Privacy Policy

Last updated: August 23, 2026

This policy explains what Ox Alpha Chat Online ("we", "our") collects when you use oxalpha.app and the chat at /chat. We do not sell your personal information.

Guests (not signed in)

You can chat without an account. We send the messages in that browser session to our servers so the model can reply. Guest threads are not stored in our database. If you refresh or close the tab without signing in, that thread is gone.

We keep a cookie named ox_guest_usage with today's guest message count and when it resets. It is httpOnly (your page scripts cannot read it). We also count guest messages against a hashed form of your connecting IP, so clearing cookies does not reset the daily guest limit (currently 5). We do not store the raw IP. People who share the same public IP (for example a home network or office NAT) share that guest pool.

Google sign-in

Sign-in is Google OAuth through our auth provider (Better Auth). Google shares the account name, email, profile image, and identifiers needed to keep you logged in. We store that profile on our user record, plus session cookies so you stay signed in.

We do not post to Google on your behalf. You can revoke access in your Google account permissions. Signing out of this site ends our session; it does not automatically delete stored chats.

Signed-in chats

When you are signed in, conversations (title plus message history, including assistant replies) are saved in our database so they appear in Recent and so later messages can use prior context. You can delete a thread from the sidebar. That removes it from our store for your account.

We also store a daily message count for your account to enforce the signed-in limit (currently 50 per day).

OpenRouter and model replies

Replies are generated by sending conversation text from our server to OpenRouter, which routes the request to the Ox Alpha model. Message content you submit (and, for signed-in users, stored history used as context) is processed by OpenRouter and the model provider to produce a response. Their terms and privacy notices apply to that processing. We do not use your chats to train our own model.

Hosting

The website runs on Vercel. Account and conversation data are stored with our PostgreSQL provider (Neon). Those processors see what they need to host the app: for example request logs may include IP address and user agent. Auth sessions may also record IP and user agent.

Cookies

Besides the guest usage cookie, signed-in use sets session cookies required to stay logged in. Analytics cookies are described below. Blocking cookies may break sign-in or guest rate limiting.

Analytics

Plausible records aggregate traffic (pages, referrers, countries) without a tracking cookie. See Plausible's privacy policy.

Microsoft Clarity records how people use the site (clicks, scrolls, session replay, heatmaps). Clarity may set its own cookies. We mark chat bubbles, the compose box, and your display name so message text and that name are masked in recordings. Masking is not a guarantee that nothing sensitive ever appears (for example text in other UI). See Clarity privacy documentation.

What we do not do

We do not sell personal data. We do not use guest or account chats for advertising. We do not require an account to try the guest quota.

Retention and your choices

Guest usage cookies expire after about a day. Signed-in chats remain until you delete them in the product. You can stop using the service and sign out at any time. If you need help with stored account data, use the Contact page.

Children

The service is not directed at children under 13, and we do not knowingly collect their information.

Changes

We may update this page when the product changes. The date at the top is the latest revision.

Contact

Privacy questions: Contact.