We collect only what is needed to provide and protect the service:

• • To provide, operate, and improve the Root AI service
• • To process your requests through the AI model you select
• • To maintain conversation history and the memory feature
• • To perform web searches when DeepSearch is enabled
• • To generate and edit images, music, and video from your descriptions
• • To analyze uploaded files and provide insights
• • To enforce usage limits, rate limits, and prevent abuse
• • To send essential account communications (verification, security alerts)

Root AI is built with security at every layer:

• Encrypted sessions — all traffic is served over HTTPS with secure cookies.
• Hashed passwords — passwords are never stored in plaintext.
• Private file storage — uploads are accessible only to your account.
• Hashed API keys — keys are SHA-256 hashed at rest; plaintext is shown once.
• Access controls — role-based access, CSRF protection, rate limiting, and strict input validation.
• Rotating logs — server logs are rotated daily and auto-deleted to minimize retention.

Your content is transmitted to the AI model you select at the moment you use it. Each provider has its own privacy policy, which we encourage you to review:

When you generate an API key, Root AI creates a credential that lets third-party agents (Kilo, Cline, Claude Code, and similar tools) make requests on your behalf. Important facts about your key:

• Shown once — the full key appears a single time; copy it immediately.
• Hashed at rest — we store only a SHA-256 hash of your key, never the plaintext.
• Plan-bound — your key inherits your plan's models, features, and daily limits automatically.
• Revocable anytime — revoke or regenerate from Account Settings; a revoked key stops working instantly.
• Usage logged — API requests are logged with token usage against your account for limit enforcement.

Setup guides for Kilo, Cline, Claude Code, and Anthropic SDKs are available in the API documentation.

• Session Cookies — keep you signed in securely.
• CSRF Tokens — protect against cross-site request forgery.
• Local Storage — remembers theme, voice settings, sidebar state, and composer preferences on your device.
• No tracking cookies — we do not use third-party trackers or advertising cookies.

We do not sell, rent, or trade your personal information. We share data only in these limited cases:

• AI providers — the content of a request is sent to the model provider you select to generate a response.
• Shared conversations — if you share a conversation link, anyone with the link can view that conversation until you revoke the share.
• Legal requirements — when required by law, subpoena, or a valid legal process.

• Access — view your conversations, files, memory, and account details at any time.
• Export — download conversations in Markdown, HTML, or JSON.
• Delete — remove individual conversations, files, or memory entries yourself.
• Account deletion — delete your entire account, including all data, from Account Settings.
• Memory control — view, edit, or clear everything Root AI remembers about you.
• Rectify — update your name, email, and password in settings.
• Revoke API access — revoke or regenerate your API key instantly.

Conversations, files, and memory are retained while your account is active, and are deleted when you delete them or your account. When you delete your account, deletion is processed promptly; backups and logs are removed on their normal rotation cycle. Server logs rotate daily and are auto-deleted. Voice data is not permanently stored.

Root AI's servers may be located outside your country, and the AI providers we use process requests on their own infrastructure worldwide. By using the service, you acknowledge that your data may be transferred to and processed in jurisdictions where data protection laws may differ. We take reasonable steps to protect your information regardless of where it is processed.

Root AI is not intended for children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will take steps to delete it promptly.

We may update this policy as the service evolves. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in-app or by email. Continued use of Root AI after changes take effect constitutes acceptance of the updated policy.

Questions about this policy or your data? Reach us through the Support chat on this page, on Telegram @roothk, or in-app support from the dashboard.