Privacy Policy
Last updated 19 August 2026 · calik.io
1. Who is responsible
Calik AI operates this site and the workspace at calik.io/app, and is the controller of the data described here. For anything on this page, including a request to see or delete your data, write to support@calik.io.
2. What is collected
Only what a specific feature needs. Nothing here is bought from or sold to anyone.
| When | What | Why |
|---|---|---|
| You visit the site | Standard server log data, and a one-way pseudonym derived from your IP address rather than the address itself | Serving the page, and counting requests to stop abuse of the contact and payment forms |
| You accept analytics | Google Analytics 4 measurement data: pages viewed, approximate region, device and browser, and a randomly generated identifier stored in your browser | Knowing which pages are worth keeping. Not collected at all unless you accept |
| You use the assistant on this marketing site | The messages exchanged, the language, your browser string, and the IP pseudonym above. This is the small helper widget on calik.io itself, not the workspace. Conversations in the app never reach us | Improving the answers it gives. Please do not type anything confidential into it |
| You send the contact form | Name, e-mail, company, team size and the message you wrote | Replying to you |
| You create an account | E-mail address, and the sign-in method you chose, held in Google Firebase Authentication | Being able to sign you in and to attach your plan to something |
| You pay by card | Handled entirely by Lemon Squeezy, who are the seller of record. We receive your e-mail, the plan and the order reference. Never your card number | Turning the subscription on and keeping a record of the sale |
| You pay directly (transfer, AirTM, crypto) | The e-mail you give us, the amount, and the reference you supply so the payment can be matched | Confirming the payment by hand and turning the subscription on |
No advertising networks, no data brokers, no tracking pixels beyond the analytics described above, and no profiling that produces decisions about you.
3. Your API keys, your prompts, your conversations
This is the part most people want to know about, so it is stated plainly and it is what the code actually does.
- Your API keys never reach us. They are held by your device's own encrypted storage and are read only when a request is about to be made. They are not uploaded, not synchronised to an account, not backed up to our servers, and not visible to us in any form. We never use your keys for our own requests, our own testing, or anyone else's traffic.
- Your prompts and files go straight to the provider you chose: OpenAI, Anthropic, Google, a model running on your own machine, whichever key you supplied. They are handled under that provider's terms. They do not pass through us on the way, so we do not have a copy to keep.
- Your conversations stay on your device. The workspace stores them in local storage on the machine you are using. They are not in our database. Clearing the app's data or the browser's storage deletes them, and there is no copy for us to hand back.
- We do not train on any of it, do not read it, do not sell it, and do not share it. There is no model here to train: Calik AI orchestrates other companies' models and does not build its own.
What that leaves us holding is in the table above: an e-mail address, a plan, and the record of a payment. That is the whole of it.
4. Cookies and analytics
The site sets as little as it can get away with:
- Necessary. A cookie remembering your language, plus a session cookie while you are signed in to an admin page. These are needed for the site to work and are not used to track you.
- Analytics. Google Analytics 4 sets identifiers in your browser. These load only after you accept the banner. Decline, and the analytics script is never requested; your choice is remembered in your own browser and you can change it any time from the link in the footer.
There are no advertising or social-media cookies on this site.
5. Why we are allowed to process it
- Performing a contract: your account, your subscription, and the payment records that go with them.
- Consent: analytics, and nothing else. Withdrawable at any time, as easily as it was given.
- Legitimate interests: keeping the service up and defending it from abuse, and answering the message you sent us. Balanced against your interests, which is why the abuse counters hold a pseudonym rather than your address.
- Legal obligation: keeping the accounting records that tax law requires.
6. Who else sees it
| Processor | For | Where |
|---|---|---|
| Lemon Squeezy | Card payments, as seller of record | United States |
| Google (Firebase, Analytics) | Accounts, plan state, site analytics | EU / United States |
| The hosting provider | Serving the site and holding its database | See the host's own notice |
| Google (Gmail) | Delivering the contact form to us | United States |
The model providers you connect are deliberately not in this table. They are not our processors: you contract with them directly with your own key, and what you send them is between you and them.
Where data crosses a border, the transfer relies on the receiving company's standard contractual clauses. Nobody in this table is permitted to use your data for their own purposes.
7. How long it is kept
- Assistant conversations: 12 months, then deleted.
- Contact form messages: 24 months, so we can pick up a thread you started.
- Account and subscription records: for as long as the account exists, then as long as tax law requires the invoice.
- Abuse counters and pseudonymised request data: days, not months.
8. Your rights
You can ask for a copy of what is held about you, for it to be corrected, for it to be deleted, for processing to be restricted, and for your data in a portable form. Where processing rests on consent, you can withdraw it without giving a reason. Where it rests on legitimate interests, you can object.
Write to support@calik.io and you will get an answer within 30 days. Most of what people ask for (conversations, prompts, API keys) is not ours to return or delete: it is on your own device, under your control, and removing the app's data removes it. If our answer does not satisfy you, you may complain to the data protection authority for the country you live in.
9. How it is protected
The site is served only over HTTPS with strict transport security. Administrative pages are behind a hashed password with rate limiting, session timeouts and browser binding. Payment webhooks are signature-verified before anything is written. Licence keys are stored as hashes, never in the clear, and request addresses are stored as keyed pseudonyms. No system is perfect; if you find a weakness, security.txt says how to report it.
10. Children
Calik AI is not aimed at children and accounts are not knowingly created for anyone under 18. If you believe a child has an account, write to us and it will be removed.
11. Changes
If this policy changes in a way that matters, the date at the top changes, and for anything material, account holders are told by e-mail before it takes effect.