Privacy Policy for Angel

1. Scope and Controller

This policy covers the Angel browser extension, Angel web app and withangel.io website. Angel helps you find original sources for claims. It is currently in beta; the separate Beta Terms of Use also apply.

The data controller is Sami Al-Khafaji. For privacy questions or requests, email sami@withangel.io.

2. Account, Billing and Communications

We store your email address, name or username, authentication provider and identifier, account role, signup and update dates, and profession and company if supplied. We also store policy acceptance dates and versions, subscription tier, credit balances and usage, billing and subscription identifiers, and invitation or promotional-deal records. Firebase Authentication handles sign-in, password resets and email verification. Stripe handles checkout, subscriptions and payments; Angel stores billing references and subscription status, rather than full payment-card numbers.

We send account, invitation and service emails through Resend. Deal invitations contain the recipient's email address and a personalised redemption link. If you join our mailing list on the website, your email address goes to Loops, which manages the list and sends our updates. Emailing us also puts the information you send into our correspondence records.

3. Searches and Results

When you select text and click Verify, or submit text or a URL in Angel, we receive the submitted content and your account identity. Extension searches also send the current page's full URL, including its query string. Search requests may include your selected model and language or example-search context. The extension does not automatically upload the rest of the page or your browsing history. The backend can fetch pages you submit or pages found during the search.

We store search text, page URLs, results, verdicts, sources and quoted passages, together with timestamps, run identifiers, execution traces, tool inputs and outputs, and usage or cost information. Saved claims, source trails, statistical table selections and minted links support history and source retrieval. We also store tags, archive and sharing settings, and feedback including ratings and notes you submit. Angel is not designed for special categories of personal data (such as health information), criminal-offence data about private individuals, or confidential material. Please do not submit them.

Claims can mention other people, such as public figures. We process that information only to find the source of the claim you asked about, based on our legitimate interests in providing the service, and we do not contact those people. They have the rights described in Section 11 and can email sami@withangel.io.

4. Service Providers and Source Websites

Your search and related information can pass to these providers as needed:

• Google Cloud, Vertex AI / Gemini and OpenAI: hosting and AI processing. The chosen model receives search text, page URL, context and retrieved material to plan searches and return results. Google search grounding can also process derived queries when you select an OpenAI model.
• Brave Search: receives search queries derived from your input to find web sources.
• Jina AI Reader: receives candidate page URLs and returns their contents. URLs themselves may contain personal information.
• TypeSafe AI (Jev): where configured, receives claim and candidate-source information for relevance judgments.
• Source websites and public-record services: receive requested URLs or search and table parameters. These include Statistics Finland's StatFin / PxWeb and Finnish and EU institutional sites such as Finlex and Eurostat when used in a search. Queries can contain words from your claim.
• Langfuse: receives analysis traces, including search text, page URL, model and tool activity, queries, retrieved excerpts and statistical selections, for debugging and evaluation. Trace content may be truncated; it is not anonymised.
• PostHog: receives analytics, account properties and errors as described in Section 6.
• Firebase, Stripe, Resend and Loops: process authentication, payment, service-email and mailing-list data as described in Section 2.
• Vercel: hosts the withangel.io website and receives standard connection information, such as IP address and browser headers, when you visit it.
• Google Analytics: processes website analytics as described in Section 6.

We do not sell personal information or use it for advertising.

5. Staff Access and Sharing

Authorised Angel staff can review searches, results, feedback, account email addresses and linked diagnostic traces in the admin dashboard to support users and improve source retrieval. We may also use beta searches and feedback to evaluate and improve Angel's accuracy, including building test sets. When a search finds no verifiable record or fails with an error, a member of the Angel team may read it, look for the source by hand, and email you what they find. Where failed-search alerts are enabled, the search text, your email address, outcome, time and dashboard link are sent through Resend to the team's inbox.

If you make a claim public, anyone with its share link can view its text, original page URL, result and sources, as well as tags and feedback notes returned with the claim. Sharing is controlled by you. Do not publish a claim or feedback note you want to keep private. Source links you choose to share can also reveal table selections or query parameters.

6. Analytics

The web app uses EU-hosted PostHog for product analytics, automatic interaction capture and error monitoring. It can send events and error reports before you sign in or accept the policy. Its analytics identifier is held in memory only, so it sets no analytics cookie and writes nothing to local storage. Signing in links analytics to your account ID. Account properties include profession, company, subscription tier, signup date, authentication method and accepted policy version; this is more than an anonymous identifier.

Angel does not record your sessions: web-app session replay is switched off.

Custom product-event properties describe usage and search shape, rather than claim text, email or name. They can include outcome, verdict, duration, claim type and language, example-search identifier, source, domain, data holder, credit usage and errors. Automatic interaction capture records clicks and page views without the text or attributes of the elements, but it can include page URLs. PostHog also receives technical context such as browser, operating system and approximate location derived from IP.

The extension runs no analytics in the browser. Its searches still generate server-side PostHog events. The backend records completed searches, API failures and usage or credit events against account identifiers; these events are not controlled by the website's cookie banner.

On withangel.io, Google Analytics loads only after you accept analytics in the website banner. It measures visits, page URLs, referrers, interactions and technical or approximate-location information, using cookies such as _ga. Declining prevents it from loading. The website's choice is separate from web-app analytics. You can reopen Cookie settings on the website privacy page to change it. For web-app analytics questions or to object to it, contact sami@withangel.io.

7. Storage on Your Device

The extension uses chrome.storage.local for sign-in credentials, cached account and usage information, recent claims and results with their page URLs, and settings such as theme. These records have no automatic expiry. Signing out clears extension local storage and cached claims. Removing the extension also clears its extension storage.

The web app uses local storage for its auth token and preferences such as theme, selected model and panel state. Session storage can hold an in-progress analysis and its input so a tab can resume it. Firebase may keep sign-in state in browser storage. Web-app analytics sets no cookies and uses no local storage. The stores above are needed for sign-in and settings and can exist before policy acceptance. Browser controls let you remove local data; doing so does not delete server records.

The website stores your analytics choice in local storage.

8. Logs, Retention and Deletion

Backend audit logs can contain request and response bodies, search text, URLs, result content, identifiers, IP addresses, user-agent and timing information. Search text and URLs are not generally removed. Account credit and usage records are stored in the database; separate abuse-prevention rate-limit counters are held in server memory, keyed by client identifier or IP address.

Audit logs are deleted automatically after 90 days. Your saved claims, results and history remain while your account exists, or until you delete them. External services and backups have their own retention settings. We keep analytics events and analysis traces for as long as we need them for debugging, evaluation and product-quality monitoring, and delete them on request. We keep correspondence for as long as needed to handle your request, and billing records for as long as the law requires accounting records to be kept.

Account deletion removes your account and the saved claims, feedback and usage records linked to it, and attempts to remove your Firebase sign-in and PostHog profile. Clearing your search history removes your analysis records and tags but keeps your account and billing data; it also asks PostHog to delete the related data. Deleting data held by outside services can fail or need manual follow-up.

Account deletion does not automatically erase every copy: audit logs and some legacy request records, invitation recipient details, Stripe records, Langfuse traces, staff emails and backups can remain. Contact us to request deletion across these systems; we will check what remains and confirm the result, including any information we must retain for legal obligations. Deleting browser storage or the extension alone does not delete your account.

9. Purposes and Legal Bases

We process account and search information to provide the service you request, including history, source retrieval and support, under contract. We use legitimate interests for service security, abuse prevention, operational diagnostics, product-quality monitoring, accuracy evaluation and handling information about other people that appears in claims you submit. This includes web-app analytics, error monitoring and the server-side events described in Section 6, none of which set cookies. Website analytics cookies rely on your consent. Mailing-list signups and emails also rely on your consent, which you can withdraw at any time by unsubscribing or emailing us. Billing records may also be retained to meet legal obligations.

Providing your account details and the content you search is necessary to use Angel; without them we cannot provide the service. Web-app analytics is not needed to use Angel, and you can object to it as described below.

Your right to object. Where we rely on legitimate interests (service security, abuse prevention, operational diagnostics, product-quality monitoring, accuracy evaluation and handling information about other people in submitted claims), you can object to that processing at any time on grounds relating to your particular situation. We will then stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. To object, email sami@withangel.io.

10. Security and International Processing

We use HTTPS for network transport and limit staff access to service operations and support. The configured backend deployment region is europe-north1, and PostHog and Langfuse use EU cloud endpoints. This does not mean all processing stays in the EU: AI services, authentication, payments, email, website services and source sites may process data elsewhere, including the United States. Vertex model calls are not pinned to the backend's region. Where a provider processes personal data outside the EEA, we rely on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses in its data processing terms. Contact us for information about the applicable provider arrangements and transfer safeguards. Accepting this policy is not a blanket waiver of your data-protection rights.

11. Your Rights

Depending on applicable law, you can request access, correction, deletion, restriction, objection and a portable copy of your personal data. You can withdraw consent where processing relies on it, without affecting earlier lawful processing. You can complain to a supervisory authority, including Finland's Data Protection Ombudsman at tietosuoja.fi. We do not make decisions with legal or similarly significant effects about you solely through automated processing.

Send requests to sami@withangel.io. We handle requests manually during the beta, may verify your identity, and will explain any applicable exceptions or remaining records. We respond within one month, or tell you why we need longer, as the law allows.

12. Children and Policy Changes

Angel is not intended for people under 16, and we do not knowingly collect children's personal information.

We may update this policy as the service changes. We update the date and require acceptance of material policy revisions through the app's acceptance gate. Contact: Sami Al-Khafaji, sami@withangel.io.