Privacy Policy — Chaos Filter

1. What this policy covers

Chaos Filter ("we," "us," "our") operates the website at chaosfilter.ai and the application at app.chaosfilter.ai. This policy explains what personal data we collect, how we use it, and your rights regarding it.

Chaos Filter is a diagnostic AI tool. Unlike most apps, we intentionally collect and analyze behavioral patterns from your conversations. This is the core function of the product — not a side effect. This policy is written to be explicit about exactly what that means.

Plain language summary: We collect your email, payment info, and conversation data. We use your conversations to build a behavioral profile that makes the AI progressively more accurate over time. We do not sell your data. We do not use it for advertising. You can request deletion at any time.

2. What data we collect

Data Type	What it is	Why we collect it
Email address	Provided at signup	Account creation, authentication, transactional emails
Payment information	Processed by Stripe — we never see or store card details	Subscription billing
Conversation messages	Everything you type and every AI response	Delivering the service; building session memory and behavioral profile
BIOS scores	Automated linguistic analysis scores (agency, rigidity, volatility, coachability, blame index)	Calibrating AI responses to your communication patterns
Session summaries	Compressed AI-generated summaries of each conversation	Cross-session memory for paid users
Behavioral Operating Map	A synthesized behavioral profile built from all your sessions (Pro/Unlimited only)	Long-term pattern recognition and diagnostic accuracy
Usage data	Message count, subscription tier, timestamps	Enforcing tier limits, product improvement

We do not collect: location data, device fingerprints, browsing history outside the app, or any data from third-party sources.

3. The Behavioral Operating Map

This section deserves special attention because it is unusual.

For Pro and Unlimited subscribers, Chaos Filter automatically builds and maintains a Behavioral Operating Map — a synthesized profile of your behavioral patterns, psychological operating system, avoidance patterns, and coachability profile. This is derived entirely from your own conversations with the app.

This map is:

Generated automatically every 10 messages using an AI model (Anthropic Claude)
Stored securely in our database associated with your account
Injected into AI system prompts to improve diagnostic accuracy over time
Never shown to third parties, never used for advertising, never sold
Deleted immediately and permanently if you request account deletion

Important: By using Chaos Filter as a Pro or Unlimited subscriber, you are explicitly consenting to this behavioral analysis. If you do not want this analysis performed, use the Free tier, which does not build a behavioral map.

The map is the core value proposition of the product — it is what allows the AI to operate with accumulated precision rather than starting from zero each session. We are being explicit about it here because you have a right to know it exists.

4. How we use your data

We use your data only for the following purposes:

Delivering the service — processing your messages, generating AI responses, maintaining your account
Cross-session memory — allowing the AI to remember context from previous conversations (paid tiers only)
Behavioral analysis — building and updating your Behavioral Operating Map to improve diagnostic accuracy (paid tiers only)
Authentication — verifying your identity when you sign in
Billing — processing subscription payments via Stripe
Transactional communication — sending you account-related emails (magic links, receipts, important updates)
Safety and abuse prevention — rate limiting, detecting misuse

We do not use your conversation data to train AI models. We do not use your data for advertising. We do not sell your data to anyone.

5. Third parties

We share data with the following third-party services as necessary to operate:

Service	Purpose	Data shared
Anthropic	AI model provider (Claude)	Your messages are sent to Anthropic's API to generate responses. Subject to Anthropic's Privacy Policy.
Supabase	Database and authentication	Email, conversation data, behavioral map, all stored data. Subject to Supabase's Privacy Policy.
Stripe	Payment processing	Email, payment information. Subject to Stripe's Privacy Policy. We never see your card details.
Resend	Transactional email	Email address, for sending account emails. Subject to Resend's Privacy Policy.
Vercel	Hosting and serverless functions	IP addresses, request logs (standard server logs). Subject to Vercel's Privacy Policy.

We do not share your data with any other third parties. We will never sell your data.

6. How long we keep it

Account data (email, tier) — retained while your account is active. Deleted within 30 days of account deletion request.
Conversation messages — retained while your account is active. Deleted within 30 days of account deletion request.
Session summaries — retained while your account is active. Deleted within 30 days of account deletion request.
Behavioral Operating Map — retained while your account is active. Deleted immediately upon account deletion request.
BIOS scores — retained while your account is active. Deleted within 30 days of account deletion request.
Payment records — retained for 7 years as required by financial regulations. Stripe retains payment data subject to their own retention policy.

We do not have an automatic data expiry system at this time. If you want your data deleted before closing your account, email us at hello@chaosfilter.ai.

7. Your rights

Regardless of where you are located, you have the following rights:

Access — You can request a copy of all personal data we hold about you, including your Behavioral Operating Map.
Deletion — You can request deletion of your account and all associated data at any time. We will process this within 30 days.
Correction — You can request correction of inaccurate personal data.
Portability — You can request your conversation data in a portable format.
Objection — You can object to specific uses of your data at any time.

For GDPR (EU/UK users): Our lawful basis for processing is (a) contract performance — processing necessary to deliver the service you signed up for, and (b) legitimate interests — behavioral analysis to improve diagnostic accuracy, which is the stated core function of the product you explicitly signed up for.

For CCPA (California users): We do not sell your personal information. You have the right to know what data we collect, request deletion, and opt out of sale (though we do not sell data).

To exercise any of these rights, email hello@chaosfilter.ai with the subject line "Data Request." We will respond within 30 days.

8. Security

We take reasonable technical measures to protect your data, including:

All data transmitted over HTTPS/TLS
Database access controlled via Row Level Security — you can only access your own data
Authentication via Supabase JWT tokens
Server-side API keys never exposed to the frontend
Rate limiting on all API endpoints

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at hello@chaosfilter.ai.

9. Children

Chaos Filter is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy as the product evolves. If we make material changes — particularly to how we use your behavioral data — we will notify you by email and update the effective date above. Continued use of the service after notification constitutes acceptance of the updated policy.

11. Contact

For any questions about this policy or your data, contact us at: