Privacy Policy

1. Who is responsible for your data

The controller of personal data described here is Behzad Shams, an individual trading as “AI Board” (“we”, “us”). Postal address: Unit 107, Building W3, Wasl Green Park, Dubai, United Arab Emirates. For any privacy question or request, email [email protected].

This policy covers the AI Board app at aiboard.me, the AI Board Runner you install on your computer, and the AIBoard Remote service at mcp.aiboard.me. It applies wherever you are; where a law such as the EU or UK GDPR or the UAE Personal Data Protection Law gives you extra rights, you have them too.

2. The AI Board app: your data stays with you

The AI Board app has no backend. It is a static website that runs entirely in your browser:

• Your provider API keys, chats, builds, settings and attachments are stored in your browser (IndexedDB and local storage) or in a folder on your computer that you choose, optionally encrypted with your passphrase. We never receive them.
• When you chat or build, your browser sends your prompts and any files you include directly to the AI providers you selected (for example OpenAI, Anthropic, Google or OpenRouter), or to a local model. Those providers handle that data under their own privacy policies.
• If you connect a ChatGPT or GitHub Copilot account, a small runner on your computer handles that login, and it stays in a file on your computer.
• The site has no analytics, advertising or tracking scripts, and sets no cookies. Fonts are served from aiboard.me itself.

Like any website, our web server and Cloudflare (see Who processes data for us) see technical request data when you load the site, such as your IP address, browser type and the pages requested. This is used only to deliver the site and protect it from abuse.

3. The AI Board Runner

The Runner runs on your computer and keeps its data there: project files, build history, logs and encrypted provider settings. It sends no telemetry or usage statistics to us. It connects to the internet only:

• to the AI providers you configure, with your own keys or accounts;
• to aiboard.me when you install or update it, to download the signed release;
• to mcp.aiboard.me, only if you turn on AIBoard Remote (described below).

4. AIBoard Remote: what we collect

AIBoard Remote is the one part of AI Board that runs on our servers. It needs a small amount of personal data to work:

• Account.When you sign in with Google we receive your Google account id, email address and whether it is verified. With GitHub we receive your GitHub user id and email address. We don't keep your name, profile picture or any Google or GitHub access token.
• Sign-in sessions. We store only a scrambled (hashed) form of your session and security tokens, with their creation and expiry times.
• Devices.For each computer you pair: a device id, its public key, a name (by default your computer's hostname; you can rename it), when it was added, last seen and revoked, and the Runner version and operating system while it is connected.
• Machine hint.To share the free allowance per computer, the Runner may send a one-way keyed hash (HMAC) of your operating system's machine id. The machine id itself never leaves your computer and cannot be recovered from the hash. We use it only to count free usage per computer and to spot free-plan abuse; we never use it to block paying customers.
• Pairing. While you pair a computer, we keep the IP address it connected from, to warn you if the approval comes from a different network. Pairing records are deleted after about 20 minutes.
• Connected AI apps.For each AI app you authorise (such as ChatGPT or Claude): its name and website, when you authorised it and when it last used Remote, plus hashed access tokens. We don't share your email or identity with these apps.
• Usage. A count of tool calls per account, device and month, and for recent calls a request id and timestamp. We record which tool was called, the result status and how long it took in our service logs.
• Billing(paid plans only). Paddle's customer and subscription ids, your plan, the subscription status and renewal dates, and records of refunds or chargebacks. Paddle holds your name, email, address and payment details; we never see your card number.
• Messages you send us. If you email us, we keep the conversation so we can help you.

5. The content of your tool calls

When an AI app uses your computer through Remote, the request (for example “read this file”) and the result (the file's contents, a command's output, a screenshot) pass through our relay. Please understand how that works:

• Traffic is encrypted in transit (HTTPS / TLS). It is not end-to-end encrypted: our relay, and Cloudflare in front of it, process the content in memory to deliver it.
• We do not store the content of tool calls or results, do not log it, and do not look at it, sell it or use it to train AI models. It exists on our servers only for as long as it takes to pass it on.
• The AI app you connected receives the results and handles them under its own privacy policy.

Only expose files and commands you are comfortable sending through this path. The Runner lets you restrict Remote to one folder, make it read-only, or turn off shell commands.

6. Why we use it, and our legal basis

• To provide Remote: signing you in, pairing devices, routing tool calls, counting usage and applying your plan. Legal basis: performing our contract with you.
• To keep the service secure and fair: rate limits, preventing free-plan abuse with the machine hint, investigating misuse, and short-lived server logs. Legal basis: our legitimate interest in running a safe, reliable service.
• To handle payments, tax and accounting, together with Paddle. Legal basis: contract, and our legal obligations.
• To answer you when you contact us, and to tell you about important changes to the service or these policies. Legal basis: contract and legitimate interest.

7. Who processes data for us

We do not sell your personal data or share it for advertising. We use these providers to run the Services:

Paddle.com Market LimitedUK and worldwide

Our reseller and Merchant of Record: checkout, payments, tax, invoices and refunds. Paddle is an independent controller of your payment data under its Privacy Notice.

Cloudflare, Inc.Global network

Network, TLS and attack protection in front of aiboard.me and mcp.aiboard.me. Sees request data and, for Remote, traffic in transit.

Akamai Technologies (Linode)London, UK

The virtual server that hosts the website and the Remote relay, its database and backups.

Google and GitHubUSA and worldwide

Sign-in to Remote, if you choose them. They tell us who you are; we don't give them your Remote data.

AI providers and AI apps you chooseVaries

OpenAI, Anthropic, Google and others receive what you send them from the app or Runner with your own keys or accounts; AI apps you connect to Remote receive your tool results. They act under your own agreement with them, not on our behalf.

We may also disclose data if the law requires it, or to protect our rights or someone's safety.

8. International transfers

Our servers are in the United Kingdom, we are based in the United Arab Emirates, and our providers operate worldwide, so your data may be processed outside your country. Where the law requires it, we rely on appropriate safeguards such as adequacy decisions and the standard contractual clauses offered by our providers.

9. How long we keep it

• Account, devices, machine hint and monthly usage totals: for as long as your account exists. Revoked devices stay listed so their keys can never be reused.
• Sign-in sessions: expire after 30 days without use and at most 90 days after sign-in.
• Connected AI apps: until you revoke them, or 90 days after last use. Access tokens last one hour; refresh tokens at most 90 days.
• Per-call usage records: the current and previous month only.
• Pairing records with IP address: about 20 minutes.
• Server and web logs (which may include IP addresses at the web-server level, but never tool-call content): up to 30 days.
• Billing records: for as long as your account exists and then as long as tax and accounting law requires. Paddle keeps its own records under its policy.
• Backups: database backups are kept for up to 90 days.

To delete your Remote account, email [email protected] from the address on the account. We will delete your account data within 30 days, except billing records we must keep by law. Copies in backups disappear as those backups expire.

10. Cookies and local storage

aiboard.mesets no cookies. It uses your browser's local storage and IndexedDB to keep your own settings and data on your device.

mcp.aiboard.meuses three strictly necessary cookies: one keeps you signed in (up to 90 days), one protects forms against cross-site request forgery, and one secures the sign-in redirect (10 minutes). On the checkout page, Paddle's payment form loads from Paddle and may set its own cookies to process the payment and prevent fraud. We use no advertising or analytics cookies.

11. Security

We protect data with encryption in transit, hashed tokens, signed device keys, least-privilege server access and restricted backups. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

12. Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email [email protected]; we will answer within one month and may need to confirm the request comes from the account's owner. You can also revoke devices and connected apps yourself in the Remote dashboard.

You have the right to complain to a data protection authority, for example the one in the country where you live. We would appreciate the chance to help first.

13. Children

The Services are not for children under 13 (or the higher minimum age in your country). We don't knowingly collect their data; if you believe a child has given us data, email us and we will delete it.

14. Changes to this policy

If we change this policy we will post the new version here with a new date, and tell Remote users about material changes by email or in the dashboard before they take effect. See also our Terms of Service.