Last Updated: November 1, 2026

Thank you for using Chat Bot AI, operated by Mobile Cosmos LLC ("Company", "we", "us", or "our"). We are committed to protecting your privacy through a strict Privacy-First, Local-Only Conversation Architecture. If you have any questions or concerns about this Privacy Policy or our practices, please contact us at [email protected].

1. What Information Do We Collect?

We collect only the minimum technical data necessary to operate the app, manage token balances, verify Premium subscriptions, and prevent abuse:

• Anonymous Device & Profile Identifiers: When you launch the app, we assign an anonymous account linked to your device identifier (device_id / UDID), country/language code, push notification token (notify_token), app version, and technical device information (device model, manufacturer, operating system version, device name and build fingerprint) used to keep your account consistent and to prevent abuse. If you grant permission via iOS App Tracking Transparency (ATT) or Android settings, your device's advertising identifier (IDFA on iOS, Google Advertising ID on Android), stored as profile_id, is used to attribute "Share & Earn" referral rewards and to preserve your account across reinstalls. When a friend installs the app through your referral link, our attribution partner reports that install to us (the friend's advertising identifier, device model, operating system version, country, locale and IP address) so the reward can be credited and duplicate installs detected. We ask for this permission only when you choose to join the "Share & Earn" program, never at app launch. If you decline, every other feature keeps working normally and you can still share the app; only referral rewards cannot be attributed, because the identifier is needed to match a friend's install to your link.
• Non-Content AI Transaction Metadata: When you send a message to the AI, our servers record only non-content metadata: the AI provider's response reference ID (ai_id), conversation UUID, token counts (prompt tokens, completion tokens, total tokens), AI model identifier, whether a file/photo attachment was included, timestamp, and the IP address the request was sent from (kept for security, abuse prevention and legal compliance). We never log or store the text of your prompts, the AI's replies, or your uploaded files in our database.
• In-App Purchase & Subscription Records: If you purchase a Premium subscription, payment processing is handled entirely by the Apple App Store or Google Play Store (and verified via Adapty). We do not collect or have access to your credit card, bank account, or billing address. We store only the non-sensitive transaction ID (trans_id), subscription status, price, and country code for accounting and entitlement verification.
• Content Moderation Reports: If you voluntarily report an inappropriate AI response using the in-app report button, we record the associated ai_id, the report reason, optional notes you provide, the text of the reported AI answer and the question that preceded it, your anonymous user/device ID, and the IP address the report was sent from. This lets our team review the report and, where required by law, provide the reported content and the related account information to competent authorities.
• Approximate Location: The app does not request location permission and never accesses GPS or precise location. Our analytics providers (Google Firebase Analytics and Yandex AppMetrica) derive an approximate location (country and city) from your IP address to produce usage statistics.

2. Device Permissions We Request & How They Are Used

Chat Bot AI requests the following device permissions strictly on an on-demand basis to enable specific user-initiated features:

• Microphone & Speech Recognition: Used only when you tap the microphone icon to convert your spoken voice into text prompts (Speech-to-Text). Transcription is performed by your device's built-in speech recognition service (Apple or Google); the app receives only the resulting text, and no audio is sent to or stored on our servers.
• Camera, Photo Library & Files (Premium Feature): Used only when a Premium subscriber chooses to capture or select a photo or document (PDF, TXT, CSV, JSON, MD, DOCX) to attach to a conversation. The selected image or document text is transmitted securely over HTTPS to process your AI request in memory and is immediately discarded after the response is returned.
• Push Notifications: Used to deliver service notifications. You can disable push notifications at any time in your device's system settings.

3. How Your Data Is Processed by Third-Party AI & Service Providers

In compliance with Apple App Store Guideline 5.1.2(i) and Google Play Data Safety requirements, we transparently disclose the third-party service providers that process data on our behalf:

Service Provider	Purpose	Data Processed
OpenAI API (and configured LLM providers)	Generating AI chat responses & analyzing attached photos/documents	Your current prompt, recent conversation context (stored locally on your device and sent with the request), and any attached image/document. Data sent via the OpenAI API is not used by OpenAI to train its models.
Apple App Store, Google Play Billing & Adapty	In-app subscription billing, receipt validation, and purchase restoration	Anonymous user ID, subscription receipt and transaction status, device information, IP address, and your advertising identifier if you allow tracking.
Google Firebase (Messaging, Analytics, Crashlytics)	Push notifications, crash reporting, and app stability diagnostics	Push notification token, anonymous installation ID, your anonymous user ID, crash logs and diagnostic data, app usage events, and approximate location (country/city) derived from your IP address.
Yandex AppMetrica	"Share & Earn" referral link attribution	Referral link parameters, device/install attribution metadata (including the advertising ID if you allow tracking), app usage events, crash and performance diagnostics, purchase events, and approximate location (country/city) derived from your IP address, to credit bonus tokens when a friend installs the app and to measure app usage and stability.

We do not sell, rent, or trade your personal information to any third party, and we do not use any third-party advertising SDKs.

4. Data Retention & Security

All communication between the Chat Bot AI mobile app, our backend API, and AI providers is encrypted in transit using industry-standard HTTPS / TLS encryption.

• Conversation Content: Not stored on our servers (kept only in local storage on your device until you clear it or uninstall the app). Reported messages are the exception: they are kept with the report as described above.
• Anonymous Account & Non-Content Metadata: Retained while your anonymous device account remains active to maintain your token balance, Premium status, and legal/abuse compliance records.
• Subscription Notification Logs: Raw purchase notifications received from Adapty are kept for 90 days for troubleshooting and then deleted automatically.
• After You Delete Your Account: Your account is detached from your device immediately and can no longer be used. Its identifiers (device ID, advertising ID, IP address), AI transaction metadata and content reports are kept for up to 365 days solely for legal compliance and abuse investigations, and longer only while a content report linked to the account is still under review. After that they are permanently deleted. Purchase records are kept as required for accounting and tax purposes, linked only to an internal numeric ID.

5. How to Review or Delete Your Account and Data

You can delete your data immediately at any time without contacting support:

• Clear Local Conversations: Open the app, go to Settings → Clear All Conversations (or delete individual chat threads from the drawer). This immediately removes your conversation history from your device.
• Delete Account & Server Data: Open the app, go to Settings → Reset / Delete Account Data, and confirm. This immediately detaches and deactivates your account on our servers and clears all local data on your device; the remaining server records are permanently deleted after the retention period described in section 4.
• Delete by Email Request: You may also request data deletion or assistance by emailing [email protected].

6. Your Privacy Rights (GDPR, UK GDPR & CCPA/CPRA)

European Economic Area (EEA), United Kingdom & Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to request access to, rectification of, or erasure of your data, as well as the right to restrict or object to processing and the right to data portability. You also have the right to lodge a complaint with your local data protection supervisory authority.

California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• We do not collect sensitive personal information such as real names, physical addresses, social security numbers, biometric data, or precise GPS geolocation.
• We do not "sell" or "share" personal information for cross-context behavioral advertising.
• California residents have the right to know what categories of data are collected, the right to request deletion of their data (requested in the app via Settings → Reset / Delete Account Data, completed as described in section 4), and the right to non-discrimination for exercising privacy rights.

7. Children's Privacy

Our Service is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal data, we will promptly delete such information.

8. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our app features, legal requirements, or store guidelines. The updated version will be indicated by the "Last Updated" date at the top of this page and will take effect as soon as it is published.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Company: Mobile Cosmos LLC
• Address: 30 N Gould St, Ste R, Sheridan, WY 82801, United States
• Email: [email protected]