Effective date: March 12, 2026
DHU Labs ("the Service") is operated by TeamWeaver LLC, doing business as DHU Labs ("we", "us", "our"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.
| Data | Purpose | Retention |
|---|---|---|
| Account information — email address, display name, hashed password | Authentication and identifying your account (registration is invite-only) | Stored until you request account deletion |
| Conversation content — your questions and AI responses | Generating responses, maintaining conversation history so you can continue chats | Stored on our server until you delete the conversation or request account deletion |
| Code block metadata — programming language and position of code blocks within AI responses | Powering the code artifacts panel (a browsable view of code blocks in your conversations) | Stored alongside conversation content; deleted when the conversation is deleted |
| Session cookie — a random identifier stored in your browser | Maintaining your authenticated session and associating your conversations with your account | 7 days (renews on each visit) |
| Usage metrics — token counts, model used, endpoint called, estimated cost | Enforcing per-user usage quotas and internal service monitoring | Stored on our server; aggregated in admin dashboard |
| IP address | Rate limiting (preventing abuse) and security audit logging | In server logs only; not stored in a database |
| Custom instructions — optional text you provide in Settings | Personalizing AI responses per your preferences | Stored with your account |
| Preferences — theme choice, mode selection, provider choice | Remembering your UI settings | Stored with your account |
| Memory facts — short factual statements automatically extracted from your conversations (e.g., "User is a software engineer") | Personalizing AI responses by remembering relevant context about you across conversations | Stored with your account; you can view and delete individual memories in Settings at any time (max 50 per user) |
| Subscription and billing data — subscription tier, Stripe customer ID, subscription status | Managing your subscription and enforcing usage quotas per tier | Stored with your account; payment details (card numbers) are held by Stripe, not by us |
| Password reset tokens — temporary tokens generated when you request a password reset | Verifying your identity during the password reset process | Expire after 1 hour; single-use; invalidated when a new reset is requested |
The Service relies on a small number of third-party providers to function. We share only the minimum data necessary with each:
When you send a message, your conversation content is transmitted to an AI provider for processing. This is necessary to generate responses. The Service currently uses the following AI providers:
The AI may also perform web searches via Anthropic's built-in web search tool. When this occurs, search queries derived from your conversation are executed through Anthropic's search infrastructure. We do not control which search providers Anthropic uses.
When using the comparison feature, the same prompt may be sent to two model configurations simultaneously.
If you subscribe to a paid tier, your payment is processed by Stripe. We send Stripe your email address and subscription tier selection. Stripe collects and stores your payment details (card number, billing address) directly — we never receive or store your full payment information. See Stripe's Privacy Policy.
During account registration, the Service may use Cloudflare Turnstile to verify that you are a human. This sends your IP address and browser interaction data to Cloudflare for analysis. See Cloudflare's Privacy Policy.
If you request a password reset, your email address is shared with our email delivery provider (currently Resend) solely for the purpose of delivering the reset email. No other data is shared with this provider.
The Service offers an optional voice input button. If you use it, your browser's built-in speech recognition processes your audio. We never receive or store your audio. We only receive the transcribed text that your browser produces. However, your browser may transmit audio to its vendor for processing — for example, Chrome sends audio to Google's servers. This is governed by your browser vendor's privacy policy, not ours. Voice input is entirely optional; you do not need to use it.
The Service supports programmatic access via API tokens for authorized integrations. If a third-party tool or agent accesses the Service on your behalf, it may read, create, or export conversations in your session. We are not responsible for how third-party tools handle data they retrieve from the Service.
Conversation data and session information are stored in a SQLite database on the server that runs the Service. The Service uses HTTPS to encrypt all data in transit between your browser and our server.
Database backups are stored on Cloudflare R2 (an S3-compatible storage service) for disaster recovery. Backups are retained for up to 30 days and then automatically deleted.
Provider API keys stored by administrators are encrypted at rest using AES-256-GCM before being written to the database.
We implement the following security measures:
No system is perfectly secure. We take reasonable precautions but cannot guarantee absolute security.
You have the right to:
If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to access, rectification, erasure, data portability, and the right to object to processing. Our legal basis for processing your data is legitimate interest (providing the Service you requested) and, where applicable, your consent. To exercise these rights, contact us at the address below.
If you are a California resident, you have the right to know what personal information we collect and how it is used, to request deletion, and to not be discriminated against for exercising your rights. We do not sell personal information. To exercise these rights, contact us at the address below.
We comply with applicable New York state privacy and data security laws, including the SHIELD Act. If we become aware of a data breach affecting your personal information, we will notify you in accordance with New York law.
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this Privacy Policy from time to time. The effective date at the top indicates when the current version took effect. Continued use of the Service after changes constitutes acceptance of the updated policy.
For privacy-related questions, data requests, or concerns:
Email: contact@dhulabs.com