Privacy Policy

1) Scope

This policy covers CyberAI websites, courses and downloads, AI Tutor, CyberAI Dev, CyberAI VPN (desktop app and Chrome extension), and any other services that link to it (collectively, the "Service"). It does not cover third-party sites or services you choose to connect; review their policies separately.

2) Data We Collect

3) Where Data Comes From

• Directly from you when you create an account, enroll, or contact support.
• Automatically via cookies, local storage, pixels, and server logs.
• From payment processors when you buy a plan (metadata only).
• From CyberAI VPN clients when you sign in or connect (account and operational metadata only — not browsing content).
• Optionally from OAuth/social sign-in if you connect an account.
• From CyberAI Dev when you sign in or use available sync and integration features, limited to the Dev data described below.

4) How We Use Data

• Provide and personalize the Service, including courses, the AI Tutor, CyberAI Dev, and CyberAI VPN.
• Authenticate, secure, and prevent abuse/fraud.
• Analyze performance and improve features and content.
• Communicate about updates, changes to terms, and relevant offers (you may opt out).
• Comply with legal obligations and enforce our Terms of Service.

5) AI Tutor & Model Providers

When you chat with the AI Tutor, we process your prompts, conversation history, and usage telemetry to deliver responses, safety-check content, and improve quality. Depending on your plan and settings, we may route requests through reputable AI providers as processors (e.g., model APIs). We minimize data shared and use secure transport. We do not sell your personal information.

Enterprise/workspace settings can restrict logging or retention; contact us for a DPA.

6) CyberAI Dev: Local and Cloud Data

Local by default

CyberAI Dev keeps workspace files and paths, local indexes, terminal history, local conversations and provider credentials on your device. Provider keys are intended for protected operating-system credential storage and are not part of website sync. The app can access an approved workspace and run tools or terminal commands at your direction; that local processing does not by itself upload the workspace to CyberAI.

Cloud sync

When you sign in and use available sync features, CyberAI may receive account and device identifiers, app version and platform, last-seen time, opaque workspace metadata, configured provider names, model and token usage, server-verified cost estimates when pricing is available, safe activity summaries, selected settings, integration health and workspace associations. We do not define a special Dev retention period here; the general retention section applies until a formal schedule is published.

Providers and integrations you select

Prompts, selected context and instructions sent to an AI provider are processed under that provider's terms and privacy practices. GitHub, Vercel, Supabase and MCP servers receive the requests necessary for features you explicitly connect or invoke; Stripe processes checkout and payment data. CyberAI does not control these third parties or promise how they retain data, use model inputs for training, secure their systems or certify their services. Review the provider's settings and terms before connecting it. Local MCP commands execute on your device; remote MCP servers receive the data required by the tool call.

6) CyberAI VPN & No-Logs Policy

What we do not log

• Browsing history, DNS queries, or websites you visit through the VPN tunnel.
• Contents of your communications or files transferred over the VPN.
• Source IP addresses linked to your identity for the purpose of building activity profiles.

Minimal data we may process

• Account email, user ID, and subscription status to authenticate the app and enforce plan limits.
• Short-lived HMAC authentication tokens when you sign in from the website (expiry typically five minutes; used to link the desktop app to your account, not to log VPN sessions).
• Aggregate bandwidth or connection timestamps where needed for billing, capacity planning, or abuse prevention — not tied to the content of your traffic.
• App version and optional crash/diagnostic reports if you enable them, to fix bugs and improve reliability.

During development, some VPN features may operate in a simulated mode. Our no-logs commitment applies to production VPN infrastructure. See our Terms of Service — CyberAI VPN for acceptable use.

7) Cookies, Local Storage & Analytics

We use necessary cookies for login and session security, preference cookies (e.g., theme), and optional analytics to understand feature usage. You can control cookies in your browser; some features may not work without them.

8) Sharing & Subprocessors

We share data with vendors who help us run the Service, under contracts that limit use:

• Cloud hosting, storage, and CDN
• Payment processors and fraud prevention
• Email delivery and support tools
• Optional AI/model providers and safety filters

We may disclose information to comply with law, enforce terms, or protect rights/safety. We do not sell your personal information.

9) Data Retention

We keep personal data only as long as needed to provide the Service and for legitimate business or legal purposes (e.g., tax, security). VPN authentication tokens expire within minutes and are not retained as traffic logs. You can request deletion as described below.

10) Security

We use reasonable technical and organizational measures (TLS in transit, role-based access, least privilege, logging). No method is 100% secure; please use a strong unique password and enable device protections.

11) Children's Privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction). If we learn we've collected data from a child without verifiable parental consent, we'll delete it.

12) International Data Transfers

We may process data in countries other than where you live. Where required, we use appropriate safeguards (e.g., SCCs/DPAs) for cross-border transfers.

13) Your Rights

You may have the following rights, subject to local laws:

• Access a copy of your personal data
• Correct inaccurate information
• Delete your data (erasure)
• Port data in a usable format
• Object to or restrict certain processing
• Withdraw consent where processing relies on consent

To exercise rights, email [email protected] or use the form below. We may need to verify your identity. You may also contact your local data protection authority.

CCPA/CPRA (California)

• Right to know, delete, correct, and non-discrimination
• We do not "sell" personal information. We do not share PI for cross-context behavioral advertising.

14) Your Choices

• Update profile information in Profile Settings.
• Unsubscribe from emails via footer links or by contacting support.
• Control cookies in your browser; block analytics if desired.
• Request account deletion via our data deletion page or by emailing us.

15) Changes to this Policy

We may revise this policy as our services evolve. We'll post updates here and adjust the date above. Material changes may also be announced in-app or by email.

16) Contact Us