Last updated: August 2026

This policy describes what information Caf.ai collects, how we use it, and the choices you have. By creating an account and using Caf.ai, you agree to the practices described here.

1. Information We Collect

Account information. When you create an account we collect your name, email address, username, password (stored hashed), and a mobile phone number. The phone number is required because it is how we verify your account and deliver sign-in security codes; it is a security control, not a marketing list, and we do not sell or rent it. We previously asked for a date of birth and postal code at signup; we no longer collect either, because neither was used to provide the service.

Content you provide. Questions you ask, attachments (images and PDFs) you upload, discussions and decisions you participate in, action items you create, and feedback you submit.

Usage data. Queries you run, the models consulted, response times, token counts, cost and water-consumption estimates, and timestamps. We log this to operate the service, support you, and improve the product.

Calendar data (optional). If you add calendar feeds, we read event titles and busy times to give models scheduling context. We do not store the full content of calendar events beyond what's needed for the active query.

Technical data. Standard web server logs (IP address, browser user-agent, page URL, timestamp) for security and debugging.

2. How We Use Your Information

• To operate Caf.ai — running queries, hosting discussions and decisions, tracking action items.
• To bill you under your plan and show you usage history.
• To send service messages — account invitations, password resets, assignment notifications, and feedback acknowledgements.
• To improve the product — aggregate, de-identified analysis of usage patterns and model performance.
• To prevent abuse — rate-limiting, fraud detection, and enforcement of our Terms of Use.

3. AI Model Providers

When you submit a query, the question, any attachments, and the relevant conversation context are sent to one or more third-party AI providers (currently OpenAI, Anthropic, Google, xAI, Mistral, and Groq, among others). Each provider's own privacy policy governs how they handle that data. We send only what's needed to produce your answer.

4. Other Service Providers

We rely on a small number of vendors to operate Caf.ai:

• Microsoft 365 — outbound email delivery.
• Twilio — SMS delivery for invitations and account notifications.
• Stripe — payment processing for paid plans. We do not store full credit card numbers; Stripe handles all card data.
• Google Cloud Platform — our application hosting and infrastructure.
• Cloudflare (cdnjs) and jsDelivr — content delivery networks that serve icon and formatting libraries used by our pages. Your browser requests these files directly, so these networks receive your IP address, browser user-agent, and the page you are viewing. They receive no account information, and we send them nothing about you.

Each provider receives only the information needed to perform their service.

5. Cookies

Caf.ai uses a small number of cookies. We do not use advertising cookies, and we do not use cookies to track you across other websites.

• Session cookie (session) — set when you log in, so the site knows it is still you from page to page. Strictly necessary; the site cannot work without it. Cleared when you log out.
• Theme cookie (sys_theme) — remembers whether your device is in light or dark mode so pages render the right way. Expires after one year.
• Cloudflare bot-management cookie (__cf_bm) — set by cdnjs.cloudflare.com, not by us, when your browser fetches the icon library our pages use. It is Cloudflare’s own anti-bot measure and typically expires within 30 minutes. We neither read nor receive it.

You can block or delete cookies in your browser settings; blocking the session cookie will prevent you from logging in.

6. SMS Messages

If you provide a phone number at signup and consent to SMS, we may send you account-related text messages — account invitations, discussion and collaboration invitations, password resets, and similar transactional notifications. Message frequency varies; you should not expect more than a handful of messages per month under normal use. Message and data rates may apply. Reply HELP for help or STOP at any time to unsubscribe. We do not sell or rent phone numbers and do not send marketing SMS.

7. Sharing With Other Users

Some Caf.ai features intentionally share content with other people you choose:

• Favorites you publicly share generate a permalink anyone with the URL can view.
• Discussions and decisions are visible to the participants you invite.
• Action items are visible to their assignee.
• Referrals reveal your name and email address to the person you invite, so they know who referred them.

You can revoke shares and remove participants at any time from the relevant page.

8. Data Retention

We retain your account data, favorites, discussions, decisions, action items, and query logs for as long as your account is active. Query logs older than 24 months may be summarized and the detailed records removed. If you delete your account, we delete your personal information and content within 30 days; some operational logs may persist for an additional 90 days for security and audit purposes before final deletion.

9. Your Choices

• Access and export — you can review your favorites, history, and usage at any time from the in-app pages.
• Correction — edit your profile from Settings.
• Deletion — request account deletion by emailing info@thecaf.ai; we'll process it within 30 days.
• SMS opt-out — reply STOP to any text message, or clear your phone number in Settings.

10. Security

Passwords are stored as salted hashes. Sessions use HTTPS. Stripe handles all payment card data. No system is perfectly secure, but we apply reasonable measures to protect your information.

11. Children

Caf.ai is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have done so, we will delete it.

12. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be announced in-app or by email.

13. Contact

Questions about this policy or your data? Contact us at info@thecaf.ai.