Privacy Policy
Effective October 9, 2026 · Version 2026-10-09
In short (the full policy below controls):
- We collect what we need to run accounts, enforce limits and keep the Service secure: your username, email, a hashed credential (never your raw password), your IP address and basic usage data.
- Your conversations are stored: in your browser so you can reopen them, and we and our providers may store and retain copies as described in our Terms of Service. Your prompts and outputs are sent to third-party AI model providers to generate responses.
- We do not sell personal information, and the Service has no advertising, analytics or tracking scripts.
- You can ask us to access, correct or delete your data at contact@redmodel.ai.
1. Who we are and what this covers
This Privacy Policy explains how RedModel ("RedModel", "we", "us") collects, uses, shares and protects personal information when you use the RedModel website, chat, API and related services (the "Service"). It forms part of, and should be read with, our Terms of Service. RedModel is intended for security professionals testing property they own or are authorized to test, and is not directed at children.
You can reach us about privacy at contact@redmodel.ai.
2. Information we collect
2.1 Information you give us
- Account details. Your username and email address. If you register, you also choose a password. Your password is processed in your browser (a key is derived from it with a salt) and only that derived key is sent to us; we then hash it again before storing it. We never receive or store your raw password. We also record that you accepted the Terms, with the version and time.
- API keys. The name you give a key, a short non-secret prefix, a hash of the key and when it was created and last used. The full key is shown to you once and is not stored.
- Content and conversations. Everything you submit to or generate through the Service: prompts, messages, files, code, descriptions of systems and test targets, findings and model outputs. Your conversations are stored, as described in Section 7. Content can contain personal or confidential information, so please do not submit anything you are not authorized to share.
- Communications. Anything you send us, for example by email.
2.2 Information collected automatically
- IP address and request data. Your IP address, and standard browser and device details such as your user agent, are processed when you use the Service. We store a shortened user-agent string with each sign-in session.
- Usage and quota data. Counters of free messages used, tied to a random browser identifier and to your IP address; when you last signed in; when an API key was last used; and security and rate-limiting records.
- Logs. Our servers and providers may log requests and errors, which can include IP addresses and technical details.
2.3 Cookies and browser storage
We use only what is needed to run the Service. We do not use advertising or analytics cookies.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
redmodel_session | Cookie | Keeps you signed in. Holds a random token; we store only a hash of it. | Up to 30 days, or until you sign out |
redmodel_sid | Cookie | A random browser identifier used to count free messages and apply rate limits for visitors. | 1 year |
redmodel-conversations-v1 | Browser local storage | Your conversations (your messages and the model's replies), saved in your browser so you can reopen them. We and our providers may also store copies (Section 7). | Until you delete it |
The cookies are HttpOnly and SameSite, and are marked Secure when you connect over HTTPS. You can clear cookies and local storage in your browser at any time; clearing the free-message identifier does not remove our server-side records.
2.4 Information from others
We do not buy personal information. The AI model providers we use return generated responses to us, and we may receive information about misuse from affected parties or authorities.
3. How we use information
- to provide, operate and maintain the Service, including generating responses and managing accounts and API keys;
- to authenticate you and keep the Service secure;
- to apply free-tier and rate limits, and to detect, investigate and prevent misuse, including suspending or terminating accounts under our Terms;
- to improve and develop the Service, our models and our products, including by training and fine-tuning models using Content, as described in the Terms;
- to communicate with you, for example to answer your questions or send service notices;
- to comply with law, respond to legal process, and protect the rights, property and safety of RedModel, our users and others; and
- for other purposes you agree to or that are described to you when we collect the information.
4. Legal bases (EEA, UK and similar regions)
Where the law requires a legal basis, we rely on: performance of a contract (providing the Service you asked for); legitimate interests (security, abuse prevention, enforcing our Terms, and improving and developing the Service), balanced against your rights; legal obligation; and consent where we ask for it, which you can withdraw at any time.
5. How we share information
We share personal information only as follows. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- Service providers. Cloud, hosting and infrastructure providers (which may change over time and may be located in different countries) and the AI model providers described in Section 6. They process information on our behalf or under their own terms.
- Legal, safety and enforcement. To comply with law or legal process; to investigate or respond to suspected misuse, including unauthorized testing or other unlawful activity; to protect our rights, property and safety and those of our users and others; and to report unlawful activity to authorities or affected parties.
- Business changes. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of it.
- With your direction. When you ask us to share information.
- De-identified or aggregated information that does not identify you.
6. AI model providers and your Content
The Service sends your prompts and conversation context to third-party AI model providers, and receives responses back, so that RedModel can answer you. Those providers process your Content under their own terms and privacy practices, which we do not control, and they may retain it. Do not submit information you are not authorized to share or are not comfortable having processed and retained by us and by those providers. Our own rights to retain and use Content are set out in Section 7 of the Terms.
7. How long we keep information
- Account information: for as long as your account exists, and afterwards as we consider necessary for security, abuse prevention, legal compliance and disputes.
- Sign-in sessions: up to 30 days; expired sessions are removed.
- Free-message counters: per-IP counters are removed after about 2 days, and per-browser counters after about 90 days.
- Conversations and other Content, logs and related records: your conversations are stored, and we and our providers may retain copies for as long as we consider necessary or useful, as described in the Terms, including after you stop using the Service or delete them from your browser.
- Your browser's copy of your conversations stays on your device until you delete it.
8. Security
We use measures designed to protect personal information, including hashing your password in your browser and again on our servers, storing only hashes of session tokens and API keys, access controls and rate limiting. No system is perfectly secure, so we cannot guarantee absolute security. Keep your password and API keys confidential, and tell us promptly if you suspect unauthorized access.
9. Your choices and rights
- Local controls. You can delete your browser's chat history and cookies, sign out, and revoke API keys in your account.
- Requests. Email contact@redmodel.ai to ask us to access, correct, delete or export your personal information, to object to or restrict certain processing, or to close your account. Password reset is not available yet, so account closure is also handled by email. We may need to verify your identity, and we may keep information we are required or permitted to retain, for example for security, legal compliance or abuse prevention, and Content we already hold under Section 7 of the Terms, to the extent the law allows.
- EEA, UK and similar regions. You may have rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent, and the right to complain to your local data protection authority.
- US state privacy laws (for example California and Texas, where they apply). You may have the right to know and access the personal information we hold, to delete or correct it, to receive a copy, to opt out of sale, sharing and targeted advertising (we do none of these), and to appeal our decision; we will not discriminate against you for exercising your rights. You can use an authorized agent, and we will respond within the time the law requires.
- Do Not Track and Global Privacy Control. We do not track you across other sites, so there is nothing for these signals to opt you out of.
10. International transfers
We may host and process information in the United States or in any other country where we or our service providers operate, and our hosting arrangements may change over time. If you use the Service from elsewhere, your information may be transferred to, and processed in, those countries, where data protection laws may differ from yours. Where the law requires, we use appropriate safeguards for these transfers.
11. Children
The Service is for people aged 18 or over and is not directed to children. If we learn that we collected personal information from a child, we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will change the version and date at the top and, where practical or required, notify you. Continuing to use the Service after an update means the updated policy applies.
13. Contact
Questions, requests and complaints about privacy: contact@redmodel.ai.