Privacy Policy

This Privacy Policy describes the personal data that Monarch (« we », « us ») collects, uses, and discloses about individuals (« you ») who use Monarch and its related pages (the « Service »).

« Personal data » means any information relating to an identified or identifiable individual. Your use of the Service is also subject to our Terms of Service.

This product is built to minimise data: no analytics, no advertising, no third-party trackers, no behavioural profiling, and the free-tier limit is not keyed to your IP address.

For a plain-language summary of these data flows, see How it works.

• —Publisher: Monarch. Legal form, registered address, publication director and registration number will be added here once the company is formed.
• —Contact: contact@reply.usemonarch.app · Abuse / unlawful content: abuse@reply.usemonarch.app. You can also reach us from the in-app contact form.
• —Application hosting: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (vercel.com).
• —Database hosting: Neon Inc. (neon.tech), on instances in the EU and the US depending on your chosen storage region.

A. Data you provide to us

• —Local mode (no account, ever). The on-device model needs no identifying detail and no session — nothing is sent to our servers. Guest (no-account) sessions on Cloud are being phased out; existing ones keep working until they expire, but Cloud now requires an account. Conversations are stored only in your browser either way (see « Conversations » below).
• —Account users. To create an account we collect your email address and a hashed password. A display name is derived from the local part of your email. There is no third-party (Apple / Google / Discord) or crypto-wallet login.
• —Storage region. EU or US, chosen by you, and changeable while your account has no stored data. It determines where your account record is held.
• —Payments. Pro is paid in cryptocurrency through our processor (NOWPayments). We record the plan, amount, status, and the processor's payment reference. We do not receive card numbers, wallet keys, or wallet addresses.
• —Communications. If you use the in-app contact form or email us, we receive your message and, if you give one, your email address. The contact form also attaches a small technical context to help us reproduce issues — your current engine (Cloud / on-device), the model in use, your browser type, and the page you came from. It does not capture your conversation content. These messages are stored in our EU database (see « Retention »).

B. Data collected automatically when you use the Service

• —Technical / device data. IP address, browser and operating-system type, and request timestamps. Kept minimally, for security and debugging. Not used for fingerprinting and not used to enforce the free-tier limit.
• —Usage records. For each message, a timestamp and the model name — used to enforce the daily free-tier limit and to control cost. Not linked to message content.
• —Conversations. Every conversation — and the folders you organise them into — is stored only in your browser (localStorage). It is never stored on our servers. You can export an encrypted copy from Settings; that file stays on your device unless you move it yourself.

C. Prompts and outputs

To generate a reply, the content of your conversation (« prompts ») is sent to our model provider, OpenRouter, which routes it to the underlying language-model host, and the response (« output ») is streamed back to your browser. We do not store the content of your prompts or outputs on our servers — it is held only in your browser. Every model request instructs OpenRouter to route only to providers whose data policy is « does not collect user data » (« data_collection: deny »); our OpenRouter account is also set to refuse providers that train on data, and OpenRouter's own prompt-logging feature is disabled. We do not use your prompts or outputs to train models. We do not currently claim end-to-end Zero Data Retention across every upstream host.

Web search (optional). If you turn on the « Web » toggle, then for a message that needs current information a short search query derived from it is sent to Brave Search and the results are added to the model's context. This is the only case where something derived from your message goes anywhere other than the model provider. The toggle is off by default, the query and results are not stored on our servers, and on-device (« Local ») replies never use it.

On-device engine. If you set the engine to Local, the model runs entirely in your browser on your device (WebGPU). Your prompts and the model's replies are never sent to us or to any third party, and no usage record is created. The model files are downloaded once from a public model host and then cached by your browser (see « Cookies & local storage »).

• —To provide, maintain, and secure the Service, and authenticate you.
• —To generate AI replies to your messages.
• —To enforce the free-tier limit and to detect and prevent abuse and cost runaway.
• —To send transactional email (account and payment-related). We do not send marketing email.
• —To debug, and to keep the Service reliable.
• —To comply with legal obligations, including accounting obligations for payments.
• —To respond to your requests and communications.

We do not use your data for advertising or behavioural marketing, and we do not sell it.

• —Performance of a contract — creating and running your account, generating AI replies, processing payments.
• —Legitimate interests — security, abuse and cost-runaway prevention, minimal technical logging. We balance these against your rights.
• —Legal obligation — retaining payment/accounting records.
• —Consent — not currently relied on; if we ever add a feature that needs it, we will ask first.

Sub-processors

• —OpenRouter — AI inference routing, and the model host it forwards prompts to.
• —Neon — database hosting (EU and US regions).
• —Vercel — application hosting.
• —Resend — transactional email, plus inbound email for support.
• —NOWPayments — crypto payment processing.
• —Brave Search — only when you turn on the optional « Web » toggle in the composer. A short search query derived from your message is then sent to Brave to fetch current information; the reply cites the sources. With the toggle off (the default), no query is sent. On-device (« Local ») replies never use it.

Each acts on our instructions for its specific function. We do not use analytics or advertising partners, and we do not disclose data to data brokers.

Other disclosures

• —Legal and safety — we cooperate with valid legal requests from competent authorities, and may access, preserve, and disclose data where we believe it is required or appropriate to comply with law or legal process, to protect rights, property, or safety, or to investigate abuse or unlawful activity. We disclose only what a request actually covers, and we do not hold conversation content to disclose (it never reaches our servers — ADR 0012). Report abuse to abuse@reply.usemonarch.app.
• —Corporate transaction — if the Service is involved in a merger, acquisition, or asset transfer, data may be transferred as part of it, subject to this policy.

If you are in the EEA, Switzerland, or the UK, you can request: access and portability, rectification, erasure, restriction, and you can object to processing based on legitimate interests, and withdraw any consent previously given.

Exercise these by contacting contact@reply.usemonarch.app. We may ask for information to verify your identity. Exceptions and limitations apply; changes are reflected in active systems promptly, while backups cycle out over time. You may also lodge a complaint with the French authority, the CNIL (cnil.fr), or your local supervisory authority — we would appreciate the chance to address your concern first.

• —Account data — until you delete your account.
• —Conversations and folders — never held by us; they live only in your browser, for as long as you keep them there.
• —Usage records (a timestamp + model name per turn, no content) — deleted after 90 days, automatically, once a day.
• —Support correspondence (contact form + email) — kept while we handle your request and deleted about 24 months (730 days) after the last message, by the same daily job.
• —Technical / server logs (Vercel) — 1 day (our plan's default runtime-log retention; we have not enabled longer retention).
• —Payment / accounting records — for the period required by law (invoices ~10 years in France).

Account and authentication data, payment records, and support correspondence are stored in the EU. If you choose the US storage region, your account record and usage records are held on infrastructure in the United States, at your request; conversation content is never stored on our servers in either region. Several sub-processors are established outside the EU/EEA; here is the safeguard we rely on for each:

• —Vercel (application hosting) — the European Commission's Standard Contractual Clauses (Modules 2/3), incorporated into their Data Processing Addendum.
• —Resend (email) — Standard Contractual Clauses pre-signed into their Data Processing Addendum for every account, plus participation in the EU-US Data Privacy Framework.
• —Neon (US-region database hosting) — participation in the EU-US Data Privacy Framework.
• —Brave Search (optional web search — only if you turn it on) — covered by their Data Processing Addendum. Brave separately keeps a record of submitted queries for up to 90 days on their own systems, for billing and troubleshooting — independent of our own no-logging practice for the query.
• —OpenRouter (AI inference routing) — [TO COMPLETE: our account is on OpenRouter's self-serve tier, which does not carry a signed Data Processing Addendum or Standard Contractual Clauses (only their Enterprise tier does). Resolve before a public paid launch — upgrade the account, or have counsel assess the exposure of relying on a self-serve processor for this].
• —NOWPayments (crypto payment processing) — [TO COMPLETE: no public Data Processing Addendum or transfer safeguard found; confirm directly with NOWPayments, or have counsel assess].

[TO COMPLETE: have counsel confirm this wording and resolve the two open items above before a public paid launch]

• —Session cookie — set by the authentication system to keep you signed in (guest or account). Strictly necessary, so no consent is required. Removed on logout or expiry.
• —Closed-beta cookie (monarch.beta) — during the invite-only beta only, set after you enter a valid access code so you are not asked for it again. Strictly necessary for access control; it goes away when the beta ends.
• —Browser localStorage — not a cookie: holds your conversations and folders (which never leave your browser), your engine and model choice, your 18+ confirmation, and small UI preferences. Cleared when you clear your browser's site data.
• —On-device model files — if you download a model for the Local engine, its files (several GB) are stored by your browser (Cache Storage / IndexedDB). They stay on your device, can be removed from Settings, and nothing about them is sent to us.

No analytics, advertising, or third-party cookies, and no fingerprinting. Because there are no non-essential cookies, there is no consent banner — and that is a property we intend to keep.

Passwords are hashed. Data in transit is encrypted (HTTPS). Access to production data is limited, and we aim to keep the data we hold minimal by design. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

The Service is for adults: it can produce adult content and is 18+. We do not knowingly collect personal data from anyone under 18. In France the age of digital consent is 15; regardless, this Service is not directed to anyone under 18. If you believe a minor has provided us data, contact contact@reply.usemonarch.app.

We will post any changes on this page; the revised version is effective when posted, and the « Last updated » date above will change.

Monarch is responsible for processing your personal data. Questions or concerns: contact@reply.usemonarch.app.