Privacy Policy & Data Security

AllGPT (allgpt.live) is a multi-model AI workspace. This policy explains what the operator of allgpt.live ("we") collects, why, who receives it, how long we keep it, and the security measures we apply. Contact [email protected].

You accept this policy when you accept the Terms of Service. If you do not agree, do not create an account and do not use the service.

We process account, chat, and billing data to perform the contract with you. We process security logs, fraud checks, and service diagnostics because we need to run and protect the service. We keep some billing records because accounting and dispute rules require it. If you are in the EEA or the UK, those reasons are the contract, legitimate interests, and legal obligation. This page describes our actual practices. It is not a claim that every privacy statute worldwide has been separately certified.

• Account data: name, email address, and a hashed password when you register with email. We send a confirmation email to verify that you own the address. If you continue with Google, Google shares your name and verified email so we can create or link your account. We do not receive your Google password. You may also add a date of birth and location on your profile. A Bangladesh mobile number can be saved after we send a one-time SMS code.
• Chat data: conversation titles, messages, attachment names, and extracted text from files you upload (.txt, .docx, .pdf). Original uploaded files and photos are not stored after the message is sent. Images the models generate for you are stored in that chat so you can reopen and download them. Voice recordings are used only to produce a transcript and are not stored on AllGPT. When you turn on web search, we store the source titles and URLs shown under that reply.
• Billing data: prepaid credit balance, credit lots and expiry dates, top-up requests (method, amount, transaction ID), usage records, and credit ledger entries when you pay with EPS, bKash, or Nagad or use platform models.
• API keys (optional): provider keys and custom endpoint details you choose to save in Settings. These are encrypted before storage.
• Chrome extensions: if you sign AllGPT for Sheets or AllGPT for Docs into your account, that extension stores a session token in its browser storage. When you use it, it sends an excerpt of the open spreadsheet or document and your question. That excerpt is saved as a chat on your account. Changes are written back only after you confirm. After you sign an extension in, we record that it is installed, when you use it, and when you remove it. Sheets and Docs are recorded separately.
• Technical data: session cookies, a first-party visitor cookie used only for anonymous pageview analytics, rate-limit counters, and basic logs needed to operate and secure the service. We do not use third-party ad trackers.
• Terms acceptance: the version of the Terms you accepted and the time you accepted it.
• Support: questions you send in Help, the assistant's replies, tickets you open, and replies from the account operator. Workspace chats are not copied into Help.

• Authenticate you and keep you signed in securely.
• Store and display your conversations across devices on the same account.
• Route chat requests to the AI provider or model you select.
• Transcribe voice clips you record in the composer so the text can be edited before you send a message.
• When you enable web search, look up public sources for that prompt and pass the titles, URLs, and snippets to the model you selected.
• When you enable read pages, fetch the top public result pages and pass extracted text to the model. Full page HTML is not stored in the chat.
• Deduct prepaid credits when you use platform keys, and record usage for your balance.
• Apply credit expiry: unused free credits (starter, bonuses, grants) expire 3 months after they are received; unused credits from an approved top-up expire 1 year after they are added.
• Verify EPS payments with the gateway and prevent duplicate transaction IDs.
• Verify manual wallet top-ups and prevent duplicate transaction IDs.
• Protect the service from abuse (rate limits, fraud checks, error monitoring).
• Answer questions in Help and let the account operator read and reply to support tickets.

We do not sell your personal data. We do not use your chats to train our own models.

When you send a message, the relevant parts of your conversation (including your prompt, prior messages in that thread, extracted text from attached documents, and images on that turn) are transmitted to the provider powering the model you picked — for example OpenAI, Google, Anthropic, xAI, Fal, DeepSeek, Venice, or a custom API you configured. Image-generation prompts are sent to the image model you selected; later chat turns do not resend the generated pixels. When you use Improve in the image editor, the current picture and your instruction are sent once to the image model you picked (GPT Image or Gemini Image). We do not store that picture or the edited result; the result stays in your browser until you download it. Voice clips are sent to OpenAI speech-to-text (using your OpenAI key if you added one, otherwise the platform key) and are discarded after the transcript is returned. The transcript is only saved if you send it as a chat message. Questions you type in Help are sent to a platform model so it can answer, and are stored on your account with the replies. Your workspace chats are not sent to Help.

If you turn on web search, we send your prompt (or a shortened search query) to a web search provider — DuckDuckGo by default, or Tavily, Brave, or Serper if those keys are configured on the server. The returned titles, URLs, and snippets are then sent to the AI model you picked so it can cite current sources. We cache identical search queries briefly to reduce repeat lookups.

If you turn on read pages (deep search), we also fetch the top public result pages, extract visible text, and send that excerpt to the selected model. We do not store the full page body in your chat — only the source titles and URLs. Private or local network addresses are not fetched.

If you add your own API key, requests go to that provider under your key and your agreement with them. If you use platform keys, we send requests on your behalf using our infrastructure.

AllGPT for Sheets sends the sheet excerpt and your question to AllGPT, which stores them as a chat and sends them to the provider for the model you pick.AllGPT for Docs does the same with an excerpt of the open Google Doc. Platform credits are deducted the same way as a chat on the site. Google receives the spreadsheet or document permission you grant so the extension can read that file and, after you confirm, write the change. We do not receive your Google password, and we do not keep a copy of the whole spreadsheet or document.

Each provider has its own privacy terms. We recommend reviewing their policies for how they handle API data.

We share data only as needed to run the service:

• AI providers you select, such as OpenAI, Google, Anthropic, xAI, Fal, DeepSeek, Venice, or a custom API you configure. They receive the prompt payload described above and handle it under their own terms.
• Search and page-fetch providers when you turn those features on (DuckDuckGo by default, or Tavily, Brave, or Serper if configured).
• Payments: EPS for checkout, and the wallet details you submit for bKash or Nagad top-ups.
• Email and SMS vendors, to deliver verification, password reset, and phone codes.
• Google, when you use Google sign-in or a Sheets or Docs extension, for the permissions that feature needs.
• Hosting: the database and cache that store the account. Those providers host data for us and do not receive it for their own marketing.

We do not sell personal data. Providers, email, payments, and hosting may process data outside Bangladesh, including in the United States or the European Union. Their own privacy terms describe their retention. We do not use your chats to train our own models.

• Passwords are stored using industry-standard one-way hashing — never as plain text.
• API keys are encrypted at rest with AES-256-GCM. The encryption key is kept separate from the database.
• Sessions use signed, httpOnly cookies so JavaScript on the page cannot read your session token.
• Database (PostgreSQL) and cache (Redis) run on managed infrastructure with access restricted to the application.
• Transport is over HTTPS in production (allgpt.live).

No online service can guarantee absolute security. We work to reduce risk, but you should also use a strong unique password and keep your account credentials private.

• Account & chats: kept while your account is active. You may delete individual conversations from the workspace.
• Billing records: top-up and usage history are kept for account reconciliation, dispute handling, and fraud prevention.
• Voice recordings: not stored. Audio is discarded after transcription.
• Logs: short-lived operational logs may be retained for a limited period for debugging and security.
• Support threads and tickets: kept while your account is active so the team can reply.

To request account deletion or export of data you control, contact us using the details below. Some billing records may be retained where required for legal or accounting purposes.

We use an essential session cookie to keep you signed in. Appearance preferences (theme, font, stream speed) may be stored in your browser's local storage and are not sent to our servers unless tied to a saved setting on your account.

• Use your own API keys instead of platform credits where supported.
• Review and edit voice transcripts before you send them as a message.
• Delete conversations you no longer need.
• Sign out on shared devices, including the Chrome extension.
• Email [email protected] from your account address to access, correct, export, or delete the personal data you control. We aim to reply within 30 days. We may keep billing and fraud records where accounting or legal duties require it, and we may refuse a request we cannot verify.

AllGPT is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will close it.

We may update this page as the product or legal requirements change. The date at the top is the current version. A material change is accepted the same way as a new Terms version: the product asks you to agree before you continue.

See also our Terms of Service and Refund Policy.

Questions about privacy or data security: email [email protected] from the address linked to your account, including your registered email so we can verify you.