The short version
- Our own models run on hardware we operate. Your chats are not sent to an outside AI company unless you connect your own key for one.
- We do not sell your data. We do not show ads. We do not use analytics or tracking tools.
- We do not use your conversations or files to train AI models.
- Every message, reply and uploaded file is checked automatically for a short list of illegal content. Nothing else is blocked.
- You can delete your account and your content from Settings at any time. Backup copies are gone within 30 days.
Who we are
Ashburn is an AI chat service available at ashburnlabs.com and in our iOS app. It is run by Ashburn Labs ("we", "us"). This policy explains what personal information we collect when you use the website, the app and the API behind them, and what we do with it. It applies to everyone who uses Ashburn.
Questions or requests about your data go to [email protected].
Information we collect
Account information
When you sign up we collect your email address, a password, your first and last name, and your confirmation that you are 18 or older. Sign-in is handled by our authentication provider, Supabase. Your password is stored by Supabase in hashed form; we never see it. We also keep your account status: whether it has been approved, which plan it is on, and whether it has been disabled.
What you create
To make the service work, we store the following on our servers:
- Conversations. Your messages, the replies, titles and pinned status, so your chats are available on all your devices. A copy is also kept in your browser or app so it works offline.
- Files you upload. The original file and the text we extract from it. For images, that text is read with optical character recognition (OCR) on our own servers.
- Knowledge documents. Documents you add to your knowledge base, and the search index built from them so the model can find relevant passages.
- Agents and workflows you build, including their names, instructions and settings.
- API keys you connect for other AI providers. Keys are encrypted before they are stored and are never shown again after you save them.
- Reports you file about a reply. A report includes the reply, the message that led to it, the model used, the reason you chose and any note you add.
- Feedback you send from Settings, with your email address and whether you sent it from the web or the app.
Usage and safety records
We count how many messages you send each day and when you sent the last one, so we can apply your plan's limits. We keep an event log of account and service activity: sign-ups, approvals, age confirmation, file uploads (type and size), chats (message length and which model answered, not the content), reports, errors, and moderation blocks. When a request or reply is blocked, we keep a safety record of it, including the blocked text and the account it came from.
Technical information
Like any website, your device sends technical details such as your IP address and browser type when it connects. Our own application does not store your IP address. Cloudflare, which carries traffic to our servers, and Supabase, which handles sign-in, process it as part of providing their service. The site's fonts are loaded from Google Fonts, which receives the same basic connection details when your browser downloads them.
On your device
The site and app store your sign-in session and a cache of your conversations and settings (such as light or dark appearance) in your browser's local storage. We do not use advertising cookies or tracking pixels.
What we do not collect
We do not collect your precise location, contacts, or advertising identifiers. The app only receives files you choose to upload. We do not buy information about you from anyone.
How we use it
- To run the service: sign you in, answer your messages, read your files, search your knowledge base and sync your chats.
- To manage access during the beta, apply plan limits and confirm you meet the age requirement.
- To keep the service lawful and safe: automatic moderation, reviewing reports, and acting on accounts that break our Terms.
- To send account email, such as sign-up confirmation and password resets.
- To answer your support requests and feedback.
- To find and fix errors, and to protect our systems from abuse.
- To comply with the law.
We do not use your conversations, files or knowledge documents to train AI models. We do not use your information for advertising, and we do not build profiles of you for marketing. Our staff do not read your conversations as a matter of routine. We look at content only when you report it, when you ask us to help with a problem, or when we need to investigate abuse or meet a legal obligation.
How your chats are processed
Ashburn models
Ashburn models, such as Nykor, are open-weight models that we modify and run on hardware we operate. When you chat with them, your messages, the text of any files you attach and any knowledge passages used to answer are processed on our servers. They are not sent to an outside AI company. The automatic safety check also runs on our own servers.
Providers you connect
You can connect your own API key for Anthropic, OpenAI or another compatible service. When you choose one of those models, we send that provider what it needs to answer: your message, the earlier messages in the conversation, the text of any attached files and any knowledge passages used. The provider handles that data under its own terms and privacy policy, and bills you directly. If you add a custom endpoint, your data goes to the address you enter. We do not control what these providers do with your data. Removing your key stops any further sharing.
Moderation and safety
Every message you send, every reply, and the text of every uploaded file is checked automatically. We block only content that is illegal: sexual content involving minors, instructions for making weapons capable of mass casualties, and instructions for manufacturing illegal drugs. Adults are otherwise free to use Ashburn for a wide range of topics.
When something is blocked, you see a message saying so, and we keep a safety record of it. You can flag any reply you think is harmful or wrong. Our staff review reports and blocked activity, and may disable accounts that break our Terms.
How long we keep it
We keep your information for as long as your account is open. You can delete individual conversations and files at any time, and they are removed from our servers.
Deleting your account. Go to Settings, choose Delete account, and confirm with your password. We immediately delete your sign-in from Supabase and remove everything we hold for you: conversations, files and extracted text, knowledge documents and their index, agents, workflows, saved API keys, usage counts, feedback and your event log. Safety records (moderation blocks and reports) are kept after deletion so we can meet our legal obligations, including reporting illegal activity to authorities.
Backups. We back up our database and uploaded files every night to a second server we operate. Each backup is kept for 30 days and then deleted, so data you delete is gone from backups within 30 days. We do not restore deleted accounts from backups.
Data you sent to a provider you connected is kept under that provider's policy. Cloudflare and Supabase keep their own service logs for limited periods under their policies. We may keep other information longer if the law requires it.
Security
- All traffic to ashburnlabs.com and our API is encrypted with HTTPS.
- Our servers are not exposed directly to the internet. Requests reach them only through an encrypted Cloudflare tunnel.
- Passwords are handled by Supabase and stored hashed. Deleting your account requires your password.
- API keys you connect are encrypted before they are stored.
- Each account can reach only its own conversations, files and documents.
- Backups are encrypted before they leave the server, and the key that unlocks them is kept offline.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
Your rights and choices
Wherever you live, you can ask us to:
- Access the personal information we hold about you, and get a copy of it.
- Correct information that is wrong.
- Delete your information. You can do this yourself with Delete account in Settings.
- Restrict or object to how we use your information.
- Withdraw consent where we rely on it, for example by removing an API key you connected.
Email [email protected] from the address on your account. We may ask you to confirm the request from that address so we know it is you. We answer within 30 days. If we cannot do what you ask, we will explain why, and you can reply to ask us to reconsider. We will not treat you differently for using any of these rights.
California and other US states
California and several other states give residents the rights above. In the last 12 months we have collected the categories described in this policy: identifiers (email, name), account login details, the content you create, records of your use of the service, and basic network information. We collected them from you and your device, for the purposes in "How we use it". We have not sold or shared personal information for targeted advertising, and we do not use sensitive information for anything other than providing the service. You may use an authorized agent to make a request. We do not track you across other sites, so there is nothing to opt out of with Global Privacy Control or Do Not Track.
European Economic Area, UK and Switzerland
We process your information because we need it to provide the service you signed up for (contract), to keep the service secure and lawful (our legitimate interests), to meet legal obligations, and, for connected providers, because you chose to connect them (consent). You can also complain to your local data protection authority.
Where your data is stored
Our servers are in the United States. Our service providers may process data in the United States and other countries. If you use Ashburn from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live.
Children
Ashburn is only for people 18 and older. Every account must confirm the user is 18 or older. We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a minor is using Ashburn, contact [email protected].
Changes to this policy
We will update this policy when our practices change, and change the effective date above. If a change is significant, we will tell you by email or in the app before it takes effect. We will not use information we already hold in a materially different way without your consent.
Contact us
Email [email protected] with any question about this policy or your data. Our Terms of Service explain the rules for using Ashburn.