Privacy policy

1. What we keep

1. 1. What we keep
2. 2. What we never collect
3. 3. How we use what we keep
4. 4. Training and people reading
5. 5. Who else sees it
6. 6. What Seufic will not do
7. 7. How the rules are enforced
8. 8. Checking answers
9. 9. Security
10. 10. Requests for your data
11. 11. Your controls
12. 12. Deleting your account
13. 13. Reporting a problem
14. 14. Changes to this policy

(Section 5 of the Terms of Service)

This page says the same thing in plain words. If the two ever differ, the Terms win.

We don’t sell ads or data, so we only keep what we need to answer you and the files you choose to store. Transparency shows what you can check yourself. This policy covers seufic.com and the assistant on it.

1. What we keep

If it isn’t on this list, we don’t have it.

• Account information: your email address, your password (kept only as a hash that cannot be reversed), your handle, your display name, the two-step verification your account uses, a keyed check of your PIN if you set one (never the PIN itself), and which browsers the account is signed in on, so you can sign one out.
• Your record: your profile, the memories you have approved, and the notes and documents you add.
• Files: the files you attach to messages and the artifacts you save. They are kept in a private storage bucket, encrypted where they are stored but not end to end, and erased with the account.
• Your conversations: every message and reply, and the title of each chat, sealed in your browser before they are stored. See Encrypted chat history.
• Your encryption keys, in sealed form: a public key your messages are sealed to, and the private key, sealed under a secret our server keeps on Cloudflare. That secret is never stored in the database.
• Your settings: your language, the model you leave the picker on, whether earlier conversations are recalled and how long chats are kept.
• Usage: the credits spent each week, any promotional credits you claimed and what is left of them, and one row for each message and reply holding which model answered, its length and how long it took. Never the text.
• Feedback: what you write to [email protected], the date it arrived and the address it came from, kept apart from your account and never passed on.
• Feedback survey: if you answered the feedback survey that used to be in the app, your answers and the date, linked to your account so the credits it gives reach you. They are erased with the account.
• Mailing list: if you join it from the foot of a page, your email address, the page you joined from and the date. It is kept apart from your account, used only to email you news about Seufic, and deleted the moment you leave the list on the Contact page. Your address is also held by Resend, the service that sends those emails, and is removed there when you leave.
• Projects: the name of each project, sealed like a chat title, which chats are in it, the files you keep there, and a fingerprint of each open claim you tick off. The claim itself is never stored with it.
• Seufic Daily: if you play while signed in, your progress on each day’s puzzles and whether you solved them, so your streaks follow you. Nobody else sees it, and it is erased with the account.
• Reported replies: if you press Report reply, the text of that one reply, the reason you picked and any note you add. A report is the only way a sealed reply reaches us, and it is not linked to your account.

We keep no request log of our own. Cloudflare, which hosts Seufic, sees the IP address and browser that arrive with each request and keeps its own logs under its own policy.

Encrypted chat history

The first time you sign in, a key pair is made for your chats, with nothing for you to set up or save. Each message and each chat title is sealed to the public half (P-256, then AES-GCM) in your browser before it is stored. The private half is stored sealed with AES-GCM under a key our server derives from a secret it keeps on Cloudflare, apart from the database. When you sign in on a device, with your password and your two-step code if you turned it on, the server opens the private key and hands it to that session, and your browser keeps it there until you sign out.

• What this protects. The database that stores your chats, and anyone who gets a copy of it, sees only ciphertext.
• What it does not. Because our server holds the secret, it could open your stored chats. It opens your key only to hand it to your own signed-in session. This is not end-to-end encryption, and we do not call it that.
• Forgot your password. Reset it from the sign-in page. Your chats stay as they are.
• While a reply is written. Our server reads your message, the conversation and your record in order to answer, as any assistant must. A reply is sealed to your key before it is stored. Nothing of the conversation is stored in readable form.
• What it does not cover. Your account, profile, memories, notes, artifacts and files are stored readable, encrypted only where they are stored. Your password also reaches Supabase, our sign-in provider, every time you sign in, as with any password sign-in, and Supabase keeps only a hash of it. We plan to move to a more secure database that we run ourselves.
• End-to-end chats. For two days in October 2026 you could start end-to-end encrypted chats. That option has been removed. Chats started that way can no longer be opened, by you or by us, and you can delete them from the sidebar.

Your PIN

In Settings, under Security, you can set a six-digit PIN, with or without two-step verification. Once it is set, our server hands your chat key only to a device that already holds it or sends the right PIN. A new device, or one that signed out, shows your chats as locked until the PIN is entered there in Settings. Devices you are signed in on when you set it carry on as before.

Your browser turns the PIN into a check value (PBKDF2, 600,000 rounds) and sends only that. Our server stores a keyed hash of it, never the PIN. After four wrong tries each new try has to wait, from 30 seconds up to 3 hours, so a PIN cannot be guessed through Seufic.

• What this protects. Someone who gets your password, and your two-step code if you use one, still cannot read your chats on their own device without the PIN.
• What it does not. It does not change how chats are sealed. Our server still holds the secret that could open them, as Encrypted chat history explains, and a device where your chats are already open stays open.
• Forgot your PIN. Press Forgot PIN in Settings. The PIN turns off 24 hours later, so someone who just got into your account cannot skip it, and any device where your chats are open can stop the reset.

2. What we never collect

We collect no device fingerprint and no location. The bot check described below is run by Cloudflare, and we receive only its result. We keep no record of what you press or how long you stay, and no contacts. We buy nothing about you from anyone, and we draw no conclusions about your age, income, beliefs, health or intentions.

Visits to seufic.com are counted with Cloudflare Web Analytics, which sets no cookies and keeps no identifier that ties one visit to the next. It tells us how many people opened a page, not who they were. That is why this site has no cookie banner.

Signing up, signing in and resetting a password pass an invisible bot check, Cloudflare Turnstile. To tell a person from a bot, it reads signals from your browser, such as your IP address, your browser and a fingerprint of the encrypted connection, and Cloudflare uses them only to block bots and to improve that check. Seufic receives a pass or a fail and nothing else. Cloudflare’s Turnstile Privacy Addendum explains what it collects and how it is used.

3. How we use what we keep

• Answering you. Your question goes to the model with the conversation, your profile and your approved memories, through our own server, for one answer.
• Keeping Seufic safe. Detecting fraud, abuse and attacks, and meeting our legal obligations.
• Writing to you. The emails an account needs, a reply when you write to us, and news about Seufic if you joined the mailing list. Nothing you keep in Seufic is used to train a model, as section 4 says.

We don’t show ads and never sell, rent or license your information.

4. Training and people reading

Your chats are encrypted and never used for training. Neither is your profile, memories, documents, artifacts, attached files, or a chat on your own API key. There is no setting for this because there is nothing to turn on.

Nobody at Seufic opens your chats, though our server holds the secret that could, as Encrypted chat history explains. Your profile, memories, notes, artifacts and files are stored readable, and the person who runs Seufic can open them with the database’s service key. We do so only to fix a problem you reported, or when the law requires it.

Chats on your own API key

In Settings, under Your API keys, you can add a key of your own from Google, OpenAI, Anthropic, xAI, Mistral AI or OpenRouter and chat with their models inside Seufic. Your key is kept encrypted in your browser, and wiped when you sign out. It is never kept in your account and never synced to your other devices. Your key is never sent to Seufic.

A chat on your own key is sent from your browser to the provider you picked, under that provider’s terms and privacy policy, and they bill you for it. The model is given what any Seufic model would be given for that turn: the conversation, your profile and your approved memories. To prepare each turn, our server reads the conversation once to add your record and any web results, then hands it back to your browser to send. Seufic keeps the conversation and any artifacts in your account, encrypted like any other chat, and never uses them to train any model.

Seufic pays nothing toward a chat on your own key and takes no share of what you pay. The reply is written by the provider’s model, and we do not check, filter or stand behind it. Seufic isn’t responsible for how the provider of that key stores, uses or trains on your data. Section 7.2 of the Terms sets this out in full.

5. Who else sees it

No other account can read anything of yours. Seufic has no way to hand a conversation, a file or any part of your record to another user.

The companies whose systems Seufic runs on handle your information only to run the service. Cloudflare hosts the site and our server, and runs our models on Cloudflare Workers AI. Supabase holds the database, the sign-in system and your stored files for now. We plan to move to a more secure database that we run ourselves. A web search provider receives a short search query when an answer needs current facts. When a question is about a company, a country, research or money, our server also asks public sources for the name or figure it needs: OpenAlex for research papers, the US SEC, GLEIF and UK Companies House for company records, Wikidata for facts, the World Bank for country figures and Frankfurter for exchange rates. A question about a medicine, a treatment, government spending or a website sends only that name or address to the US FDA, ClinicalTrials.gov, USAspending.gov, the registry that holds the website’s domain or the Internet Archive. When you copy a citation for a research paper, our server asks OpenAlex for its details using the paper’s identifier. When a page an answer relies on is gone, our server asks the Internet Archive for a saved copy of that page. None of them receive your account or the rest of the chat. Supabase’s email service delivers the emails an account needs, and Resend sends the mailing list, holding only the addresses on it. Each is bound by contract to use what it is given for that work.

Atlas is Qwen3.8 27B, Cobalt is Google Gemma 4 26B, Altair is Meta Llama 4 Scout and Spectre is Mistral Small 3.1 24B. Z.ai GLM-4.7-flash decides whether a message needs a web search and which public sources to ask. BAAI bge-reranker picks the most relevant pages and Meta M2M-100 translates sources written in another language. The companies that made those models never see your conversation. It goes from our server to Cloudflare Workers AI and back. The one exception is a reply you ask for on your own API key, which goes to the provider you picked, as described under Chats on your own API key.

The Transparency page sets out what each of these sees, why, how long it is kept, and what deleting does.

6. What Seufic will not do

Some of these are enforced in code. Others are instructions to the models.

• Remember on its own. It may suggest a memory. Nothing joins your record until you approve it. This is enforced in code.
• Take orders from your files. Your profile, memories and documents reach the model as data inside marked boundaries. It won’t follow instructions written inside them.
• Diagnose, advise or represent you. It is not a doctor, a lawyer or an accountant. Where an answer needs one, it says so.
• Invent facts about you. If your record does not say, it asks or says it does not know.
• Keep an unsafe image. Every image you attach to a message is screened before it is kept. When the screen cannot decide, the answer is no. This is enforced in code.

7. How the rules are enforced

A model can be talked out of its instructions, so the important rules are enforced outside it.

• The database refuses. Every row belongs to one account, by a rule in the database itself. A request for anyone else’s record comes back empty. The database also refuses to store a new message or chat title that is not ciphertext.
• The server checks. Every request to a Seufic model passes through our own server, which checks your session first. Your browser never reaches a Seufic model directly.
• Your chats are sealed in your browser before they are stored. Everything else is encrypted between your browser and our servers, and again where it is stored, with keys our providers hold. Neither part is end-to-end encryption.
• The screen fails closed. When a safety check cannot decide, the answer is no. An error or a doubtful result counts as a rejection, never as a pass.

8. Checking answers

The assistant can be wrong, so it shows its sources.

• Sources. An answer drawn from the web lists its sources under it, each one a link you can open. The list is saved with the answer.
• Only the answer is kept. Notes and drafts written on the way to an answer are dropped before it reaches you, so nothing else can end up in your record.

9. Security

How a message moves

1. Sealed. Your browser seals the message to your key and stores it in a row owned by your account. The database refuses every other account.
2. Sent. The readable message goes over an encrypted connection to our server, with your profile and approved memories.
3. Answered. Our server passes it to the model for one answer. Nothing about the model is reachable from your browser.
4. Stored. The reply is sealed to your key before it is stored, by your browser or, if you have left, by our server.

Access control

Our server checks your session before it forwards anything. A request with no session, or an expired one, never reaches a model. Keys and app tokens live on the server, and none of them is in the page, in a script the page loads, or in a response the page receives.

Security headers

You can see these on any response from this site.

10. Requests for your data

From July 1 to September 30, 2026 we received none. A request counts whether or not we complied with it.

We answer only a request the law requires and that is valid where it was issued. We hand over the narrowest part of an account that satisfies it, and unless the law forbids it, you hear about it first. That includes your stored conversations, because our server holds the key that opens them, so we would open only what such a request names.

11. Your controls

• See and edit it. Your profile, memories and documents are open to you in Settings, and any of them can be changed or removed on the spot.
• Take it all. One ZIP from Settings with every conversation, every memory, your profile and every file you keep. Your browser opens your chats to put them in it.
• Delete it. A deleted conversation is erased at once, and its attached files within 30 days. To close the account itself, see section 12.
• Lock it. Two-step verification you can turn on, and a list of every browser signed in, with a button to sign any of them out. A PIN that a new device has to enter before your chats open there.

12. Deleting your account

Open Settings and go to Danger zone. Download your data first if you want a copy, because nothing can be brought back afterwards. Then pick one of two ways to close the account, and confirm with your email address and password.

• Deactivate. You are signed out and the account is closed. Sign in again within 31 days and it comes back as you left it. After 31 days you can no longer sign in, and the account is deleted with every conversation, project, memory, document, artifact and attached file in it. A short account record stays for 2 more months, so it is removed 3 months after the day you deactivated.
• Delete. This is permanent. You cannot sign back in, and the account is deleted straight away with everything in it. A short account record stays for 3 months and is then removed.

The account record holds your email address, your handle, your display name, the details you put in your profile and a count of what the account held. Only Seufic can read it. Once it is removed, nothing of the account is left in our database, and neither you nor we can bring it back.

13. Reporting a problem

Tell us about a bad answer, a memory it shouldn’t have suggested, or a security hole. Say what happened and how to see it again. For security reports, only test against your own account and put security in the subject.

Write to [email protected].

14. Changes to this policy

When this policy changes, the date at the top of this page changes with it. If a change materially affects your rights, such as widening what we keep or adding a purpose, you are told in the product before it takes effect. Where the law requires fresh consent, we ask again.