Privacy Policy

Effective: May 13, 2026

Last updated: September 29, 2026

Meriq ("Meriq," "we," "us," or "our") operates an AI assistance platform that includes chat, deep research, generation, file analysis, and an encrypted Cloud Vault. This Privacy Policy explains what we collect, how we protect content, how long we retain information, with whom we share it, and the rights you can exercise.

1. Information We Collect

1.1 Account and profile information

• Email address and account identifiers.
• A salted, slow-hashed representation of your password. We do not store, transmit, or back up your password in plaintext.
• Display name, plan selection, language preference, theme, custom instructions, and other settings you provide.
• For social sign-in, the minimum identifiers your chosen provider returns to confirm who you are (typically an email address and a stable provider user ID).

We also count successful results and confirmed payments in aggregate to understand service adoption and referral performance. For the first 35 days after signup, this uses content-free result identifiers, outcome dates, plan and storage choices, and the referral code already associated with the account. Individual result records expire after 35 days or account deletion. Retained cohort totals contain no account identities, and groups with fewer than five signups are suppressed. This does not use advertising pixels, third-party behavioral analytics, or conversation content.

1.2 Billing and subscription information

• All paid plans, credit packs, and other purchases are processed by Stripe. We do not receive or store your full card number, expiration date, CVV, or bank account number.
• We receive only the billing metadata required to manage your subscription, such as your Stripe customer identifier, subscription status, selected plan, invoice and receipt metadata, the card brand and last four digits presented on receipts, billing email when you provide one, and country code for tax purposes.

1.3 Technical, security, and operational data

On public pages, first-party audience analytics count browser sessions that interact with the page, excluding recognized automation. An anonymous session identifier rotates daily; records contain the day, public page, device category, and referring hostname, and expire after 90 days. This analytics dataset does not contain raw IP addresses, full referring URLs, account identities, prompts, or responses. We respect Do Not Track and Global Privacy Control for this collection. Staff dashboards also summarize existing sign-in and quota records to measure service usage without reading chat content.

• IP address, network classification (residential, datacenter, anonymizer where detectable), user agent, request timestamps, and request metadata required to route, secure, and bill the request.
• Abuse signals such as failed login attempts, rate-limit events, CAPTCHA outcomes, and similar protective telemetry.
• Application audit events for staff and admin actions on the platform, used for security review and incident response.

1.4 Content you choose to provide

• Prompts, conversation transcripts, AI outputs, file uploads, generated images, project documents, saved notes, saved prompts, and any memory entries you choose to keep.
• Account-level configuration that you place inside Custom Instructions, Project Instructions, or Project Memory.

Where your Cloud Vault is enabled, content in this category is stored only in encrypted form. See Cloud Vault Architecture.

1.5 Information we do not collect

• We do not collect biometric data.
• We do not collect precise geolocation data.
• We do not buy data about you from data brokers.
• We do not deploy advertising pixels, third-party behavioral trackers, or session-replay scripts on the Service.

2. How We Use Information

We use the information described above to operate, secure, and improve the Service, to bill paid usage, to communicate with you about your account, and to comply with applicable law.

Category	Purpose	Typical Retention
Account information	Authentication, account management, security notices, support, service communications	For the life of the account, plus a limited period after closure for legal, fraud, and tax obligations
Stripe billing metadata	Subscription management, billing support, fraud prevention, accounting and tax	For the life of the account and for the additional period required by tax and accounting law (typically 7 years)
Conversation data and saved content (Cloud Vault)	Provide chat history, continuity, exports, saved artifacts, projects, memory features	Conversations you haven't touched in your chosen number of days (1 to 365, default 60) are deleted automatically. Continuing a chat keeps its history
Conversation data (Local-Only mode)	Kept in your browser, encrypted on that device. We process each message with its conversation context but do not retain history; we keep only the key your browser uses	On your device until your chat retention period passes, you clear it, or you delete your account. Temporary chats end when you close the tab
Temporary staged uploads	Pre-attachment analysis before a file is added to a conversation	Approximately 60 minutes if not attached to saved content, after which the staged copy is purged
Security and access logs	Protect the Service, enforce rate limits, investigate abuse, maintain reliability	30 days for application audit events, 7 days for routine request logs, longer where retention is required for a specific incident or legal hold

We may use de-identified, aggregated statistics (for example, total messages per day, error rates, latency percentiles) to monitor the health of the Service. These statistics are not linked back to you and are not used to build profiles of users.

3. Cloud Vault Architecture

This section explains how encryption protects stored content and when the service can access plaintext. Cloud Vault is encryption at rest, not end-to-end encryption against Meriq or its server operators.

3.1 Your vault key and your password

Your vault key is a 256-bit key: the one your password first derived, or a random one after you rotate it in Settings. It is sealed under a second key derived from your password (your account password, or a separate vault password if you set one) with a slow and intentionally expensive key-derivation step. We never store your password in readable form, and we store the vault key only in that sealed form.

If you sign in through a social provider, you choose a separate vault password the first time you turn on the Cloud Vault, and that password protects your key. A social-login account without a vault password, including one that turned the Cloud Vault on before vault passwords were required, keeps what it saves under a key the service derives from account details, so the service can decrypt that content without a secret from you. An account in that state with the Cloud Vault on is asked to create a vault password at its next sign-in, and its content then moves to the new key.

3.2 Working keys during use

Your vault key is stored only in sealed form: once under a key derived from your password, and once for each signed-in session under a secret that only that browser's cookie holds. We keep a hash of that secret, never the secret, so the stored copy opens nothing on its own. When a request arrives, the server opens the key in memory, uses it for that request or a task the request started, and discards it. Long-running research and agent tasks keep it in memory until they finish. A session relocks after 7 days without use, and signing out or changing your password ends a session's access.

Meriq can still read the following, by design or until an upgrade completes:

• Characters you make public or unlisted, including their portraits, which other users can see.
• Artifact previews you open. A preview's files load through addresses that carry a key for that version of the artifact, so anyone who obtains one of those addresses can load those files until it expires (72 hours for a saved preview, 4 hours for a live one), or until you change your password or sign out everywhere.
• Support tickets, which Meriq staff read so they can help you.
• Content of a social-login account without a vault password, as described in Section 3.1.
• Content saved under our earlier server-held encryption, until it moves to your vault key the next time you sign in.
• Files a running task works on, such as an agent workspace or a live app preview, which are on our servers' disks in readable form while it runs and are removed when it ends or within a day.

3.3 What is actually on our disks

Cloud Vault content records are encrypted with AES-256-GCM, an authenticated encryption scheme that detects tampering. A copy of our databases or backups holds no usable vault key, so apart from what Section 3.2 lists it does not provide plaintext without your password or a live signed-in session. This protection does not cover an active server, which handles decrypted content while it serves your requests.

3.4 What we cannot do

• We do not store your vault key in usable form, so apart from what Section 3.2 lists we cannot decrypt your stored content without you.
• We cannot recover your password. After an emailed password reset, content saved before it stays locked under the old password, and you can recover it in Settings with that old password. Without it, that content cannot be recovered.
• Signing out of one browser does not end your other signed-in sessions. Changing your password or rotating your encryption key ends them all.

3.5 What we can do (and how briefly)

• The service processes decrypted messages and conversation context to provide chat, research, file analysis, and agent features. Processing can continue for the duration of a task; it is not limited to a few seconds of routing.
• Long-running research and agent tasks keep your key in memory until they finish, even if you close the tab.

3.6 Local-Only mode

With Cloud Vault off, chat history is kept in your browser rather than saved as a Cloud Vault conversation. It is encrypted on your device with a key we hold and hand only to your signed-in browser, so a copy of the browser profile cannot be read on its own; clearing browser history or deleting your account makes every copy unreadable. Your current message and conversation context still travel to Meriq and the selected AI provider to generate a response. Browser-local storage does not mean local model execution or end-to-end encrypted inference.

4. AI Processing and Subprocessors

To generate a response, analyze a file, or run a feature you request, we may send the minimum necessary content to third-party AI, hosting, storage, and content-delivery providers. We select providers that contractually agree not to retain your content for training or for secondary uses beyond completing your request, except where you specifically opt in.

Examples of provider categories used to operate the Service include:

• AI inference providers who run the language and image models you select. The plaintext of the request you currently send is delivered to the provider you have chosen, and the response is returned to you and (if Cloud Vault is enabled) encrypted before storage.
• Payment processing by Stripe.
• Infrastructure and content delivery by Cloudflare and comparable vendors for security, edge caching, and reliability.
• Object storage for encrypted blobs (vault content, generated images, exported artifacts).
• Transactional email delivery for verification, password reset, and security notices.

A current list of categories and primary providers is available on request to [email protected].

5. When We Share Information

We disclose personal information only in the limited circumstances listed below.

• Service providers performing functions on our behalf, under written agreements that restrict their use of the information to the work we contracted them to do.
• Stripe for payment processing and subscription management. Stripe processes your card details under its own Privacy Policy.
• OAuth providers you choose (such as Google or Discord) receive the authentication request from you, not from us. We receive only the identifiers necessary to confirm your identity.
• Cloudflare and similar infrastructure vendors for security, reliability, and content delivery. See Cloudflare's Privacy Policy.
• Legal authorities and courts where disclosure is required by valid legal process or where we believe in good faith that disclosure is necessary to protect rights, safety, or to investigate fraud or abuse. See Section 13 for our process.
• Successors in connection with a merger, acquisition, financing, bankruptcy, or sale of assets. Any successor must honor the commitments in this Policy or provide you with reasonable notice and a meaningful choice.

6. What We Do Not Do

• We do not sell personal information or conversation content. We do not "share" personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act.
• We do not use your prompts, conversations, uploads, generated images, or related content to train AI models, ours or anyone else's.
• We do not deploy advertising pixels, conversion tags, or third-party behavioral analytics on the Service.
• We do not build advertising or marketing profiles based on what you do inside the Service.
• We do not store plaintext passwords or full payment card data. Your Cloud Vault key is never stored in usable form, as described in Section 3.2.

7. Cookies and Local Storage

We use a small number of strictly necessary cookies and similar technologies that are essential for the Service to function. These include a session cookie that keeps you signed in, a CSRF token that protects authenticated form submissions, and security tokens issued by our content-delivery and bot-mitigation vendors.

We do not set advertising cookies, social media tracking pixels, or cross-site analytics cookies. We do not honor cross-site tracking because we do not perform it.

Some browsers send a Global Privacy Control signal. Because we do not sell or share personal information for cross-context behavioral advertising, that signal does not require any change in our handling.

8. Your Rights and Choices

You can exercise the rights below for free by writing to [email protected], or by using the in-product controls where available. We will verify your identity through your account before responding.

8.1 Rights available to all users

• Access the personal information we hold about you.
• Correct inaccurate or outdated personal information.
• Delete your account and the personal information associated with it, subject to limited retention for legal, fraud, or accounting obligations.
• Export conversations, projects, and other saved content from inside the product.

8.2 Additional rights for users in the European Economic Area, the United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, you have additional rights under the GDPR and UK GDPR.

• Restriction of processing in specific cases set out in Article 18 GDPR.
• Objection to processing based on our legitimate interests.
• Portability of personal information you have provided to us in a structured, commonly used, machine-readable format.
• Right to lodge a complaint with your local data protection authority.

Our legal bases for processing under the GDPR are: performance of a contract (delivering the Service you requested), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax, accounting, lawful requests), and consent where required (for example, optional marketing communications you opt into).

8.3 Additional rights for California residents

If you are a California resident, you have rights under the California Consumer Privacy Act ("CCPA") as amended by the CPRA.

• Right to know the categories and specific pieces of personal information we collect and disclose.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing: as stated, we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination for exercising any of the above rights.

An authorized agent may submit a request on your behalf by providing written proof of authorization.

9. Retention and Deletion

You can delete individual conversations, individual uploads, projects, generated images, and your entire account through controls inside the product.

• Conversations you haven't touched in your Chat Retention window (1 to 365 days, default 60) are deleted automatically. Continuing a chat keeps its history.
• Deleted conversations and account-level deletions are removed from active systems promptly and from operational backups within 30 days under normal conditions.
• We may retain a minimal subset of records (such as Stripe invoices, abuse history for users we have banned, or records subject to a legal hold) for the period required to satisfy legal, accounting, fraud-prevention, or dispute-resolution obligations.

10. Security

We protect personal information using a combination of administrative, technical, and physical safeguards.

• All traffic between your client and Meriq is encrypted in transit using HTTPS/TLS.
• Cloud Vault content is encrypted at rest using AES-256-GCM with a key we never store, as described in Section 3.
• Passwords are stored as slow-hashed digests with per-account salts.
• Production systems require multi-factor authentication for staff access, and access is scoped to job function.
• We log access to administrative tools and review the logs for anomalies.
• We test the Service against the OWASP Top 10 categories and run dependency scanning continuously.

No security program is perfect. If you believe you have found a vulnerability, please write to [email protected] with reproduction steps. We do not pursue legal action against good-faith researchers who follow coordinated disclosure.

11. Children

The Service is intended for adults aged 18 and older. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child, we will suspend the account and delete the associated data. Parents or guardians who believe their child created an account may contact [email protected].

12. International Transfers

Meriq is operated from servers in Canada and the United States, with content delivery and security infrastructure that may transit data through other countries. By using the Service, you understand that your information will be processed in jurisdictions whose privacy laws may differ from those of your home jurisdiction.

For transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or the Swiss equivalent where applicable) with our subprocessors, supplemented by additional technical measures such as the encryption practices described in Section 3.

13. Law Enforcement and Government Requests

We respond to lawful, properly served requests from courts, regulators, and law enforcement. Our process is as follows.

1. We require valid legal process appropriate to the data requested (for example, a search warrant for content where applicable).
2. We verify the authenticity of the request and the jurisdiction of the requester.
3. We disclose only what is required to respond and only the data we actually hold. For stored Cloud Vault content we hold only ciphertext, apart from what Section 3.2 lists, and we will state that in our response. Content our servers are processing for you at that moment is in readable form while they process it.
4. Where not legally prohibited (for example, by a non-disclosure order accompanying the process), we notify affected users in advance so they have an opportunity to challenge the request themselves.
5. We publish aggregated transparency information about lawful requests we receive as the Service matures.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When changes are material, we will provide notice through the Service or by email at least 14 days before the change takes effect, unless a shorter period is required by law. The "Last updated" date at the top of this page will reflect the most recent version. Prior versions are available on request.

15. Contact

For privacy questions, data-subject requests, or to exercise any right described above, contact [email protected].

For security-vulnerability disclosures, contact [email protected].

For all other inquiries, contact [email protected].