ENGRAI

Summary of Key Points

This summary is provided for convenience only. It is qualified in its entirety by the full Policy that follows.

What we collect: ENGRAI is designed to operate locally on your device. We operate no servers and use no analytics or advertising trackers, so we do not collect your chats, characters, prompts, or API keys. The only personal information we receive is what you choose to send us directly, such as an email message to our support address.
Sensitive information: We do not collect sensitive personal information. Content you type into the App stays on your device, or in your private iCloud storage if you enable sync, and is not transmitted to us.
Third-party sources: We do not collect information about you from third parties.
How we use information: We use the limited information we receive from feedback reports or service tickets submitted by you only to respond to your inquiries, maintain the App, and comply with the law.
Who receives your data: We never sell your personal data. When you use your own API key, the App sends your prompts directly from your device to the AI provider you select. We do not receive or control that transmission. If you enable iCloud sync, Apple stores your synced data on your behalf.
Your rights: Depending on where you live, you may have rights to access, correct, delete, port, and restrict the use of your personal information, and to withdraw consent. Contact us to exercise them.

1. Introduction

ENGRAI ("ENGRAI," "we," "us," or "our") develops a mobile and desktop application for iOS, macOS, and iPadOS (the "App"). The App is a "bring your own key" (BYOK) front end for large language models, and offers local roleplay, assistant, and chat functionality. You supply your own credentials for the AI provider of your choice. The app runs on your device and, if you configure iCloud to sync app data, your chats and characters will sync across your devices through your private iCloud account.

Our architecture underpins our privacy commitment. We own and operate no servers that receive your conversations, and we employ no tracking technologies. We do not receive your content. That design is deliberate, and this Policy describes it candidly, including the limits of what it means for you.

This Policy applies to the App, to our website at https://engrai.app (the "Website"), and to correspondence you direct to us (together, the "Services"). It does not apply to third-party services you choose to use through the App, including the AI provider whose API key you enter and Apple's iCloud service. Those services are governed by their own terms and privacy policies.

Questions regarding this Policy may be directed to support@engrai.app

2. What We Collect & Why

We collect very little, only when you initiate it directly. This section identifies, by category, what we receive, what we do not receive, and the legal basis on which any processing occurs.

2.1 Information You Provide to Us Directly

When you contact us, for example by emailing vd@vadesai.com, we receive your email address, any name you include, and the content of your message. We use this information to respond to you, to provide support, and to maintain a record of the correspondence.

Legal basis: Our legitimate interests in responding to inquiries and supporting users of the App (GDPR Article 6(1)(f)); and, where your inquiry relates to the App you have obtained from us, performance of our relationship with you (Article 6(1)(b)).

2.2 Information We Do Not Collect

Notwithstanding the nature of the App, the following categories remain on your device or in your iCloud account and are not transmitted to, or accessible by, ENGRAI:

the content of your chats (incl. files or documents you attach in assistant chat), prompts, and AI-generated responses;
the characters, personas, and settings you create, including avatar images you save for the characters, personas, scenarios, or worlds;
the API keys or other credentials you enter for your chosen AI provider; and
usage analytics, advertising identifiers, location data, or device fingerprints.
iCloud account name, Apple IDs, or any personally identifiable information unless shared by you directly via email when contacting us.

2.3 Information Processed on Your Device and in iCloud

If you have elected application data synchronization in your iCloud Account settings, the App uses a private iCloud container associated with your Apple ID so that your chats and characters may appear across your own devices. This data is transmitted between your devices and/or Apple's infrastructure. It is not transmitted to ENGRAI, and we have no access to it. Apple's handling of this data is governed by Apple's own privacy policy and your iCloud settings.

Legal basis (to the extent applicable): Your consent, given by enabling synchronization, which you may withdraw at any time by disabling it (Article 6(1)(a)).

2.4 Information Sent to Your Chosen AI Provider

When you use the App with your own API key, your prompts and conversation context are sent directly from your device to the AI model. This will include shared information with a third party if your LLM provider runs a cloud server. ENGRAI is not a party to that transmission, does not receive a copy, does not endorse, and does not control how that provider retains, uses, or discloses your data. You should review the terms and privacy policy of your chosen provider before use. Alternatively, you could host your own local LLM that ENGRAI accepts for maximum privacy.

2.5 Information from Third Parties

We do not obtain personal information about you from third-party sources.

3. How We Use Your Information

The limited information we receive is used only for the purposes enumerated below.

Core service delivery and support (contract / legitimate interest). We shall use your correspondence to answer questions, diagnose problems, and provide assistance.
Service improvement (legitimate interest). We may consider the substance of support requests and feedback you voluntarily submit in order to improve the App. We do not build behavioral profiles of users.
Communication (contract and consent). We shall communicate with you in connection with your inquiries. We do not send promotional communications as of the date of this Policy.
Security and abuse prevention (legitimate interest). We may use correspondence-related information to protect the integrity of our communications channels and to address misuse of them.
Legal compliance (legal obligation). We may process information as necessary to comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.
Marketing (consent). We do not currently engage in marketing to users. Should we do so in the future, we shall do so only with your prior consent where required by law, and every such communication shall include a simple means of opting out.

We do not use your personal information for automated decision-making, and we do not sell it.

Our sharing of personal information is narrow. We never sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under applicable privacy laws.

Essential service providers. Correspondence you send to us is necessarily handled by the email and hosting providers that deliver and store it, acting on our behalf. Third parties you engage yourself, namely Apple (for iCloud and App Store services) and, if applicable, your cloud-hosting AI provider, process data under their own terms and not as our service providers.
Legal requirements. We may disclose information where required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, property, or safety of ENGRAI, our users, or others.
Business transitions. In the event of a merger, acquisition, reorganization, or sale of assets, personal information in our possession may be transferred to the successor entity, which shall remain bound by commitments no less protective than those in this Policy, and we shall notify you of any material change in the manner described in Section 11.

With your consent. We shall disclose personal information for any other purpose only with your consent.

5. Your Privacy Rights

You are entitled to certain rights concerning your personal information. These vary by jurisdiction and may include rights under the GDPR, the UK GDPR and Data Protection Act 2018, PIPEDA, the CCPA/CPRA, the Indiana Consumer Data Protection Act, and other U.S. state privacy laws.

5.1 Your Rights

Access. You may request confirmation of whether we process your personal information and obtain a copy of it.
Correction. You may request that we correct inaccurate or incomplete information.
Deletion. You may request deletion of your personal information, subject to legal exceptions, such as where retention is required by law or to defend legal claims.
Portability. You may request your information in a structured, commonly used, machine-readable format.
Opt out of marketing, sale, sharing, and targeted advertising. We do not engage in the sale or sharing of personal information or in targeted advertising, and we do not currently send marketing. You may still submit an opt-out request at any time.
Withdraw consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal shall not affect the lawfulness of processing carried out before withdrawal.
Restriction and objection. Where applicable, you may request that we restrict processing or object to processing based on legitimate interests.
Non-discrimination. We shall not discriminate against you for exercising any of your rights.

5.2 Rights Relating to Content Stored on Your Device and in iCloud

Because we do not store your chats, characters, or API keys, you directly control them. You may delete them within the App, remove the App from your device, disable iCloud synchronization, or manage your iCloud storage through your Apple account settings. To remove data held by your chosen AI provider, you must contact that provider.

5.3 How to Exercise Your Rights

Submit your request to support@engrai.app. We may need to verify your identity before acting, and we shall use only the information needed for that purpose. We shall respond within the period required by applicable law (generally one month under the GDPR and UK GDPR, and 45 days under the CCPA/CPRA, subject to any lawful extension). You may also designate an authorized agent to submit a request on your behalf, subject to verification of the agent's authority.

If we decline your request, you may appeal the decision by replying to our response and stating that you wish to appeal. Where applicable law so provides, we shall respond in writing, with an explanation, within the legally required period.

5.4 Lodging a Complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a competent authority. See Section 18 for details.

6. Data Security & Safeguarding

Our principal security measure is architectural: because we operate no servers that receive your chats, characters, or credentials, that information is not exposed to us or to any ENGRAI-operated system. Your content remains on your device and, if you enable synchronization, within your private iCloud account.

Notwithstanding the foregoing, no method of storage or transmission is completely secure, and we do not warrant that your information will never be accessed, lost, or disclosed. We cannot control the security of Apple's services, your device, or your chosen AI provider. You can materially improve your own security by:

protecting your devices with a strong passcode or biometric authentication and keeping your operating system and the App up to date;
securing your Apple ID with a strong, unique password and two-factor authentication;
safeguarding your API keys and revoking and replacing any key you believe to be compromised through your AI provider;
refraining from entering information into chats that you would not be comfortable transmitting to your chosen AI provider;
disabling iCloud synchronization for ENGRAI in your device's system settings or your iCloud account settings;
deleting any content you wish to remove from the app by permanently deleting characters, personas, messages, chats, or connections; and
deleting your app or privately saved data either by uninstalling ENGRAI or wiping out the app storage in the application settings.

In the event of a personal data breach affecting information in our possession, we shall notify affected individuals and the relevant regulators as and when required by applicable law.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, unless a longer period is required or permitted by law. Because of the App's design, our retention footprint is small.

Correspondence with us: Retained for as long as reasonably necessary to resolve your inquiry, to maintain a record of our dealings with you, and to comply with legal obligations or defend legal claims. After that, we delete or de-identify it. You may request earlier deletion as set out in Section 5.
Chats, characters, and API keys: Not retained by us. They persist on your device, and in iCloud if you enable sync, until you delete them.
Financial records: We do not process payment card data. Should you make a purchase through Apple's App Store, Apple processes the transaction and maintains the associated records under its own policies.
Marketing preferences: We do not currently maintain a marketing list. We will notify you in writing of any future changes, with opt-outs on first launch after the update.
Technical logs: We do not operate App analytics or telemetry and therefore maintain no App-level technical logs.

8. Cookies & Tracking

The App does not use cookies, advertising identifiers, analytics software development kits, or other tracking technologies, and we do not engage in cross-app or cross-site tracking.

With respect to the Website hosting this documentation, we do not deploy advertising or behavioral tracking technologies. Our hosting provider may use technical measures necessary to deliver and secure the Website, and you may manage cookies and similar technologies through your browser settings. As we do not use non-essential cookies, no separate cookie policy is maintained.

9. Children's Privacy

ENGRAI is an adult app and requires users to be at least 18 years old. The Services are not directed to children under the age of 13, or under any higher minimum age required by applicable law in your jurisdiction (for example, the age of digital consent under the GDPR, which varies among EU member states). We do not knowingly collect personal information from children below that age. If you believe a child has provided personal information to us, contact support@engrai.app, and we shall take reasonable steps to delete it.

10. International Transfers

ENGRAI's development team is based in the United States, in the State of Indiana. If you contact us from outside the United States, your correspondence will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction.

Where required, we shall implement appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses or the equivalent mechanism recognized under UK law, and your rights under this Policy shall be maintained.

Transmissions of your content to Apple (through iCloud) or to your chosen AI provider occur at your direction and are governed by those parties' own terms, including their respective arrangements for international transfers. We do not control the location in which they process your data.

11. Changes to This Policy

We may amend this Policy from time to time to reflect changes in our practices, the App, or applicable law. The current version shall at all times be available at our privacy webpage, bearing its "Last Updated" date. Where a change is material, we shall provide reasonable notice, such as by an in-App notice or a prominent notice on the Website. Where required by law, we shall obtain your consent to the change.

Unless otherwise stated, amendments apply prospectively. Any personal information we hold shall be handled in accordance with the version of the Policy in effect at the time of processing, subject to your rights described herein. Previous versions are available upon request.

12. Contact Us

Privacy inquiries, rights requests, and complaints may be directed to:

Email: support@engrai.app
Contact Portal: https://engrai.app/contact

We shall acknowledge and respond to your communications within the periods required by applicable law, as set out in Section 5.3.

13. California Disclosures (CCPA/CPRA)

This section supplements the foregoing for residents of California. The table below describes the categories of personal information we collected in the preceding 12 months.

Category	Sources	BUSINESS PURPOSE	CATEGORIES OF THIRD PARTIES DISCLOSED TO	RETENTION PERIOD
Identifiers and contact information (e.g., email address, name).	Directly from you, when you contact us .	Responding to inquiries and providing support.	Email and hosting providers acting as our service providers; no sale or sharing.	Retained for as long as reasonably necessary to resolve your inquiry and to meet legal obligations or defend legal claims, then deleted or de-identified.
Content of communications (the substance of your messages to us).	Directly from you.	Responding to inquiries; improving the App.	Email and hosting providers acting as our service providers; no sale or sharing.	Same as above.
Chats, prompts, characters, and API keys.	Not collected by us. Remain on your device or in your private iCloud container.	Not applicable.	Not applicable.	Not applicable. Retained on your device or in iCloud until you delete them.
Internet or device activity, analytics, advertising identifiers, geolocation.	Not collected by us.	Not applicable.	Not applicable.	Not applicable.

Sensitive personal information. We do not collect sensitive personal information as defined under the CPRA. Accordingly, we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use. Should this change, we shall update this Policy and honor the right to limit.

Sale and sharing. We have not sold or shared personal information in the preceding 12 months, and we do not do so.

Your California rights include the rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and non-discrimination, each as described in Section 5.

14. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you within the meaning of Article 22 of the GDPR and the UK GDPR. Any outputs generated by the AI model you select are produced at your request through your chosen provider and are not decisions made by ENGRAI about you.

15. Privacy Signals

We honor Global Privacy Control (GPC) signals and other legally recognized opt-out preference signals. As we do not sell or share personal information or use it for targeted advertising, and do not deploy tracking technologies, there is no processing to which such a signal would apply. Nevertheless, we shall treat any such signal as a valid request to opt out of the sale or sharing of personal information.

16. Sub-Processors

ENGRAI does not operate servers that process your App content, and accordingly engages a few sub-processors. The categories of providers that may process personal information on our behalf are limited to:

Email service providers, which deliver and store correspondence sent to and from support@engrai.app; and
Website hosting providers, which serve https://engrai.app.
Apple Inc. (iCloud and App Store) and if applicable your chosen AI provider are not our sub-processors. You engage them directly, and they process data under their own terms.

A current list of sub-processors is maintained and available upon request at support@engrai.app. Persons who wish to be notified before a new sub-processor is engaged may subscribe by emailing that address with the subject line "Sub-processor notifications," and we shall provide notice in advance of the new sub-processor commencing processing.

17. EU/UK Representative

ENGRAI is established in the United States and may make the App available to individuals in the European Union, the European Economic Area, and the United Kingdom. As of the date of this Policy, we have not appointed a representative under Article 27 of the GDPR or the UK GDPR. Individuals in the EU or UK may contact us directly at vd@vadesai.com regarding any matter concerning the processing of their personal information. We will update this Policy if we appoint a representative.

18. Supervisory Authority

You may lodge a complaint with the supervisory authority competent for your place of residence, place of work, or the place of the alleged infringement. We encourage you to contact us first so that we may attempt to resolve your concern directly, but you are under no obligation to do so. Competent authorities include:

Europe

European Union / EEA: the data protection authority of your member state, as listed in the directory of the European Data Protection Board (https://www.edpb.europa.eu).
United Kingdom: the Information Commissioner's Office (ICO) (https://ico.org.uk).
Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) (https://www.edoeb.admin.ch).

North America

Canada: the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca).
Indiana: the Office of the Indiana Attorney General (https://www.in.gov/attorneygeneral).
United States (federal): the Federal Trade Commission (FTC) (https://www.ftc.gov).
Other U.S. states: the attorney general or designated privacy regulator of your state of residence.

South America

Brazil: the Autoridade Nacional de Proteção de Dados (ANPD) (https://www.gov.br/anpd).
Argentina: the Agencia de Acceso a la Información Pública (AAIP) (https://www.argentina.gob.ar/aaip).

Asia & Pacific

Australia: the Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au).
New Zealand: the Office of the Privacy Commissioner (https://www.privacy.org.nz).
Japan: the Personal Information Protection Commission (PPC) (https://www.ppc.go.jp/en/).
South Korea: the Personal Information Protection Commission (PIPC) (https://www.pipc.go.kr/eng/).
Singapore: the Personal Data Protection Commission (PDPC) (https://www.pdpc.gov.sg).
Hong Kong: the Office of the Privacy Commissioner for Personal Data (PCPD) (https://www.pcpd.org.hk).
India: Ministry of Electronics and Information Technology (MeitY): Data Protection Board of India (DPBI) (https://www.meity.gov.in/content/data-protection-board-india)

Middle East & Africa

South Africa: the Information Regulator (https://inforegulator.org.za).
Nigeria: Nigeria Data Protection Commission (NDPC) (https://ndpc.gov.ng)
Kenya: Office of the Data Protection Commissioner (ODPC) (https://www.odpc.go.ke/file-a-complaint/)
Israel: The Privacy Protection Authority (https://www.gov.il/en/pages/public_inquiries_ilita)
Saudi Arabia: National Data Governance Platform (https://dgp.sdaia.gov.sa/wps/portal/pdp/services/ReportsComplaints)
UAE: Data Office of the United Arab Emirates (https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws)

Global resources

Global Privacy Assembly (GPA): an international forum of data protection and privacy authorities. Its website (https://globalprivacyassembly.org) provides information on member authorities worldwide, which you may use to locate the authority in a jurisdiction not listed above.

If your country or region is not listed, you may contact the data protection or privacy authority in your jurisdiction, or write to us at support@engrai.app, and we will do our best to help you identify the appropriate authority.