ParaLLM privacy policy

Effective October 10, 2026

ParaLLM is operated by Canoe AI LLC, Massachusetts, United States. Contact support@canoe-ai.com with privacy questions or requests.

Your conversations

ParaLLM saves chats on your device. To answer a message, a selected model receives your message, earlier user messages in that conversation, and that model’s earlier answers. Each model receives its own conversation history. If you enable synthesis, your question and the selected models’ answers are also sent to Qwen for comparison.

Qwen, GLM, and Gemma run on the GPU server we use to provide ParaLLM. They do not run on your iPhone or Mac. The ParaLLM service does not forward these requests to OpenAI, the Google Gemini API, or another hosted model API. Advanced connections send requests to the model server you configure; that server’s operator controls its processing.

Before sending content to a new model or destination, the app identifies the recipient and requests your permission. Synthesis requires separate permission. Declining leaves your draft unsent. You can reset sharing permissions in Model connections; this stops generation in the app and requires permission again, but cannot retract data already sent.

The ParaLLM gateway and model services are configured not to write prompts, answers, or credentials to routine request logs. Content is processed to generate responses; the service does not use your chats to train models. We do not provide a server-side conversation archive.

Access and service records

We store an opaque invitation identifier, a hash of its access token, model permissions, expiration and revocation state, rate-limit records, and daily token totals. These records control access, prevent abuse, and enforce usage limits. They are stored in Google Cloud Firestore and retained until operator removal; automatic expiration of daily usage records is not currently enabled.

Daily local recovery copies retain seven versions. Encrypted off-host recovery copies retain up to 31 versions, replaced as successful backups run. Recovery archives contain access records and operational configuration and credentials, not chat history. Separate operator recovery copies may also exist. When processing a deletion request, we explain how any remaining recovery copies are handled.

Our server host and infrastructure providers process connection metadata to deliver and secure the service. Our website uses Firebase Hosting. The app and website have no advertising or analytics SDK. The app does not request access to contacts, photos, microphone, or location. If you email support, we and our email provider process your address and message so we can respond.

Your choices and deletion

You can delete an individual chat in the sidebar or all chats in Model connections. This removes the app’s saved local copy; copies in device backups follow your backup service’s settings. You can also remove a connection and its saved access token. Removing a connection or resetting permissions does not delete service records.

To request access to or deletion of service records or support correspondence, email support@canoe-ai.com. Do not send an access token in ordinary email. We will arrange a private way to identify the relevant invitation, explain which records can be deleted and any required retention, and address recovery copies.

Security

Public app requests use HTTPS. Access tokens on the device are stored in Keychain. Off-host recovery archives are encrypted, and the decryption key is held separately from the model server. No system can guarantee absolute security.

Policy changes

We update this page and its effective date when the service changes. Changes to a model recipient, destination, or sharing purpose require updated app permission before sending content under those changes.