Qiit, LLC (“we” or “us”) respects and protects your privacy. This policy explains what we collect, how we use it, and what rights you have over your own data. Together with the Terms of Service, it forms the agreement between you and us.
1. What we collect
1.1 Information from Google OAuth sign-in
- Email address (used as your unique account identifier and for sign-in)
- Name / display name
- Avatar URL
We do not receive your Google password, contacts, email content, calendar, or Drive data.
1.2 Information you submit while using the Service
- Project settings (channel niche, target audience, and so on)
- Your conversations with the AI assistant
- Content you create — topics, copy, outlines
- Authorization data for any YouTube channel you choose to connect
1.3 Information collected automatically
- Access logs: IP address, browser user agent, timestamp, and request path (used for abuse prevention and rate limiting)
- Usage analytics: page views, clicks, scrolling, and similar behaviour collected via Microsoft Clarity and Google Analytics
- Session replay: Microsoft Clarity records anonymized playback of page interactions, with sensitive fields such as passwords and card numbers masked automatically. Sentry also records a replay around an error when one occurs, with all text masked by default.
- Cookies: used to keep you signed in and remember your language preference
1.4 Payment information
Payments are processed by Stripe. We do not store your card number, CVV, bank account, or other payment credentials. We retain only your Stripe customer ID, subscription status, and plan details, in order to deliver the Service.
2. How we use this information
- To provide, maintain, and improve the Service
- To process your subscription and payments
- To send you service-related notices (account changes, payment status, service changes)
- To analyse usage patterns and improve the product experience
- To prevent abuse, fraud, and violations of the Terms
- To meet our legal obligations
We do not use your personal data to train AI models. AI conversation data is used only to answer your request in real time; it is not used for model training or shared with third parties for training.
3. Sharing
We do not sell your personal information. We share it only in these cases:
- Service providers: Stripe (payments), Cloudflare (infrastructure), Google (OAuth, Analytics), Microsoft (Clarity), Sentry (error monitoring — captures exception stacks and the minimum context needed, configured to filter sensitive fields), and AI model providers (Anthropic, OpenAI, Alibaba Cloud and similar, receiving only the conversation content required).
- Legal requirements: we comply with valid subpoenas, court orders, or government requests as required by law.
- Business transfer: if the company is acquired or merged, user data transfers as one of the assets, and the new owner must provide protection equivalent to this policy.
4. Storage and security
- The primary database is PostgreSQL, deployed on access-controlled servers that only accept connections from Cloudflare's egress IP ranges.
- All traffic is encrypted with HTTPS / TLS.
- Sensitive tokens (such as YouTube OAuth refresh tokens) are stored encrypted with AES-GCM.
- Passwords: the Service supports Google OAuth only and stores no passwords.
- Access control: only authorized personnel can reach production data, and their actions are logged for audit.
5. Retention
- Account information: retained while the account exists; fully erased within 30 days of account deletion, except where the law requires retention.
- AI conversation history: retained while the account exists; you can delete it in-product at any time.
- Payment records: retained at least 7 years, per US tax and accounting rules.
- Access logs: retained 90 days, then aggregated and anonymized.
6. Your rights
Wherever you are located, you have the right to:
- Access: request a copy of the data we hold about you
- Correct: ask us to fix inaccurate data
- Delete: ask us to delete your account and associated data
- Export: obtain your data in a machine-readable format
- Withdraw consent: withdraw consent you previously gave, at any time
- Object: object to specific processing based on legitimate interests
To exercise any of these, email [email protected]. We respond within 30 days.
7. International data transfers
The Service runs on globally distributed infrastructure (Cloudflare's edge network). This means your data may be transferred outside your country for processing and storage. We take reasonable measures to ensure such transfers comply with GDPR, CCPA, and similar privacy regulations.
8. Children's privacy
The Service is not directed at anyone under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected a minor's data, contact us immediately and we will delete it.
9. Cookies and tracking
The Service uses the following cookies:
- Necessary cookies: keep you signed in and remember your language preference (cannot be disabled)
- Analytics cookies: Google Analytics and Microsoft Clarity, used to understand usage patterns
You can disable cookies in your browser settings, though this may affect how well the Service works.
10. Third-party links
The Service may link to third-party sites (YouTube videos, external documentation, and so on). We are not responsible for the privacy practices of those sites, and we recommend reviewing their policies separately.
11. Updates to this policy
We may update this policy from time to time. We give at least 14 days' notice of material changes, on-site or by email. Continuing to use the Service means you accept the updated policy.
12. Contact
For any privacy question or request:
Email: [email protected]
Operating entity: Qiit, LLC (registered in Delaware)
Last updated: 2026-05-25
This English text is provided for convenience. If it conflicts with the Chinese version, the Chinese version governs.