Privacy Policy

Tiferet Labs is an independent AI research group based in Melbourne, Australia. Our flagship product is Eliana — a cognitive-emotional AI companion available at tiferets.com. We are not a corporation; we are a small team of researchers and developers committed to building AI that genuinely serves people.

For privacy-related questions, contact us at: ezaz.ruxu@gmail.com

Account Information

When you create an account, we collect your email address. If you sign in with Google, we receive your name and email from Google. We do not receive your Google password.

Messages and Conversations

Your messages to Eliana and her responses are stored in our database to provide conversation history and continuity. All messages are encrypted at rest using AES-256 encryption with a unique key derived from your user ID. We retain message data for up to 15 days, after which it is automatically deleted.

Usage Data

We track how many messages you send per day and per session to enforce fair-use limits. This data helps us maintain service quality for all users and manage our infrastructure costs.

Technical Data

Our servers log standard HTTP request data (IP addresses, browser type, request timestamps) for security and debugging purposes. This data is not shared with third parties and is retained for a maximum of 30 days.

• We do not collect payment information (we have no paid plans currently)
• We do not track you across other websites
• We do not sell your data to anyone, ever
• We do not use your conversations to train AI models
• We do not use advertising or ad tracking of any kind

We use your data solely to:

• Provide and maintain the Eliana chat service
• Authenticate your account securely
• Display your conversation history within sessions
• Enforce daily usage limits fairly across all users
• Detect and prevent abuse or security threats
• Debug technical issues when they arise

We use the following third-party services to operate tiferets.com:

Supabase

We use Supabase for authentication and database storage. Your account data and encrypted messages are stored on Supabase's infrastructure. Supabase is SOC 2 Type II certified. See their privacy policy at supabase.com/privacy.

Google OAuth

If you choose to sign in with Google, Google's authentication service handles your login. We only receive your name and email. See Google's privacy policy at policies.google.com/privacy.

hCaptcha

We use hCaptcha to prevent automated abuse on login and signup forms. hCaptcha processes data necessary for bot detection. See their privacy policy at hcaptcha.com/privacy.

xAI (Grok) and OpenAI

Eliana's responses are generated using xAI's Grok and OpenAI's models. Your messages are sent to these services for processing. They are used only to generate responses and are not used to train their models under our agreements. See their respective privacy policies for details.

Vercel and Fly.io

Our website and backend are hosted on Vercel and Fly.io respectively. Standard server logs may be collected by these platforms as part of hosting operations.

We take data security seriously. Measures we have in place include:

• All messages encrypted at rest (AES-256)
• All data transmitted over HTTPS/TLS
• Authentication via Supabase's secure JWT system
• Row-level security policies on all database tables
• Service role keys never exposed to the frontend
• Automatic message deletion after 15 days

No system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly by emailing us at ezaz.ruxu@gmail.com.

You have the right to:

• Access — request a copy of data we hold about you
• Deletion — request that we delete your account and all associated data
• Correction — request that we correct inaccurate data
• Portability — request your data in a portable format
• Objection — object to how we process your data

To exercise any of these rights, email us at ezaz.ruxu@gmail.com. We will respond within 30 days.

Conversation messages are automatically deleted after 15 days. Account information (email, authentication data) is retained for as long as your account exists. If you delete your account, all associated data is permanently removed within 30 days.

Tiferet Labs services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this privacy policy or your data, please contact us: