1. Data controller
The controller for the FallenAI website and application is Ciuhu Cristian Constantin, Fichtenweg 12, 51597 Morsbach, Germany. For privacy requests, including access, correction, deletion and objections, email fallenai.gptsupport@gmail.com. FallenAI is currently an independent beta project.
2. Website usage
FallenAI's current public website is hosted on Cloudflare Pages. Cloudflare may process IP addresses, request and device metadata and technical logs required to deliver and protect the website. We have not added advertising trackers or behavioral analytics scripts. The site loads optional typography from Google Fonts when available. The legal basis, retention and international transfer details require a current provider and deployment review before broader release.
3. Contacting us
You can email fallenai.gptsupport@gmail.com for support, beta feedback and privacy requests. Your email provider and ours may process the information contained in messages. Do not send passwords, payment details or sensitive personal data. No public contact form is currently offered on the Cloudflare site.
4. Android app and local memory
FallenAI includes on-device memory and personalization functions. Some saved items and preferences may remain locally on your device. Account features and any connected AI/chat capabilities may involve additional data processing; the exact flows, providers, locations and retention periods MUST be verified and disclosed before public release.
5. Account registration and sign-in
FallenAI has email/password registration and Google sign-in. Its own backend stores account data in a SQLite database, including email, first and last name, password hashes where applicable, verification state, session identifiers in hashed form, and technical records used to limit abusive requests. Passwords are processed using PBKDF2-SHA256 with a random salt; plaintext passwords should not be stored. Verification codes are valid for ten minutes, and a signed-in session is configured with a seven-day lifetime. The backend uses Gmail SMTP to deliver necessary verification emails. Google sign-in requires data exchange with Google for authentication. These processes support account creation, service access and security (GDPR Article 6(1)(b) and, for abuse prevention, Article 6(1)(f)); exact deployment location and external provider terms remain to be confirmed.
6. Privacy of younger users (16+)
FallenAI Beta is intended for users aged 16 or older. We do not intentionally offer beta account registration to children under 16. If we learn that an account belongs to a user under 16, we will review it and take appropriate action, including deletion where required. We have not yet implemented or verified a technical age-check or parental-consent mechanism; the app must be updated before age restrictions can be reliably enforced. Users aged 16 or 17 remain entitled to suitable privacy protections. Contact us at fallenai.gptsupport@gmail.com regarding underage account data.
7. AI processing, model training and third parties
FallenAI does not use users' conversations to train its own AI models. This is the intended operating policy and must be verified against all active app and backend data flows before final publication. If an AI feature sends your input to a service provider, that input may be processed to generate a response. The third-party provider's practices (including any use for model training), storage locations and retention must be reviewed and accurately disclosed before integration is enabled for public use. This website does not submit AI prompts or store card information.
8. Payment information
Membership payments are not enabled on this website. If launched, card entry and transaction processing will be handled by Paddle. FallenAI should receive only subscription status and identifiers necessary for access control, not the complete card number or CVC.
9. Optional marketing emails (planned)
FallenAI plans to send optional product news, feature announcements and promotional offers only to users who actively opt in. Marketing consent will be separate from account registration and from essential service emails, with no preselected marketing checkbox. The intended registration method is double opt-in: after an explicit request, the user confirms the subscription through an email link. A record of consent will be kept as necessary to demonstrate compliance. Every marketing email will offer an easy unsubscribe option, and consent may also be withdrawn by contacting fallenai.gptsupport@gmail.com. Withdrawing marketing consent will not disable the user account or necessary service communications. Marketing emails are not currently enabled: the app/backend has no confirmed subscription, consent-recording or unsubscribe mechanism. Before launch, the actual email-delivery service, personal-data recipients, processing location and retention schedule must be verified and disclosed.
10. Service notifications and app updates (planned)
FallenAI does not intend to use Android push notifications for advertising, promotions, or marketing. Once implemented, optional push notifications will be limited to relevant app releases, account or security alerts, and important service notices. Android notification permission and a separate in-app enable/disable control will be offered where appropriate. A proposed Firebase Cloud Messaging integration exists only as staging code and is not currently active in the production Android app. Before activation, this policy must be updated with the confirmed notification provider, recipient data, retention practices, and any international transfers. Marketing emails are treated separately in the previous section and will require their own voluntary opt-in.
11. Optional error reports (planned)
FallenAI intends to accept app error and crash reports only when a user actively chooses to submit a report. Optional reports may contain an explanation of the problem, app version, device and operating system details, and diagnostic information the user elects to provide. The intended reporting interface will let users review what is being sent and avoid including passwords, message content, or other sensitive information. We do not intend to automatically upload app crash reports to a FallenAI error-reporting service. This user choice does not prevent the website host or backend infrastructure from creating ordinary technical logs for security and service operation; these must be separately documented. An in-app, user-initiated error-reporting feature has not yet been confirmed as implemented, and the actual data flow and retention must be verified before launch.
12. App usage statistics (planned)
FallenAI may in the future offer optional statistics for improving reliability and features, such as active-user counts and aggregated feature popularity. Participation will be off by default. Where consent is required, no optional usage analytics will run before an affirmative opt-in and a straightforward withdrawal option are provided. We will not include chat messages or AI prompts in analytics. Aggregation does not automatically make every underlying record anonymous. No dedicated usage-analytics service was identified in the inspected Android/backend source, so this is a planned option, not a claim of active tracking. Before rollout, we will document the event fields, identifiers, vendors, locations and retention period.
13. Purposes and legal bases
Data used to provide an account and requested features is generally processed for contract performance or steps taken at your request (GDPR Article 6(1)(b)); website delivery, fraud prevention and service security may rely on legitimate interests (Article 6(1)(f)); voluntary marketing emails and any analytics requiring consent use Article 6(1)(a) and any additional rules applicable to electronic communications. Optional marketing is not necessary for an account. Where consent applies, it can be withdrawn at any time with future effect. Details of the live server, processors and individual processing operations must be confirmed against the deployed product before this notice is finalized.
14. Retention and international transfers
Account details are retained as needed while an account is active, subject to verified deletion requests and any mandatory legal retention duties. Session cookies expire after seven days under the current code; expired database session entries and other security records may be cleaned on a different schedule. The current code does not establish a complete retention/deletion schedule for account databases, backups, server logs or contact submissions. Those periods must be determined and implemented before broader launch. Third-party recipients currently identified include Cloudflare (website/forms), Google (Google sign-in and Gmail verification) and, for future checkout only, Paddle (payments). Other AI or model providers, their hosting regions and any international transfers have not yet been verified; do not assume all processing remains in the EEA. For current questions or erasure requests, contact fallenai.gptsupport@gmail.com.
15. Your rights and account deletion
Subject to applicable GDPR requirements, you may request access, rectification, erasure, restriction, portability or object to processing; you may also withdraw consent and complain to a competent data-protection authority, including the North Rhine-Westphalia supervisory authority (LDI NRW). The planned account-deletion rule is permanent deletion without a 30-day recovery window, except data that must be kept for legal obligations or legal claims. Self-service account deletion is not yet implemented in the verified Android/backend code. Until it is implemented, submit an erasure request to fallenai.gptsupport@gmail.com. A functioning, auditable deletion process and backup-handling policy must be implemented before release.
16. Security and changes
We aim to protect data using appropriate safeguards, but no internet service is risk-free. This policy will be updated to reflect the verified live product, hosting setup and service providers. Contact us via fallenai.gptsupport@gmail.com or the form.