Privacy Policy

1. Overview

This Privacy Policy describes how CPU AI (the “Service”, “we”, “us”) handles information when you use cpuai.site, sign in with Google, chat with the AI assistant or use our developer tools. CPU AI is an independent software project being developed and operated by the CPU AI project operator. This notice covers the current application behavior, not possible future token, wallet or agent features.

2. Information we collect

• Account information: When you choose Sign in with Google, CPU AI receives a signed Google identity token. After validation we store your Google account's unique identifier, verified email address, display name and account creation timestamp in our Cloudflare D1 database. We do not request your Google password or Gmail/Drive contents through this sign-in flow.
• Usage records: Your CPU account identifier, UTC date and number of AI requests are stored to enforce the current free allowance of five requests per UTC day. Historical quota rows are not automatically deleted in the current implementation.
• AI conversations: Submitted text prompts and responses, including code snippets you intentionally attach or paste, are processed to answer your question. If conversation history is configured, CPU AI saves a conversation ID, title derived from your prompt, timestamps and a limited snapshot of recent messages. The current implementation keeps up to eight recent messages per saved conversation.
• Project files (local and optional cloud storage): Workspace project names and code files can be stored in your browser. When you explicitly choose Save new cloud copy or Save changes, CPU AI uploads those project files to Cloudflare D1 associated with your Google account. Cloud projects include project ID, owner ID, project name, source file contents, timestamps and a revision number. Cloud storage is optional and is not end-to-end encrypted; do not upload credentials, private keys or confidential third-party code. Agent Studio templates and theme preferences remain browser-local. Home/Dashboard prompt drafts use session storage.
• Basic technical information: Cloudflare and your browser may process IP addresses, request details, device/browser information, security events and necessary network logs to deliver and protect the site. The retention of provider-level operational logs is controlled by those providers and relevant service settings.
• Public GitHub data: The read-only GitHub tools retrieve content from repositories or issues you choose to explore. Those requests can be subject to GitHub's terms, availability and access logs.

3. Google Sign-In and Google user data

CPU AI uses Google Identity Services to authenticate you. Our server checks token validity and intended client ID, then creates a CPU session. We use your Google account identifier, email and name only for account identity, presenting account information and enabling account-scoped features such as quotas and conversation history.

Signing in does not grant us access to your Gmail inbox, Google Drive files, contacts or calendar, and it does not grant CPU AI free Google Gemini inference credits. We do not use information obtained from Google Sign-In for targeted advertising or sell that information.

Google operates its own authentication services under its Privacy Policy. You can manage your Google Account independently of CPU AI.

4. Why we use information

• Authenticate you, maintain your login session and display your CPU AI account.
• Provide AI answers, follow-up conversation context, file-review requests and related features you explicitly ask for.
• Enforce per-account usage allowances, troubleshoot failures and safeguard the service from misuse.
• Store and retrieve your saved conversations when the history feature is configured.
• Maintain the site, investigate operational and security issues, and comply with valid legal obligations.

We do not present the current site as a token trading platform and do not use Google identity information for blockchain marketing or token-holder profiling.

5. AI processing and third-party services

Cloudflare Workers AI: When you click Send message in Free AI, CPU AI sends the selected conversation context and any expressly included text/code attachment to Cloudflare Workers AI for inference. Your prompt is not sent by simply typing it on the homepage or importing a file into the local Workspace. Cloudflare states that standard Workers AI inference requests do not retain customer content beyond what is necessary to provide the service, subject to documented exceptions. CPU AI's own D1 saved-history feature is a separate retention mechanism and is not covered by the inference-only behavior.

Google: Provides Google Identity Services for login.

GitHub: Processes browser requests made through the public Repository Analyzer and Issue Explorer. CPU's current public tools do not connect to your private GitHub account.

Optional restricted operator AI route: A separate, operator-access-controlled AI Chat may send text to OpenAI if the operator has configured it. This is not the default Google Free AI route. The operator should not grant access to untrusted users without appropriate controls.

Third parties process information under their own policies and service agreements. Consult Cloudflare Workers AI data usage for more detail.

6. Storage, retention and deletion

Account profile and daily quota records are stored in Cloudflare D1. Optional saved conversation records and explicitly uploaded cloud project files stay in D1 until removed or an administrator performs appropriate account data maintenance. CPU AI does not currently enforce an automatic retention or deletion schedule for all account and quota records.

Saved conversations can be deleted individually from the Free AI conversation sidebar when the history feature is available. This does not automatically remove your account profile or historical usage counters. There is not yet a self-service “Delete my entire account” function.

Browser-saved Workspace content remains on your current device until you remove it or clear browser storage. Cloud project copies can be individually deleted in Project Workspace; deleting a cloud project does not remove local copies, and clearing browser storage does not delete uploaded cloud projects. Exported JSON/Markdown downloads remain on the device where you saved them.

7. Cookies and browser storage

CPU AI uses an essential cpu_session cookie to maintain a verified session. It is configured with HttpOnly, Secure and SameSite=Strict flags and an approximately seven-day maximum lifetime. Logging out clears this cookie in the browser. We also use local or session storage for UI theme preferences, local Workspace/agent templates and unsent drafts.

The application does not currently intentionally place advertising trackers or behavioral advertising cookies in the CPU AI frontend. Google and Cloudflare may use their own service-related technologies subject to their policies. You can block or delete browser storage, but sign-in and certain product features may stop working.

8. When information is shared

We share data with service providers only as necessary to operate authentication, infrastructure and inference, or when you deliberately use a third-party integration. We may also disclose information when lawfully required or to address legitimate security incidents. We do not intentionally sell Google Sign-In profile data or saved chat content. We do not make other users' saved conversations public through the current product features.

9. Security and limitations

CPU AI uses signed sessions, server-side Google token verification and account-scoped conversation and cloud project queries. Google credentials and model credentials should not be embedded in public frontend code. Nonetheless, no online system is entirely secure. The project is in active development and has not been represented as having undergone a comprehensive independent security audit. Do not submit passwords, API keys, private signing keys or sensitive third-party source code.

10. Your choices and data requests

• Access: You can view basic account information and daily quota in the Dashboard, and saved chat history if the relevant D1 table is deployed.
• Delete a conversation: Use the Delete control next to a saved chat in Free AI. The action deletes that saved conversation record.
• Delete a cloud project: Sign in, open Project Workspace, and click Delete next to the uploaded project. This deletes its D1 cloud record, not your exported or browser-local copies.
• Delete browser-local data: Use available clear/remove options or clear this site's storage through your browser. Clear chat only removes the current in-page transcript; it does not delete separately saved D1 conversations.
• Full account requests: The current service has no self-service account deletion or export endpoint. To request access, correction or full deletion, email support@cpuai.site with the subject “CPU AI Privacy Request”. Please do not email your Google password, session tokens or private keys. We may need to verify your account ownership before fulfilling a request.

Applicable local laws may provide additional privacy rights. The project operator must verify applicable requirements and ensure there is an accessible contact method for exercising those rights.

11. Cross-border processing

Google, Cloudflare and other service providers may process information in infrastructure located outside your country. Appropriate legal bases, transfer mechanisms and regional restrictions depend on the service operator and applicable law; no particular data-residency guarantee is made here.

12. Children's privacy

CPU AI is a general developer tool and is not specifically directed at children. The service does not currently implement age verification. People who require parental consent under applicable law should obtain it before using the service, and the operator should review age-related obligations before broader public launch.

13. Changes to this Privacy Policy

We may revise this notice when features or processing practices change. We will update the “Last updated” date and post the new version on this page. Material changes may require additional notice or consent where applicable.

14. Contact CPU AI

This email address has been tested for incoming mail through Cloudflare Email Routing. Use it for access, correction, deletion and general privacy questions. Our current email routing forwards incoming messages; a separate outgoing email solution may be needed for replies sent from this domain address. Legal operator details and applicable privacy-law requirements should be reviewed before broad commercial release.

This document describes the implementation observed in the project repository as of October 22, 2026. It is a starting policy draft and not a guarantee of compliance with every applicable privacy law.