Privacy Policy

Ask AnnyCane is built on a privacy-first philosophy. It comes in two modes, and what's processed depends on which one you use:

• Free / Anonymous mode — no account, no database, no stored conversations. You can simply start talking with AnnyCane in your browser.
• Advanced mode — you create an account so that your profile and your conversations are saved for you. This lets you come back later, continue where you left off, and have AnnyCane remember context about your situation.

Controller in the sense of Art. 4 (7) GDPR is Anja Völker (see the Legal Notice for full contact details).

1. What data is processed

1a. Free / Anonymous mode

• No user accounts. The Free mode does not require registration — no name, email or password.
• Onboarding answers (organization type, role, challenge category) are saved in your browser's local storage on your device. They are sent to the AI provider together with each message as context, but they are not written to a database operated by Ask AnnyCane.
• Your conversation messages and the text extracted from any documents you upload (PDF, Word, plain text, Markdown) are processed in your browser and transmitted to the AI provider in order to generate a response. In Free mode this content is not written to a database operated by Ask AnnyCane. It is processed in transit and may be temporarily held in operational logs by the infrastructure and AI providers listed in section 4.

1b. Advanced mode (with account)

When you choose to use Advanced mode, the following additional data is processed so that the service can give you back your own conversations and remembered context:

• Account: we use Lovable Cloud's authentication (built on Supabase Auth). Depending on the sign-in method you choose, this involves your email address and a password, and/or a sign-in via Google (in which case Google shares basic profile data such as email with us as the OAuth provider).
• Profile: the fields you provide — organization, role, current challenge, preferred language — are stored in our database (table profiles) and linked to your user ID, so that AnnyCane can use them as context in future conversations.
• Conversations: your chat sessions (title, status, timestamps — table chat_sessions) and the individual messages within them (role, text content, timestamps — table chat_messages) are stored in our database and linked to your user ID, so that you can re-open and continue them.
• Access control: every table that holds your data is protected by Row-Level Security. The database itself only ever returns rows that belong to your user ID. Other users cannot read or write your data.
• Legal basis: processing in Advanced mode is necessary to provide the service you signed up for (Art. 6 (1) (b) GDPR — performance of a contract).

1c. Applies to both modes

• Email correspondence: if you contact us by email, the email and its content are processed by the relevant email provider in order to handle your request.
• Technical request data (e.g. IP address, user agent, timestamp) is processed by the hosting provider to deliver the page and to protect the service against abuse, in line with standard server-log practice.

2. AI processing disclosure

To generate AnnyCane's responses, your messages and the extracted text of any attached documents are sent to a large language model via the Lovable AI Gateway, which routes the request to underlying model providers (currently Google Gemini models). This processing is necessary to provide the service you requested (Art. 6 (1) (b) GDPR) and, as far as additional log processing by the providers is concerned, is based on their legitimate interest in operating and securing their platforms (Art. 6 (1) (f) GDPR).

According to the current published terms of the Lovable AI Gateway and Google's Gemini API, prompts sent through these paid API endpoints are not used to train the providers' foundation models, and request data may be retained for a limited period for abuse prevention, security and operational purposes. We rely on these provider commitments and cannot independently verify them on a per-request basis. Ask AnnyCane itself does not add tracking, profiling or behavioural identifiers to the requests.

Important: Please do not share information you do not want a third-party AI provider to process — in particular unredacted personal data of others, trade secrets, health data, or confidential client information. Ask AnnyCane is a reflection tool, not a secure vault.

3. Confidentiality of your conversations

In Free mode, individual conversations are not stored in a database operated by Ask AnnyCane. They exist in your browser tab for the duration of your session and are not associated with a user identity by Ask AnnyCane.

In Advanced mode, your conversations are stored in the database so that you can come back to them. Access is strictly scoped to your account through Row-Level Security — no other user can read your conversations, and the application has no admin back-office that lists user sessions or message content. You can delete individual conversations from within the app at any time.

In both modes, we cannot rule out that message content appears temporarily in operational logs of the infrastructure and AI providers that process the request on our behalf. Access to those provider-side logs is governed by the respective providers' policies and security controls, not by Ask AnnyCane.

4. Hosting & infrastructure

• Hosting & application runtime: Lovable, running on Cloudflare Workers edge infrastructure. Standard server logs are processed for security and operations.
• AI inference: Lovable AI Gateway with Google Gemini as the underlying model provider at the time of writing. The selected model may change as the service evolves.
• Backend / database: Lovable Cloud (built on Supabase). In Free mode, no conversation content or profile data is written here. In Advanced mode, your account, profile, chat sessions and messages are stored here, protected by Row-Level Security so only your account can access them.
• Authentication: in Advanced mode, Lovable Cloud's authentication service (built on Supabase Auth) handles sign-up, sign-in and session management. If you sign in with Google, Google acts as the OAuth identity provider.
• Web fonts: Typography is loaded from Google Fonts. This means your browser establishes a connection to Google and transmits standard request data (including your IP address) to Google in order to download the font files.
• Search indexing: A Google Search Console verification meta tag is included in the page source so that the operator can monitor search indexing. The meta tag itself does not set cookies and does not track visitors.

Some of these providers are based in, or may process data in, countries outside the EU/EEA — in particular the United States. According to the providers' published documentation, such transfers are covered by appropriate safeguards under Chapter V GDPR, including the EU-US Data Privacy Framework where applicable and/or Standard Contractual Clauses (Art. 46 GDPR). We rely on these provider statements.

5. Cookies & local storage

Ask AnnyCane does not set tracking, advertising or analytics cookies. No web analytics tool (such as Google Analytics, Meta Pixel or Hotjar) is loaded by the application.

In Free mode, the application uses your browser's local storage for one purpose: to remember the onboarding answers you provided (organization, role, challenge) so they do not have to be asked again on your next visit. This data stays on your device and can be cleared at any time via your browser's site-data controls, or by visiting /onboarding and starting over.

In Advanced mode, the authentication service additionally stores a session token in local storage to keep you signed in between visits. This token is removed when you sign out.

Third-party providers (e.g. the hosting platform) may set strictly technical cookies required to deliver the page or to protect the service. These are not used by Ask AnnyCane for tracking or profiling.

6. Third-party services we use

• Lovable (hosting, edge runtime, AI Gateway)
• Google (Gemini AI models, Google Fonts, Search Console verification, and — for Advanced users who choose it — Google sign-in as OAuth provider)
• Supabase (backend infrastructure and authentication, provided through Lovable Cloud)

The application does not embed social media widgets or advertising networks. If you would prefer to avoid the connection to Google Fonts, browser extensions that block third-party requests can prevent it; the site will still load.

7. Data retention

• Free mode — conversations & uploaded documents: not persisted in a database operated by Ask AnnyCane. They are held in your browser tab for the session and may appear transiently in provider-side operational logs as described in sections 2–4.
• Free mode — onboarding answers in local storage: kept on your device until you clear them.
• Advanced mode — account, profile, conversations: kept for as long as your account exists. You can delete individual conversations from the app at any time. To delete your full account and all associated data, contact us at the email below; we will action the request within the timeframes set by GDPR.
• Server logs and AI gateway logs: retained by the respective providers in line with their own retention policies and applicable legal obligations.
• Email correspondence: kept as long as necessary to handle your request and to comply with any applicable legal retention obligations, then deleted.

8. Your rights under GDPR

Under the EU General Data Protection Regulation you have the right to:

• access the personal data we process about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure / "right to be forgotten" (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time, where processing is based on consent (Art. 7 (3)) — without affecting the lawfulness of processing before withdrawal
• lodge a complaint with a supervisory authority (Art. 77), e.g. your local data protection authority in the EU/EEA

In Free mode, Ask AnnyCane usually holds no personal data of yours to access, correct or delete. In Advanced mode, you can view and edit your profile and conversations directly in the app, delete individual conversations from the UI, and request full account deletion via the contact email below.

9. Contact for privacy requests

For any privacy-related question or to exercise your GDPR rights, please email:

anvoelker@googlemail.com

We will respond within the timeframes set by GDPR (normally within one month).

10. Changes to this policy

We may update this Privacy Policy to reflect changes in the service or in legal requirements. The current version is always available at this URL with the "last updated" date at the top.