Privacy & cookies

Alexander Kremenets, based in Portugal, operates AiDHD and is responsible for your personal data. For questions about your studio or your privacy rights, write to support@aidhd.space.

Your studio

Starting a guest studio creates a random account ID. It lets us return your cards to the same browser. If you register, we also process the sign-in details you choose, such as your username, password credentials, email address or optional display name. If Google sign-in is offered and you choose it, Google and Supabase exchange your Google account identifier, email address and basic profile information.

We store what you capture: note text, links, photos and recordings. Your flow assignments, tags, topics, connections, choices, saved steps, drafts and timestamps belong to the same studio. When you enter your studio, we ask for microphone access and release the microphone after the permission check. Hold the microphone button to record. Releasing it saves the audio. Choosing an audio file or photo also saves it immediately.

We process these details to provide the studio you request under our terms of use (GDPR Article 6(1)(b)). You can use a guest studio without giving us a name or email. AiDHD is for creative work. Keep medical records, diagnoses, confidential links and other people's private details out of the demo.

Link previews

When you capture a note containing a link, our server requests the first linked page to read its title, description and topic. The destination and any site it redirects to can see the request from our server, including the requested path and any query parameters. The preview request does not forward your account token or browser cookies. Opening the link yourself connects your browser directly to the site.

Transcripts and image descriptions

When you finish a recording or select an audio file, you ask us to send it to OpenAI for transcription. Selecting a photo sends it to OpenAI for a description, including readable text. We process the attachment to provide the media capture feature you request under our terms (GDPR Article 6(1)(b)). We keep the original file and the resulting text on the same card. If processing fails, you can retry from the saved card. Use Edit on the card to correct these texts or the caption. On an audio card, choose Edit → Delete card to remove the recording and its text from the active database.

Automatic connections

When you save a note, AiDHD looks for related cards in your studio. OpenAI can compare text from the new note with up to 24 earlier cards, including project questions. Each excerpt can contain up to 1,200 characters of caption, saved transcript and image description. We also send flow information, card identifiers, tags, topics, link details and indicators that a card contains media. Earlier captures are compared within the studio. If you explicitly turned off external suggestions in the previous version, new notes in that studio are also compared there. Prepared examples are generated on our server.

You can choose a flow yourself and keep or dismiss any suggested connection.

Cookies & browser storage

AiDHD uses browser local storage for the Supabase session that keeps you signed in, including on a return visit, until you sign out, the session expires or you clear site data. Sign-in flows can also use temporary storage to complete your chosen sign-in. We do not use advertising cookies, analytics trackers or third-party tracking pixels. If you choose a Google sign-in, Google handles its own sign-in page and storage.

You can remove this site's storage in your browser settings. Signing out or clearing site data can permanently remove your access to a guest studio. To erase the stored studio itself, use Profile → Delete studio while you still have access.

Who processes data

Railway serves the application from Amsterdam and processes preview, matching and attachment requests. Supabase provides authentication and stores studio data in its Ireland region. Cloudflare provides domain name resolution. These providers process connection information such as IP addresses and request times as needed to deliver and secure the service. We rely on our legitimate interests in keeping the service available and investigating abuse (GDPR Article 6(1)(f)).

Zoho Mail handles your email address and correspondence when you write to support. We use these to respond to you and administer the service under our legitimate interests, or to meet a legal obligation when you exercise a data right (Article 6(1)(c)). OpenAI processes attachments you choose to send and card extracts for automatic connections. Google processes sign-in information if you choose Google.

Service providers and their subprocessors may process data outside the European Economic Area, including in the US. Providers describe safeguards such as EU standard contractual clauses for transfers to countries without an adequacy decision. You can request information about the safeguards for your data or a copy from support. See the Railway data processing terms, Supabase data processing terms and OpenAI data processing terms.

How long we keep data

We keep your account and saved content while your studio is available, unless you delete it earlier. Guest studios do not currently expire automatically. Guest content stays on the server if you sign out or lose the session. Deleting the studio removes the account and its content from the active database. Providers may retain temporary backup copies and security logs according to their service retention periods. We keep support correspondence for as long as needed to handle your request and any related legal obligations.

OpenAI may keep API request and response content in abuse-monitoring logs for up to 30 days by default, unless longer retention is legally required. See OpenAI's API data controls.

Your rights

For access, a copy, correction, deletion, restriction of processing or portability where applicable, contact support@aidhd.space. You can also object to processing based on legitimate interests. If you use a guest studio, contact us while you still have access to it. We may ask for information needed to verify that the studio is yours. Please do not send a password or one-time code. We normally respond within one month. If an extension is allowed, we will explain it within that month.

You can also complain to a supervisory authority, including Portugal's Comissão Nacional de Proteção de Dados (CNPD), or the authority where you live or work.