Privacy Policy
Last updated:
NoFilterAI was built to collect as little as possible. This policy explains exactly what is processed when you use the chat, and what control you have over it.
The short version
- There are no accounts. We never ask for your name, email or phone number to use the chat.
- Your conversation lives in your browser tab. We do not store chat text and do not log it.
- Message text is processed only to generate a reply and is not used to train AI models.
- We keep technical counters without message text, and short-lived pseudonymous keys for rate limits.
- No advertising, no analytics, no session replay, no tracking cookies. We do not sell or share data.
1. Scope of this policy
This policy applies to the NoFilterAI website and chat service (the “service”). It does not apply to third-party websites you reach through links. Capitalised terms not defined here have the meaning given in the Terms of Service.
2. Who is responsible
The service is operated by No FAI LLC, 2132 Gilmore Ave, New Hampton, IA 50659, United States. No FAI LLC decides how and why personal data is processed through the service and is the “controller” (or “business”) for that data.
For any privacy question or request, write to contact@nofilterai.io with “Privacy” in the subject line. Our privacy team handles these messages.
3. What we do not collect
To be clear about what the service does not do, we do not:
- create user accounts or profiles;
- store the text of your conversations in a database, a log file or a backup;
- use your messages to train or improve AI models;
- use advertising networks, analytics tools, tracking pixels, fingerprinting or session recording;
- sell personal data, share it for cross-context behavioural advertising, or build marketing profiles;
- knowingly collect data from anyone under 18.
4. What we process, why and on what basis
| Data | Purpose | Legal basis (where GDPR applies) |
|---|---|---|
| Text of your messages and the replies | Generating a reply. Our server passes the recent part of the conversation to our AI processing infrastructure and streams the answer back to your browser. | Performance of the service you request (Art. 6(1)(b)) |
| Anonymous session cookie containing a random ID | Applying rate limits and preventing abuse | Legitimate interests in security and fair use (Art. 6(1)(f)) |
| Pseudonymous rate-limit keys derived from the session ID and IP address with a keyed hash | Counting requests in short time windows, blocking automated abuse | Legitimate interests (Art. 6(1)(f)) |
| IP address and request metadata (time, requested URL, browser type, response status) | Delivering the website, protecting it against attacks and diagnosing faults | Legitimate interests (Art. 6(1)(f)) |
| Technical usage records: request ID, status, latency, model name, token counts and cost | Running the service within its budget, capacity planning and detecting faults | Legitimate interests (Art. 6(1)(f)) |
| Emails you send us and our replies | Answering your request, handling complaints and legal claims | Legitimate interests; legal obligations (Art. 6(1)(f), (c)) |
Where we rely on legitimate interests, we have weighed them against your rights. Our interests are keeping a free service available, secure and within a fixed budget. You can object to this processing at any time (see section 11).
Please don’t put information in the chat that identifies you or other people, or sensitive details such as health information, unless you are comfortable with it being processed as described here. If you do share sensitive information, it is processed only to answer you and is not stored by us.
5. How your conversation is handled
- You type a message. It is held in the memory of your browser tab.
- When you send it, your browser sends the recent conversation to our server over an encrypted HTTPS connection.
- Our server checks the request against rate limits, then sends the part of the conversation that fits in the assistant’s context to our AI processing infrastructure. Your IP address and session ID are not included.
- The reply is streamed back to your browser. Our server keeps the text only in working memory for the few seconds needed to do this and then discards it.
- Our processing infrastructure is contractually bound to process the text only to generate the reply. It is instructed not to store replies for later retrieval and does not use the data to train models. It may keep request data for a limited period, typically up to 30 days, solely to detect and prevent abuse, after which it is deleted.
- The conversation stays in your tab until you reload the page, close the tab or press New chat. It is not written to cookies or other browser storage.
6. Where data comes from
We receive personal data directly from you (what you type and the emails you send us) and automatically from your browser when you visit the website (IP address, request metadata and the session cookie). We do not buy data or obtain it from data brokers.
7. How long we keep data
| Data | Retention |
|---|---|
| Conversation text on our servers | Not stored. Held in working memory only while a reply is generated. |
| Conversation text at our AI processing infrastructure | Up to about 30 days for abuse monitoring only, then deleted |
| Session cookie | 7 days, or until you delete it |
| Rate-limit keys | Expire with their time window, from 1 minute to 1 hour |
| Security events and hosting logs | Typically up to 7 days, longer only when needed to investigate a specific incident |
| Aggregated usage counters (no message text, no IP address) | Up to 90 days |
| Email correspondence | As long as needed to handle your request, and up to 3 years where needed for legal claims |
8. Service providers and other recipients
We share data only with service providers that process it on our behalf, under written contracts that require them to protect it and use it only as we instruct:
- AI processing infrastructure (United States): generating replies, as described in section 5.
- Cloudflare, Inc.: website hosting, content delivery, server functions and storage of rate-limit and cost counters (which never contain message text).
We may also disclose data where required by law or valid legal process (see section 17), to protect the rights, safety and property of users, the public or No FAI LLC, or to a successor in a merger, acquisition or sale of assets, in which case this policy will continue to apply to the data transferred.
We do not sell personal data and do not share it with advertisers or data brokers.
9. International transfers
No FAI LLC is based in the United States, and our service providers process data in the United States and possibly other countries. If you use the service from outside the United States, your data will be transferred there. Where the GDPR or UK GDPR applies, these transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension for certified providers) or on Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed. You can request more information about these safeguards by writing to us.
10. How we protect data
We use technical and organisational measures appropriate to the risk, including:
- encryption in transit with HTTPS and HTTP Strict Transport Security;
- keeping access keys only on the server, never in the browser;
- signed, HttpOnly session cookies and pseudonymised rate-limit keys;
- a strict Content Security Policy and other security headers;
- request validation, size limits and protection against automated abuse;
- restricting access to production systems to authorised personnel;
- data minimisation: what we do not store cannot be leaked.
The service is not end-to-end encrypted, because our servers and processing infrastructure must read the text to answer it. No online service can guarantee complete security. If we become aware of a personal data breach that affects you, we will notify you and the authorities where the law requires it.
11. Your rights (EU, UK and similar laws)
If you are in the European Economic Area, the United Kingdom, Switzerland or another place with similar laws, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data;
- erase your data;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- data portability for data you provided to us;
- lodge a complaint with a data protection supervisory authority, in particular where you live or work.
Because we keep no chat text and no accounts, we usually hold nothing we can link to you. If that is the case, we will tell you. You can always clear a conversation yourself with New chat or by reloading the page, and delete the session cookie in your browser settings.
12. Your rights in US states
Residents of California and other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Iowa) may have the right to:
- know the categories and specific pieces of personal information we collect, use and disclose;
- delete personal information we hold about them;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information, targeted advertising and profiling;
- limit the use of sensitive personal information;
- appeal our decision on a request; and
- not be discriminated against for exercising these rights.
In the last 12 months we have collected the following categories of personal information, for the purposes in section 4: identifiers (IP address, random session ID), internet or network activity (request metadata) and the content of messages you choose to send. We have not sold personal information or shared it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
You may use an authorised agent to make a request on your behalf. We may ask the agent for proof of authorisation. If we deny your request, you can appeal by replying to our decision with “Appeal” in the subject line; we will respond within the time required by law.
13. How to make a request
Email contact@nofilterai.io and describe your request. We will acknowledge it and respond within one month (GDPR) or 45 days (US state laws). Where the law allows, these periods can be extended if a request is complex; we will tell you if that happens.
Because we do not hold accounts, we may need information from you to find any data related to you, such as the approximate date and time you used the service. We will only use that information to handle your request. Requests are free of charge unless they are manifestly unfounded or excessive.
14. Children
The service is intended only for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has used the service, please contact us and we will take appropriate steps.
15. Automated decision-making
Replies are generated automatically, but we do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated rate limits may temporarily stop you from sending messages; if you believe you were blocked in error, contact us.
16. Do Not Track and Global Privacy Control
We do not track you across websites, so there is nothing for a Do Not Track signal to switch off. We treat a Global Privacy Control signal as a valid request to opt out of the sale and sharing of personal information, which we do not do in any case.
17. Requests from authorities
We respond to requests from law enforcement and other authorities only when they are made through valid legal process and in line with applicable law. Because we do not store conversations, we are generally unable to provide chat content. Requests should be sent to contact@nofilterai.io.
18. Changes to this policy
We may update this policy when the service or the law changes. The “Last updated” date at the top shows the current version. If a change materially affects how we process personal data, we will highlight it on the website before it takes effect. Details about cookies and browser storage are in the Cookie Policy.
19. Contact
No FAI LLC
Attn: Privacy
2132 Gilmore Ave, New Hampton, IA 50659
United States
Email: contact@nofilterai.io