Privacy Policy

Effective 30 October 2026 · version v1.1

This policy explains how XiaoZhan AIhub (model.dflop.top — "we", "us") collects, uses and protects your information. Using the service means accepting this policy.

1. What we collect#

Account information: your registration email, and the account identifier, display name and avatar returned by a third-party sign-in such as Google. We never store your password for a third-party account.

Usage and billing data: metadata for each API or playground call — the model, usage in tokens, images or seconds, the cost, a timestamp, which API key was used, where the request came from — used for billing, reconciliation, abuse prevention and improving the service.

What you submit:

• The request and response bodies of gateway API (/v1/*) calls are not persisted. They pass through our servers while being forwarded, and what remains is the usage metadata above;
• Playground conversations (chat, image, video and so on) keep their messages and outputs under your account so you can review history and hold multi-turn conversations; you can delete a conversation at any time;
• Knowledge-base documents and their compiled output live in object storage, reachable only by your account (and any team members you authorise);
• Generated image and video files live in object storage so we can show them to you and let you download them.

Payment information: top-ups are handled by Stripe. We keep only the order amount and status and never touch or store your card number.

Technical logs: server access logs and error diagnostics (collected through Sentry), for troubleshooting and security auditing.

2. How we use it#

• To provide and maintain the service (forwarding model requests, storing conversations, charging usage);
• For security (detecting abuse, credential stuffing and attempts to dodge billing);
• To improve the service (usage analysis at an aggregate statistical level; we do not profile individuals from their content);
• We do not sell your personal information, and we do not use your content to train models of our own.

3. Forwarding to third-party model upstreams#

This is how the service fundamentally works, so please read it carefully:

• Your prompts and the images and document fragments you upload are forwarded to the third-party provider behind the model you chose (including but not limited to direct or relayed services from OpenAI, Anthropic, Google, xAI, ByteDance Volcano Engine, Zhipu, Tencent and DeepSeek), which runs the inference and returns the result.
• Those upstreams handle data under their own terms of service and privacy policies, and some retain API traffic for a limited period for abuse auditing as their policies allow.
• Do not put information in a prompt that you are not entitled to disclose, or that you would rather did not leave this platform — someone else's identity document number, medical records, unredacted production credentials.

4. Other processors#

To run the service we use the infrastructure providers below, and your data may be transmitted through or stored on their systems:

5. Cookies#

We use cookies for the sign-in session only:

• an authentication cookie (HttpOnly, scoped to .dflop.top so the sites share a session);
• a CSRF protection cookie.

We serve no advertising cookies and do no cross-site tracking. With cookies disabled you cannot stay signed in.

6. Retention and deletion#

• Playground conversations and knowledge bases: kept until you delete them, or deleted with the account when you close it through the contact in section 8;
• Usage and billing records: kept for the life of the account, for reconciliation and compliance;
• Closing your account: delete it yourself in the Deski phone app (Settings → Delete account for good), which takes effect at once and removes what section 10 lists; or request it through the contact in section 8 ([email protected]) and we will delete your account data (except billing records the law requires us to keep).

7. Security#

• HTTPS transport encryption site-wide;
• passwords stored as one-way hashes; API keys and upstream credentials encrypted with AES-256-GCM;
• database and object-storage access isolated per account.

No system can be absolutely secure. Should an incident occur that may affect your data, we will notify you promptly as the law requires.

8. Contacting us#

To exercise your rights of access, correction and deletion, or with any question about this policy, reach us at [email protected] or through the feedback channel in the console.

9. Changes to this policy#

We may update this policy from time to time, refreshing the effective date at the top of the page; significant changes will be announced separately.

10. The Deski phone app#

Deski is the platform's phone client (iOS and Android), and you sign in to it with the same XiaoZhan AIhub account. Everything above applies to Deski as well; this section adds what is specific to it.

Phone permissions: Deski asks for a permission only when you use a feature that needs it, and you can turn any of them off in your phone's system settings at any time.

• Camera and photos: to take or pick a picture to send in a chat, and to save generated images and videos to your photo library;
• Microphone and speech recognition: to turn your voice into text;
• Location: to note where a session started in your session history, or for a task you give the agent;
• Calendar and reminders: so the agent can look up or create events and reminders when you ask it to;
• Notifications: to tell you when a task finishes or a reply arrives;
• Local network: when you ask the agent to reach a device or service on your own network.

When the agent works with phone features at your request, it may also ask for Bluetooth, Health, Home, media library, NFC or alarm access, on the same terms.

What these permissions give is used on the phone. It leaves the phone only when you send it in a chat; when the agent uses it for a task you asked for, in which case it is sent as part of the conversation (see the next item); or, for hold-to-talk, when the recording is sent to be turned into text (see "Voice input").

Chats and third-party AI: the messages and attachments you send in Deski go to our servers and are forwarded to the third-party provider behind the model you chose (including but not limited to direct or relayed services from OpenAI, Anthropic, Google, xAI, ByteDance Volcano Engine, Zhipu, Tencent and DeepSeek) to produce the answer. Those providers handle data under their own terms of service and privacy policies; see section 3.

Voice input: while you hold to talk, the recording is streamed to our servers and passed to a speech recognition provider (ByteDance Volcano Engine), which turns it into text for the input box. Our servers only relay the audio and do not keep the recording.

Storage on the phone and sync: chats are kept on your phone and synced to your account, so you can see them on other phones signed in to the same account. What reaches our servers through sync is the text of conversations and messages (an overly long message is cut short); for attachments only the name, type and size are synced, and the file itself stays on the phone. The agent's name and look, and the list of connected devices, are also kept under the account. You can turn sync off in the app, and the synced copy on our servers is then deleted.

Deleting your account: you can delete your account in the app: Settings → Delete account for good. Deletion takes effect at once, cannot be undone, and deletes or invalidates the following:

• the account's sign-in details: the email is replaced with an anonymous placeholder, and the phone number, password and display name are cleared, so none of them can be used to sign in again;
• every sign-in session, command-line token and API key of the account, and every Deski phone signed in to it is signed out;
• what Deski keeps for the account on our servers: synced conversations and messages, the agent's profile and the device list;
• the account's chats, memory and other local data on the phone: the phone that deleted the account clears them at once, and other signed-in phones clear them the next time they connect.

Any balance left on the account is forfeited with it. Billing records the law requires us to keep (top-up orders, usage and charge records) are retained. Web playground conversations, knowledge bases and generated works are not deleted automatically by deleting the account in the app, but they can no longer be reached through the account and are no longer linked to your email, phone number or display name. To have them deleted as well, delete them yourself before deleting the account, or ask us through the contact in section 8.

An enterprise account that signs in through its enterprise is managed by that enterprise and cannot be deleted in the app; please contact your enterprise administrator.

See also the terms of service.