KelvinAI includes the desktop app, the mobile app, the web version and the account service behind them ("the server" below). This policy explains what stays on your own devices, what is stored on the server, who receives what, how long it is kept, and how to delete it.
When you use AI on your computer for code and files, your project files, your Code and assistant conversations and your local settings stay on your own computer. Things shared across devices or with other people — your account, chats, Moments and cloud drive — are stored on the server.
Two lists come with this policy: Personal Information Collected lists, item by item, what we collect, what it is for and how long it is kept; Third-Party Sharing lists the providers that receive your information.
Account information: your username and a salted hash of your KelvinAI account password (not that password in plaintext), and the nickname, avatar, gender, region and bio you choose to fill in. If you sign in with or link a Google account, we store your Google user id and verified email so we can recognise your account when you sign in. If you use Sign in with Apple in the iOS / iPadOS app to sign in or link an Apple account, we store only the user identifier Apple assigns to this app and the authorization token Apple returns. The token is stored encrypted and used only to ask Apple to revoke the authorization when you delete your account or unlink Apple, after which it is deleted. We don't ask Apple for your name or email and don't store them.
Phone number: under Chinese regulations, users in mainland China need to link a phone number before using AI or sending messages; until then, signing in, reading your chat history, topping up, deleting your account and reporting all keep working. Signing up in mainland China starts with verifying your phone number, then setting a username and password. Each phone number can be linked to one account and can be used to sign in and to reset your password; accounts elsewhere can link one if they wish, and can unlink it. A sub-account can verify once with the member's own phone number; we keep only a verification record, and that number cannot be used to sign in to it.
Consent records: when you agree to the Terms of Service and Privacy Policy, we record which version you agreed to, when, where (for example the sign-up or sign-in page), which rules applied to your account at that moment (mainland China or elsewhere) and the kind of device (for example iPhone, Android or computer), to show which version you agreed to. If you choose not to agree to a new version for now, we record that choice too.
Account security records: the time and type of actions such as deciding which rules apply to your account, linking / changing / unlinking a phone number, agreeing or not yet agreeing to the policies, linking or unlinking a third-party sign-in, and changing your password. Phone numbers appear here only masked (for example 138****0000) plus a digest that cannot be turned back into the number.
Devices: the names, platforms and last-seen times of the phones and computers you sign in on, so your phone can find your computer and your devices stay in sync.
Chats and collaboration: private and group messages (text, images, files, voice, location), contacts and groups, Moments posts and comments, cloud-drive files, cloud docs and tables, and your organisation's (OA) approvals, notices, attendance and payslips. They are stored on the server so they can reach other people and sync across your devices.
Mail accounts: when you add a mailbox, its address, label, provider and account icon sync with your KelvinAI account. Mail app passwords or OAuth access/refresh tokens are stored in encrypted credential envelopes so your devices can connect. For browser authorization, the relay handles the authorization code, exchanges it with the mail provider, and decrypts tokens for renewal or supported revocation. Encrypted storage does not mean the relay cannot access those OAuth tokens.
AI records: AI colleagues' replies in group chats are stored as group messages; Cloud Muse (the cloud assistant) keeps its workspace, conversations and generated files on our cloud machines, and when it goes online we record the domain, port, traffic and duration (no URL paths, no page content) to prevent abuse; a conversation you choose to "Share" is stored behind its link; when the AI places a phone call for you, we store the number, the callee's name, the task and the text record of the call so it can report back to you; when you publish a web report with Report Hub ("一图流" / card reports), the page, its title and what visitors submit on it are stored on our Report Hub service.
Usage and purchases: for each use of an official model, the model name, token counts and credits spent; top-up records (credits, amount, currency, part of the order number).
Notifications: if you turn on new-message notifications on iPhone / iPad, the push token the system assigns.
Feedback: what you write in the desktop app's Feedback, screenshots, and diagnostic logs if you choose to attach them (keys, tokens and other secrets are removed automatically before sending).
Visitor region and the rules for your account: we use an offline IP database kept on our own servers (DB-IP) to tell whether you are in mainland China or elsewhere; the lookup happens on the server itself. This decides which sign-in methods the sign-in page shows, which models are available and whether generated images and videos get the “AI生成” (AI-generated) mark, and it is also used once to decide which rules apply to your account (mainland China or elsewhere): usually from your IP address when you sign up or when the account is first used, and as mainland China when it can't be told; a sub-account follows its main account. If this was decided wrongly, contact us and we will check and correct it.
Device time zone and App Store region: when you sign in, sign up, link a phone number or refresh your account details, the app sends your device's time zone, and on iPhone / iPad also the country or region of your App Store. A mainland China time zone or a mainland China App Store also counts as mainland China; these two only ever make the result mainland China, never elsewhere, and are not stored after use.
If an account under the rules for elsewhere is used from a mainland China IP address on 7 days within 30 days, it moves to the mainland China rules and does not move back; for this we record only the dates of those visits (not the IP address) and delete them after 35 days.
IP addresses are generally not stored — only organisation attendance check-ins and smart-device service requests record the source IP, and phone sign-in rate limits keep it for about an hour.
AI conversations and files on your computer: Code and assistant conversations, your code and local files are not stored on the server. When your phone views or directs your computer remotely, the content is relayed through the server encrypted.
On-device mail: the native mobile and desktop apps connect directly to the mail provider you select. Message bodies, attachments and mail indexes are not part of mail-account sync. Devices may keep indexes, drafts and outgoing content needed for the feature; the mail provider keeps messages under its own rules. Adding a mailbox or reading mail does not by itself send it to AI. Mail or attachments you send to AI, and relevant content or tool results from mailbox work or automatic tasks you request, are processed by the selected AI service and may remain in the corresponding conversation or task records.
The text of official-model conversations: when you use an official model, what you send to the AI passes through the server to the model provider and the server records only usage. Only when investigating a rare "context too long" failure is that one request kept for diagnosis, and it is deleted automatically within 48 hours.
Voice: for voice input, voice calls with AI colleagues and read-aloud, audio and text go through the server to the speech provider in real time; the server keeps no recordings or call transcripts. Call records you choose to save stay on your own device.
Your own API keys: model keys you enter in the desktop app stay on your computer, and requests made with them go straight from your computer to that provider.
Card numbers: top-ups are processed by Stripe (cards, Alipay, WeChat Pay) or Apple In-App Purchase; we never see or store your card number. For Apple purchases we only receive Apple-signed transaction records to confirm the top-up.
We use no third-party analytics, advertising or crash-reporting tools, we do not sell your personal information, and we do not use it for advertising.
To provide a feature you use, the content it needs goes to the matching provider, only for that feature:
AI model providers: for official models, image reading, unread-message summaries, voice-input tidying, picture generation and other AI features — the messages, images, files and tool results you send to the AI (some requests pass through a relay gateway we run ourselves before reaching the model provider).
AI services are currently provided by: Zhipu AI, Alibaba Cloud, Volcano Engine, Baidu AI Cloud, DeepSeek, Moonshot AI (Kimi), StepFun, Anthropic, OpenAI, xAI, MiniMax, Xiaomi, ElevenLabs, Brave. Which one receives your content depends on the model and feature you use.
Before your content first goes to AI (chatting with AI, voice input and voice-to-text, asking AI about a screenshot, unread summaries, mentioning an AI colleague in a group, and so on), KelvinAI tells you which providers will receive it and asks you to choose "Agree" or "Not now". With "Not now", these AI features stay off while chats with people and Office keep working. After agreeing you can review or withdraw at any time under AI providers (in Settings on the computer, under Me on the phone). Tasks you have set up to run on their own on your computer (scheduled tasks, connected chat channels) hand content to AI as you set them up and do not ask again each time they run. We do not use what you send to AI to train models.
Speech providers: audio and text for voice input, voice calls and read-aloud.
Map providers: coordinates and search terms when you share a location or look up places, routes or weather; on Android, after you allow location, the map provider's location component gets your position.
Search, image and video providers: web-search terms, and the descriptions and reference images for pictures and videos you ask for (picture requests reach the image-generation provider through a relay gateway we run ourselves).
Cloud storage providers: chat files and cloud-drive files are kept in a cloud provider's object storage.
Mail providers: your chosen mailbox provider (such as Outlook / Hotmail, Gmail, iCloud, QQ or NetEase) processes the address and credentials needed to connect, recipients and senders, subjects, bodies and attachments. Devices connect directly to send and receive mail. With browser authorization, the relay also exchanges authorization codes, tokens and mailbox identity information with the provider to authorize, renew or revoke access.
Content-safety provider: see "Content review" below.
SMS providers: your phone number and the verification code when you sign up, sign in, link or change a phone number.
Cloud telephony providers: when the AI places a call for you, the number, opening line and call content (the other side's speech is turned into text for the AI to answer).
Payments: Stripe receives your account number and the top-up tier you pick; Apple handles In-App Purchases.
Push: iPhone / iPad new-message notifications are delivered by Apple's push service and include the sender's name and the first few words of the message (up to 60 characters).
Operator notifications: operator notifications (account name and top-up amount) are sent to the messaging tool our operations staff use; alerts about new sign-ups and unusual smart-device or Cloud Muse network activity also include the account name involved.
When required by law or by a competent authority acting lawfully.
The name of each provider, what it is used for and which information is involved are listed in Third-Party Sharing.
Public information that others can see and that stays up is checked automatically by a content-safety provider before it is shown: nicknames, avatars, bios, regions, Moments covers, group names and notices, the names / titles / avatars of bots and AI colleagues, and mini-app names / descriptions / icons / share details. The check record (result, category and the first few words) is kept for 180 days.
Private and group messages and Moments posts are not reviewed automatically. Reported content is reviewed by us by hand — see the Terms of Service.
When you report an AI-generated reply, image, video or audio, the following are sent to us with the report so we can check it: the reply's text (up to 4,000 characters) and its full length, the model that produced it, which feature it came from, the IDs your device uses for the conversation and the message, the time of the reply, and the AI colleague's name when you are chatting with one. For images, video and audio only how many there are, the file name and any web link it already has are included; if it is a chat file that is already on our servers, that file is attached as evidence and kept for 90 days. Files stored on your own devices are not uploaded.
Account, phone number, consent records, chat, Moments, cloud-drive and organisation data is stored on servers in mainland China. When you use the Hong Kong node, your requests are received and processed by servers in Hong Kong, China, and this data is likewise saved over an encrypted connection to the servers in mainland China. Chat files, cloud-drive files and avatars are stored at the node you use (mainland China or Hong Kong, China).
Chat messages: deleted automatically after 90 days. Chat files: deleted automatically after 120 days (except those used in approvals, saved stickers or Moments).
Records of calls the AI placed for you: deleted after 90 days. Content-review records and Cloud Muse network records: deleted after 180 days.
Mail configuration and encrypted credentials: kept until you remove the mailbox from KelvinAI or delete your KelvinAI account. Removal clears these fields and keeps a sync deletion marker without the address or credentials until account deletion. Browser-authorization sessions expire after 10 minutes; completion clears the temporary token envelope, and remaining session state is removed during service cleanup or account deletion. Removing a mailbox does not delete messages held by the mail provider or automatically revoke its authorization.
Cloud drive, docs and tables: deleted items stay in the trash for 7 days, then are removed for good. Phone sign-in codes: deleted within 24 hours. Per-model usage statistics cover roughly the last 70 days.
Phone number: kept while it is linked, deleted when you change or unlink it or delete your account. Consent records, the rules for your account and account security records: until you delete your account (what happens to account security records then is in the next section). Dates of mainland China visits used to decide the rules: deleted after 35 days.
Account details, credits and top-up records: until you delete your account. Contacts and groups, Moments, organisation data, feedback and share links: no automatic deletion; what happens to them when you delete your account is in the next section.
Mobile app and web version: Me → Delete account; desktop app: Settings → Account → Delete account. Type your username to confirm. It takes effect immediately and cannot be undone.
Right away: the account can no longer sign in and every device is signed out; your nickname, gender, region, bio, email, linked phone number, phone verification record and third-party sign-in are cleared on the spot, and that phone number can be used to register again.
Then deleted automatically (usually within a minute): remaining credits, sub-accounts and bots (with their data), credit ledger and usage records, the names of your computers and phones; your Moments (posts, comments, likes, cover and their pictures and videos), cloud drive (including the trash), cloud docs and tables only you can see, AI colleagues, share links, avatar, contacts and block list, saved stickers, push tokens, consent records, records of calls the AI placed for you, feedback, mini apps you made and your data in mini apps, web reports you published with Report Hub ("一图流" / card reports) together with what visitors submitted on them, smart-device bindings, conversations and memories from the phone's former "Chat" tab, and Cloud Muse workspaces (complete once the cloud machine has wiped them). Chat files you uploaded that nobody else can still reach are deleted too. Last, the account itself is deleted and your username becomes free to register again. Content kept on your own computers and phones (Code and assistant conversations, AI colleagues' memories and so on) is not on the server and is not touched by account deletion; you can delete it on the device.
Mail data: account deletion also removes the server-side mail configuration, encrypted credentials, sync records and browser-authorization sessions. Messages held by the mail provider are unaffected, and provider-side authorization must still be revoked there. Delete downloaded or separately saved mail and attachments on the device or storage location where you saved them.
Kept for other people: messages you sent in private and group chats stay with the other people, with the sender shown as "deleted"; your account name in their quotes of you, forwarded chat records and group system notices is replaced with "deleted" too. These messages and their files are removed on their normal schedule (messages after 90 days, files after 120 days). Groups you created pass to the earliest-joined member (an organisation's groups pass to an organisation admin), and a group where you are the only member is deleted; files you added to a group's files stay with the group. Cloud docs and tables you shared with others pass to another collaborator.
Organisations: an organisation you created passes to its earliest-joined admin (or, with no admin, its earliest-joined member) if it has other members, and is deleted entirely if you are its only member; you leave every organisation you are in, and approvals you started that are still pending are withdrawn. While an organisation remains, its approvals, reports, notices, attendance and payslips are the organisation's business and employment records and stay with it, with your name shown as "deleted".
Kept for accounting, safety and legal reasons: Apple purchase transaction ids (with only an account number left); account security records (including which policy versions you agreed to), switched to an anonymous code that can't be traced back to you and deleted within at most 180 more days; content-review records and Cloud Muse network records until their 180-day limit above; records of reports we handled (the content you sent along when reporting AI output is deleted, leaving only the reason, the model, the feature, the text length and the time). We also keep a deletion record (account number, time, which steps finished) with no personal details.
Share links created before 14 October 2026 did not record who shared them, so they cannot be deleted automatically with the account; to have one removed, send us the link by emailing kelvin12399@icloud.com.
View and edit: change your nickname, avatar and other details in Me → Profile.
Delete: you can delete your own Moments posts and comments, cloud-drive files, docs and tables; for deleting your account see above.
Mail controls: remove a mailbox configuration in the desktop app's mail account management. Removing configuration and revoking provider authorization are separate actions. Revoke authorization in the mailbox settings either calls a supported revocation endpoint or opens the provider's page for you to finish (Outlook / Hotmail requires action on that Microsoft page). Revocation does not also remove the configuration or existing local records. Disable mail app passwords with the mail provider.
Withdraw permissions: location, microphone, camera and notification access can be turned off at any time in your system settings.
Withdraw consent: you can withdraw your consent to this policy at any time. Signing in, chat and AI all depend on the information above, so withdrawing consent is done by deleting your account (mobile app and web version: Me → Delete account; desktop app: Settings → Account → Delete account), or you can email kelvin12399@icloud.com and ask us to do it for you. After that we can no longer provide these services, but processing done before you withdrew is not affected.
To ask what we hold about you, get a copy, have it deleted, or ask about this policy, email kelvin12399@icloud.com; we usually reply within 15 business days.
KelvinAI is meant for adults. Users under 18 should use it with a parent's or guardian's consent and guidance. We do not knowingly collect children's personal information; if a parent finds that a child signed up without consent, contact us and we will delete the account.
When this policy changes we update this page and the date at the top; for important changes we tell you in the app and ask you to confirm again when you sign in.
Email: kelvin12399@icloud.com