Privacy Policy

1. Who we are

This website (abliteration.org, "the Site") is operated by Catyonic OÜ, a company registered in Estonia (registry code 17463508), located at Madara tn 9a, 10612 Tallinn, Estonia ("we", "us", "our"). For any questions about this Privacy Policy or to exercise your rights, contact [email protected].

2. What this policy covers

This policy explains what information we collect when you visit abliteration.org, how we use it, how long we keep it, and what rights you have. It applies to all pages under the abliteration.org domain, including the catalog, market analytics, wiki, the Research Agent, and the shop. Section 15 covers our separate Abliteration desktop application - available for Windows (Microsoft Store) and macOS (signed and notarized .dmg from abliteration.org) - which has its own (much smaller) privacy footprint.

The Site has two very different privacy profiles: anonymous browsing (the catalog, market, wiki - what most visitors see) and authenticated features (the Research Agent and credit purchases). Section 3 covers the first; Section 4 covers the second.

3. Anonymous browsing (catalog, market, wiki)

We do not require accounts to browse the catalog, view market analytics, or read the wiki. There is no registration, no login, no password, no email, no payment. You can use these parts of the Site anonymously.

We do not use cookies for analytics, tracking, or advertising on these pages. The Site sets no cookies of its own for anonymous visitors.

We run Umami, a privacy-friendly self-hosted analytics tool, on our own infrastructure. Umami collects aggregate, anonymized data about visits:

• Page URL you visited and the referring URL (if any)
• Approximate country and region (derived from IP, not stored)
• Browser, operating system, and device type
• Screen resolution and language preference
• Timestamp of the visit

What Umami does not collect: your IP address is used only to derive geography and to distinguish visits; it is hashed daily with a rotating salt and never stored in raw form. There is no cross-site tracking, no fingerprinting, and no advertising identifiers. We cannot identify individual visitors.

4. Authenticated features (Research Agent, Public API, and shop)

To use the Research Agent, the Public API, or to purchase credit packs, you must sign in. Sign-in and purchases are the only parts of the Site where we handle personal data linked to you.

4.1 Sign-in (Google OAuth). When you sign in, we receive from Google:

• Your email address and whether it is verified
• Your name (as it appears on your Google profile)
• Your profile picture URL
• A stable identifier that Google uses for your account

We do not receive your Google password, your contacts, your Gmail, or anything else from your Google account. We store the fields above in our own database, along with the timestamps of your first and most recent sign-in.

4.2 Session cookie. After sign-in we set a single essential cookie, abl_session, which lets us recognize you across page loads. It is HttpOnly, Secure, SameSite=Lax, and expires after 30 days of inactivity. On the server we store only a SHA-256 hash of the session token, so a database disclosure cannot be turned into usable cookies. This is the only cookie we set, it is essential for the authenticated features to work, and it does not require consent under the ePrivacy Directive.

We do not show a cookie banner. The only cookie on the site is the essential session cookie described above, and our analytics tool (Umami) uses no cookies at all. Under the ePrivacy Directive, consent is required for non-essential cookies and tracking identifiers - since we have neither, a banner would be theatre rather than compliance, and we would rather not add one to your screen. If we ever introduce non-essential cookies (advertising, cross-site tracking) we will add proper consent controls at that point; right now, there is nothing to consent to.

4.3 Credits and transactions. Every credit change - free grant at sign-up, purchase, query cost, refund, and expiry - is recorded in your account so that you can see your full history. Each record includes the amount, the reason, the timestamp, and (for purchases) the Stripe product identifier and the amount paid. When credits are about to expire, we send a warning email 30 days ahead and a confirmation email on the day of expiry - see Section 7 of the Terms.

4.4 Payments. Payments are processed by Stripe Payments Europe, Ltd. (Ireland). When you click "Buy" on our pricing page, you are redirected to Stripe's own hosted checkout page at checkout.stripe.com - the address bar changes to Stripe's domain, the page is served by Stripe, and the card form is Stripe's, not ours. Your card details never touch our servers. We receive from Stripe only what we need to reconcile the transaction: a payment identifier, the amount, the currency, the last four digits of the card, and the card brand. Stripe processes your data according to its own Privacy Policy.

4.5 Research Agent queries. Your questions to the Agent, and the answers it produces, are stored in your conversation so that you can go back to them. Queries are processed by our language-model providers (Anthropic and, in some cases, Google) under commercial API contracts that include an explicit no-training clause - those providers contractually undertake not to use the content of your queries to train their models. Beyond that clause, Anthropic and Google process API traffic under their own privacy policies (Anthropic Privacy Policy, Google Cloud Privacy Notice). We ourselves have no models of our own to train, and we do not sell query content to anyone.

We keep your query history in your account until you delete a conversation or your account. When you delete a conversation, it disappears from your account immediately, is removed from our live database within 24 hours, and is removed from encrypted backups within 30 days on the next backup rotation cycle. Backups are not searchable, not accessed for any purpose other than disaster recovery, and cannot be read without cryptographic keys held only by our infrastructure team. After 30 days, no copy of the conversation exists in any of our systems. The financial record of the transaction (date, tier, credits deducted, no content) is separately retained for 7 years as required by Estonian Accounting Act §12 - see Section 6 and Terms Sections 7.1 / 7.2.

4.6 Public API keys. When you generate an API key at /shop/account#api-keys we show you the raw key exactly once and store only a SHA-256 hash of it, alongside its short display prefix (e.g. abl_live_...ABC4), the name you gave it, the creation timestamp, and - updated on each authenticated request - the timestamp of its last use. The raw key itself is never stored, so a database disclosure does not yield usable keys. When you revoke a key we set a revocation timestamp on the row; the row is not deleted, so a later "was this key revoked before it made that call" question stays answerable from your own account log. If you delete your account, all your API-key rows are deleted with it.

Every API call is written into the same credit_transactions ledger as the Research Agent's spend, with a distinct reason label (api_spend) so that we can attribute activity correctly to Agent versus API. The Query log at /shop/account shows only Research Agent activity - it exists so you can dispute a tier assignment (Terms 7.2), a mechanism that has no counterpart on the API where cost is deterministic by route and returned row count. Per-key API usage is surfaced next to the keys themselves in your account panel, so you can see which integration is spending your balance. We record which route was called and which of your keys was used, so that you can attribute usage to the right integration; we do not record request parameters, response bodies, or the customer's IP address in this ledger. Server logs (Section 5) hold the request URL for a short period for operational reasons; the ledger row is what persists for accounting. The 7-year retention on the financial record applies to API rows the same way it applies to Agent rows.

5. Server logs

Our web server (behind Cloudflare) automatically records basic technical information for security and troubleshooting: IP address, request URL, HTTP status code, user agent, and timestamp. These logs are retained for up to 30 days and used only for operational purposes (detecting attacks, diagnosing errors). They are not linked to Umami analytics data or to your account.

6. How long we keep data

• Umami analytics data: up to 12 months, then anonymized aggregate summaries only
• Server logs: up to 30 days
• Account profile (email, name, avatar URL): as long as your account exists, plus a short archival period after deletion for dispute resolution
• Session records: 30 days after last use, then deleted
• Research Agent conversations (question text, answer text): kept until you delete the conversation or your account. On deletion - immediately removed from your account, within 24 hours from the live database, and within 30 days from encrypted backups on the next rotation cycle
• Credit balance: credits themselves expire 12 months after they were issued (per Terms §7). The record of every transaction (date, tier, credits deducted, expiry event) is kept for seven (7) years after the transaction, as required by Estonian accounting law (Accounting Act §12), even if the underlying conversation has been deleted
• Email correspondence (if you write to us): as long as needed to resolve the conversation, plus a reasonable archival period

When you delete your account we remove your profile, unused credits, sessions, and conversation history on the same schedule as above. Payment records are retained for the accounting period and then deleted.

7. Sub-processors we use

We only use a small number of processors, listed here so you know exactly whose infrastructure your data touches:

• Contabo GmbH (Germany) - hosting of the Site, database, and Research Agent
• Cloudflare, Inc. (US, EU points of presence) - content delivery, DDoS protection, and traffic security
• Google LLC (US, Ireland) - OAuth sign-in only; we do not use Google Analytics, Google Ads, or any other Google service on the Site
• Stripe Payments Europe, Ltd. (Ireland) - card processing for credit purchases
• Anthropic PBC (US) - language-model inference for the Research Agent, under a commercial API agreement with a no-training clause
• Google LLC (US, Ireland) - Gemini language-model inference for the Research Agent, under the same no-training terms

We do not use Google Analytics, Facebook Pixel, or any advertising network. There are no social-media tracking widgets on the Site.

Links on the Site point to third-party platforms: primarily Hugging Face, where the actual model files are hosted, but also academic papers on arXiv and the ACL Anthology, source-code repositories on GitHub, personal blogs of researchers, and other market resources cited in the wiki. When you follow such a link, you leave abliteration.org and are subject to the destination site's privacy practices. We have no visibility into or control over their data collection.

8. Legal basis (GDPR)

• Anonymous browsing, Umami, server logs, security: legitimate interest (Art. 6(1)(f) GDPR) - operating and protecting a public catalog.
• Sign-in, sessions, Research Agent, credits, purchases: performance of a contract (Art. 6(1)(b) GDPR) - the account is the contract between you and us for the paid service.
• Retention of payment and accounting records: legal obligation (Art. 6(1)(c) GDPR) - Estonian Accounting Act §12.
• Anti-fraud and enforcement of these Terms: legitimate interest (Art. 6(1)(f) GDPR).

Because we do not use tracking cookies or advertising identifiers, and the session cookie is essential to the authenticated service, we do not require consent under the ePrivacy Directive.

9. Your rights

If you are in the EU, EEA, or another jurisdiction with similar rules, you have the right to:

• Ask what data we hold about you (for anonymous browsing: very likely none, since we collect no identifiers; for authenticated features: everything described in Section 4)
• Request a copy of your personal data in a portable format
• Request correction or deletion of your data - noting that payment and accounting records must be retained for the period described in Section 6
• Object to processing based on legitimate interest
• Withdraw consent where consent is the legal basis (in practice, we do not rely on consent, so this is rare)
• Lodge a complaint with your local data protection authority (in Estonia: Andmekaitse Inspektsioon)

UK users have the same rights under the UK GDPR and the Data Protection Act 2018, and may lodge complaints with the Information Commissioner's Office (ICO). California residents have the rights to know, delete, and opt-out of the sale of personal information under CCPA/CPRA - since we do not sell personal information to anyone, the opt-out is effectively already applied. For users in other jurisdictions with equivalent data-protection rules, we honour those rights on the same basis wherever we can.

How to delete your account. Email [email protected] from the address on the account (this is how we verify it is you). We confirm the request within a few days and complete the deletion within 30 days. Deletion removes your profile, unused credits, session records, and conversation history on the schedule described in Section 6. Financial records (date, tier, credits deducted - with no question or answer content) are retained for 7 years as required by Estonian Accounting Act §12; we cannot delete them earlier without breaking accounting law.

To exercise any of the other rights above, email [email protected]. We will respond within 30 days.

10. Data transfers

Our servers are located in Germany (Contabo GmbH). Cloudflare, Stripe, Google, and Anthropic operate global networks with points of presence outside the EU; your data may be processed in the United States. Where transfers occur, our processors rely on the standard EU-approved safeguards (Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914), and, where applicable, on the EU-US Data Privacy Framework.

11. Security

We take reasonable technical and organizational measures to protect your data: HTTPS everywhere, secure cookies, hashed session tokens, minimal collection, restricted server access, and prompt patching. No system is ever perfectly secure. If we discover a breach that materially affects your data, we will notify the Estonian Data Protection Inspectorate within 72 hours as required by GDPR, and notify affected users by email where the breach is likely to result in a high risk to their rights and freedoms.

12. Children

The Site is intended for a general adult audience interested in AI research. It is not directed at children under 16, and the Research Agent is not intended for use by minors. We do not knowingly collect information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be posted at this URL with a new effective date. Material changes will be noted in the site footer, and for authenticated users we will also send an email at least 14 days before the change takes effect.

14. Change log

We track material changes to this Privacy Policy here, so you can see what has moved without re-reading the whole document.

• 28 September 2026 - clarified: the "Local hardware bridge" paragraph in Section 15 now lists every field the /rig endpoint returns, so that the Privacy Policy matches the desktop app's documentation exactly. The bridge itself, its scope and its purpose are unchanged; only the enumeration is more complete. In addition to the previously named CPU model, total and free RAM, and GPU name, the paragraph now spells out the application version, the operating system name and version, the CPU core count, the VRAM figure that accompanies the GPU name (returned only when a discrete or external GPU with at least 2 GB of VRAM is present; integrated graphics are reported as null), and the UTC timestamp of the measurement. The "no personal data" commitment is unchanged and reworded slightly to list explicitly the categories the response never contains.
• 27 September 2026 - expanded: Section 15 now covers both the Windows client (unchanged: MSIX from the Microsoft Store) and the new macOS client (signed and notarized .dmg from abliteration.org, Developer ID Application OU Catyonic (AHPT46BBZ2)). The five zero-collection commitments - no accounts, no telemetry, no cloud inference, no usage data, no content - are unchanged and apply to both clients. Three subsections were added: Where content lives on the device (explicit per-OS storage paths), Network use (the application requires no network access to answer prompts; user-initiated downloads of models from public catalogs such as Hugging Face and clicked in-app links are the only outbound traffic), and Local hardware bridge (the loopback-only HTTP server on 127.0.0.1:47821 that lets abliteration.org, in a browser on the same machine, see the rig for compatibility filtering and enable the "Open in Abliteration" catalog hand-off; endpoints are /health and /rig, read-only, exposing only OS-reported hardware summary - CPU model, total/free RAM, GPU name - and only while the application is running). A Trust and integrity paragraph documents the macOS signature verification command and the Windows Store distribution channel. The previous single sentence "requires no network access to function" was reworded because it did not accurately describe optional user-initiated model downloads and the loopback bridge; the zero-collection commitments themselves are unchanged. Section 2 updated in one place to mention both operating systems in the pointer to Section 15.
• 19 September 2026 - added: new Section 15 covers our separate Abliteration desktop application for Windows, distributed through the Microsoft Store. The application is a local runner for open-weight language models supplied by the user, and, unlike the Site, collects no personal data - no accounts, no telemetry, no cloud inference, no usage or content collection, no network calls at all in normal operation. Section 2 gained one sentence pointing to the new section, and the previous Section 15 "Contact" moved to Section 16. Legal terms governing the application live in Section 20 of the Terms of Use.
• 15 September 2026 - added: Public API v1 launched, so authenticated features now covers Research Agent, Public API, and shop (Section 4). New subsection 4.6 describes what we store about API keys: the SHA-256 hash of each raw key (the raw value itself is never persisted), a short display prefix, the name the user gave it, and creation / last-used / revocation timestamps. API call spend is written to the same credit_transactions ledger as the Research Agent's, with a distinct api_spend reason. The Query log at /shop/account stays Agent-only because the dispute mechanism it exists for has no API counterpart; per-key API usage is surfaced next to the keys themselves. No new personal data category is introduced; the API surface reuses the identity, session, and credit-wallet plumbing already documented for the Agent.
• 11 September 2026 - added: split of anonymous browsing vs authenticated features (Section 2); Google OAuth fields, essential session cookie with explanation why no cookie banner is shown, Stripe redirect to checkout.stripe.com (Sections 4.2, 4.4); no-training clause with links to Anthropic and Google provider policies, 30-day backup deletion window for conversations (Section 4.5); split of content vs financial-record retention - conversation content on deletion schedule, transaction record for 7 years per Estonian Accounting Act §12 (Section 6); named sub-processors - Contabo, Cloudflare, Google OAuth, Stripe, Anthropic, Google Gemini (Section 7); expanded destination links - Hugging Face, arXiv, ACL Anthology, GitHub, other market resources (Section 7); four legal bases separated for anonymous browsing, contract, legal obligation, anti-fraud (Section 8); UK GDPR, CCPA/CPRA, and other-jurisdiction paragraph, explicit "how to delete your account" paragraph (Section 9); Standard Contractual Clauses and EU-US Data Privacy Framework for cross-border transfers (Section 10); security measures and 72-hour breach notification commitment (Section 11); this change log (Section 14).
• 27 August 2026 - initial version.

15. Abliteration desktop application

The Abliteration desktop application is a separate product from the Site. It is available for Windows (distributed through the Microsoft Store as an MSIX package) and macOS (distributed through the Mac App Store and also as a signed and notarized .dmg directly from abliteration.org). All distribution channels ship the same binary; all clients follow the same privacy principles.

Unlike the Site, the application does not collect, store, or transmit any personal data. Specifically:

• No user accounts or authentication. The application has no sign-in flow and no concept of a user identity linked to Catyonic OÜ.
• No telemetry or analytics. The application does not report installations, sessions, feature usage, crashes, or any other event back to us or to a third party.
• No cloud connectivity for inference. All model inference runs entirely on the user's local hardware. Prompts, responses, and any other generated content stay on the device.
• No usage data collection. We do not record which models the user loads, how many tokens are generated, or how often the application is opened.
• No content collection. Chat history, model files, and all other user-generated content remain exclusively on the user's device.

Where content lives on the device. Chat history, downloaded model files, and application settings are stored in a per-user directory that the user has full and direct access to and may back up, move, or delete at any time:

• Windows: %LOCALAPPDATA%\Caty\
• macOS: ~/Library/Containers/org.abliteration.models/Data/…/Abliteration/

Network use. The application requires no network access to answer a prompt - inference itself is entirely offline. It may reach the public internet only in situations the user initiates, specifically:

• Downloading a model file the user selected from a public catalog such as Hugging Face. The application itself does not host, distribute, or curate any AI models; downloads go directly to the third-party host.
• Following a link the user clicks from within the application (for example, in-app Docs, Terms, or Privacy).

Local hardware bridge (optional, catalog handoff). While the application is open, it runs a small local HTTP server on 127.0.0.1:47821 (bound to the loopback interface only, so it is never reachable from outside the machine). It exposes two read-only endpoints, /health and /rig, whose sole purpose is to let abliteration.org, when opened in a browser on the same machine, recommend model quantizations that fit the user's rig, and to enable the "Open in Abliteration" hand-off from the catalog. The response consists of the following fields, each of which the operating system already reports to any locally running application:

• Application version.
• Operating system name and version.
• CPU model and core count.
• Total and free RAM.
• GPU name and VRAM, and only when a discrete or external GPU with at least 2 GB of VRAM is present; integrated graphics are reported as null because they are not useful for local inference.
• UTC timestamp of the moment those numbers were measured.

No personal data is exposed: no user identity, no chat content, no model files, no prompts, no responses, no filesystem paths, no browsing history. The bridge is unavailable when the application is not running.

Trust and integrity. The macOS client is signed by Developer ID Application OU Catyonic (AHPT46BBZ2) and notarized by Apple; the signature can be verified at any time with spctl -a -vv /Applications/Abliteration.app. The Windows client is signed and distributed through the Microsoft Store.

Third parties. The application does not contact any third-party service on its own. All third-party interactions - downloading a model from Hugging Face, following a documentation link, or a browser on the same machine querying the local bridge - are user-initiated.

Legal terms governing the application - the Microsoft Standard Application License Terms the Windows client is distributed under, the equivalent role of these Terms of Use for the macOS client, and the disclaimers around user-supplied models and their outputs - are set out in Section 20 of the Terms of Use.

16. Contact

Questions, requests, or complaints about this Privacy Policy: [email protected].