer permission. We do not grant that permission for Google API data. Connected account details and action records are stored to operate the integration; file search results and generated content may appear in your saved history.

ShadowAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from the Plugins page inside ShadowAI — which revokes the token immediately — or from your Google Account permissions page. Disconnecting stops all further access at once.

4. What we don't do

We don't sell your personal data. We don't share it beyond what's required to run the service itself — our hosting infrastructure (Vercel), our database (Neon), and our payment processor (Razorpay) for billing, and AI providers for the processing described above. We don't use your conversations for advertising.

5. Security

Passwords are hashed, never stored in plain text. Access tokens for connected Google accounts are encrypted at rest. Payment details are handled entirely by Razorpay — we never see or store your card or bank information ourselves. Access to account-management tools inside ShadowAI is restricted to authorized developer accounts only.

6. Your rights

You can ask us to delete your account and associated data, or to export a copy of your stored conversations, at any time by contacting support (see the Support page). We'll act on deletion requests as soon as reasonably possible.

7. Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we'll update the date at the top of this page.