Privacy

Swirl is an AI chat app. That means your conversations, your files and your account details pass through us and through the companies we use to run the service. This page says exactly what that involves.

Last updated: October 2026. Swirl runs at swirlai.app. The contact address for anything on this page is hello@swirlai.app.

What we collect

• Account details. Your email address, and if you sign in with Google, the name and picture that come with that account. Authentication is handled by Clerk; we never see your password.
• Your conversations. The messages you send, the replies you get back, the documents and files you upload, and the artifacts the app builds from them. This is the product — we could not provide it without keeping it.
• Memory. If memory is on, we store facts and preferences the app works out from your conversations, and write them into a memory store so a later chat can pick them up. Switch memory off, or clear it, and it stops.
• Integrations. The connections you authorize — MCP servers, skills, and toolkits from our integrations catalogue — along with the credentials needed to reach them. Those credentials are encrypted before they are stored, and we never read what you do inside a connected service.
• Usage and billing. Which model ran each turn, what it cost, and your plan and payment status. Payments are handled by Dodo Payments, who act as Merchant of Record; we receive a record of your plan and what you have used, not your card details.
• Diagnostics and analytics. Technical logs (errors, latency, request metadata) in Axiom, and product analytics events in PostHog. PostHog receives a stable account identifier and may hold your name and email as person properties so product and Dodo billing records can be joined correctly.

Who else sees it

We do not sell your data, and we do not use your conversations to train our own models. The service is built on these processors, and each one gets only what it needs to do its job:

• Clerk — sign-in, accounts and sessions.
• Convex — the database and backend that hold your chats, files, memory and settings.
• Cloudflare — hosting and the content delivery network that serves the site.
• OpenRouter — routes your prompt to the model provider you are using, and reports back what that call cost.
• Model providers — the companies that actually generate the reply. Your prompt reaches them.
• Dodo Payments — checkout, subscriptions, invoices, refunds, payment recovery, and checkout-recovery messages, as Merchant of Record. Recovery messages include unsubscribe controls.
• Resend — transactional, product, and promotional email when you have subscribed to the relevant category, including delivery, open, click, bounce, complaint, and suppression status.
• Composio — the hosted integrations catalogue.
• Exa — web search, when you use it.
• Supermemory — the memory store.
• PostHog and Axiom — product and billing analytics, session diagnostics, and technical monitoring.

Locked chats and incognito mode

Two parts of the product are built specifically to keep a chat away from being retained. A locked chat only runs on models that have at least one endpoint with zero data retention — we check OpenRouter's list of those endpoints before letting a locked chat run, and the check is refreshed regularly, because providers change what they offer. If nothing qualifies, a locked chat is refused rather than quietly downgraded.

Incognito mode does not write memory, does not appear in your chat history, and is swept rather than kept. It is the closest thing to leaving no trace.

Where it is kept

Your data is stored in the United States, in Convex and Axiom infrastructure. Payments are processed by Dodo Payments, which is also where your billing records are held. Model providers are distributed globally, so a prompt sent to a model may be processed in whichever country that provider operates from — including outside the United States.

How long we keep it

Conversations, files, memory and settings are kept for as long as your account exists, so you can pick up where you left off. Incognito threads are swept. Diagnostics and analytics are kept in aggregate for a limited period and then discarded. Billing records are kept for as long as tax and accounting law requires.

What you can do

Inside the app you can delete individual memories, clear your memory entirely, delete chats, documents, folders, skills and integrations, turn memory off, and use incognito mode. If you want your account and everything attached to it removed, email hello@swirlai.app and we will do it. We will also correct anything that is wrong about you, and tell you what we hold if you ask.

Depending on where you live, you may have rights to access, correct, export or erase your personal data, or to object to some of our use of it. Writing to us is the route to exercise any of them.

Cookies

We use a cookie to keep you signed in. Analytics and diagnostics use pseudonymous identifiers rather than cookies, and we do not run advertising or cross-site tracking.

Children

Swirl is not for people under 13, and we do not knowingly collect information from children. If you think a child has created an account, tell us and we will remove it.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page. We will not retroactively apply a change that reduces your rights.