Your Privacy, Protected

1. Who We Are

InnerZero is provided by Summers Solutions Ltd (Company No. 16448945), registered in England and Wales at Mclaren Building, 46 The Priory Queensway, Birmingham, B4 7LR.

Summers Solutions Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller. Registration reference: ZC122497. You can verify this on the ICO register.

For privacy enquiries: help@innerzero.com.

2. What Data the Desktop App Collects

The InnerZero desktop application does not collect or transmit any personal data by default. All AI processing, conversations, memory, and documents remain on your local machine. No telemetry, analytics, usage tracking, or crash reporting is included.

In-app feedback and optional diagnostic logs

The app has a feedback box you can use to send us a message (the message is optional when you attach a log, see below). When you send one, the message you typed, your app version and operating system are emailed to our support inbox, and a record is stored in our Supabase database so we can respond and keep track of reports. That record holds the message, app version, operating system, the app's network user agent string, and a salted one-way hash of your IP address that we use only to limit abuse of the feedback service (never the address itself). Nothing is sent unless you press Send.

You can choose to attach a window of the app's own activity log to a feedback message (the last 15 minutes, hour or 24 hours, all entries or errors only). Before it leaves your device the log is reduced to event names, timestamps, short technical labels, numbers and sizes: your prompts, the assistant's replies, file names and paths, your user name and any other written content are removed. The exact text that will be sent is available in a preview inside the feedback box, so you can check it before you press Send. The attached log is emailed to our support inbox with your message. The stored record notes only whether a log was attached, which window you chose and its size, never the log itself. If you do not choose to attach a log, none is sent.

3. Cloud Mode

If you enable the optional Cloud Mode, your prompts are sent to the third-party AI provider you select (such as DeepSeek, OpenAI, Anthropic, Google AI, Qwen/DashScope, xAI, or Kimi) and responses are returned to your device. InnerZero does not store, log, intercept, or read your prompts or responses at any point. Each AI provider has its own privacy policy governing how they handle your data; you should review the relevant provider's privacy policy before enabling Cloud Mode.

Telegram bridge (optional)

InnerZero offers an optional Telegram bridge for mirroring chat messages between your desktop and your phone, and for receiving Proactive Assistant briefings on your phone. The bridge is off by default and must be explicitly enabled in Settings.

When enabled, messages and briefings routed through the bridge are processed by Telegram's servers under their privacy policy and terms of service. Your Telegram bot token is encrypted and stored locally on your device only. You may disable the bridge at any time from Settings.

4. Cloud AI Service (Managed Subscription)

When you use InnerZero's managed Cloud AI service (optional paid subscription), the following data is sent to our proxy server:

• Your message text and a short recent conversation window (last 4 exchanges)
• Your model preference

What is NOT sent:

• Your memory database, full conversation history, personal profile facts, or file contents
• Your IP address is not included in the data sent to AI providers and is not stored in InnerZero application logs

Your prompts are routed to one of our AI subprocessors according to your plan tier, and the response is returned to you. If the model is temporarily unavailable, your request may be retried with the same provider or returned as an error, in which case the app falls back to your local model where one is installed; your prompts are not rerouted to any cloud provider not listed below. InnerZero does not store or log the content of your prompts or AI responses, and does not access them for human review.

Proxy logs are limited to: timestamp, plan tier, model used, and usage count deducted. To prevent duplicate billing and abuse, the proxy may also retain billing-integrity records consisting of a request identifier, a one-way fingerprint of the request (a cryptographic hash that is not designed to be reversible and does not contain a copy of your text), the usage units charged, and timestamps. All of these records are retained for up to 30 days for billing dispute resolution and abuse prevention, then automatically deleted.

Your prompts may be processed by one or more of the following AI subprocessors. The exact provider depends on your plan, current model availability, and our routing configuration at the time of your request. Each processes data under its own privacy policy and, where applicable, a data processing agreement:

• DeepSeek (direct API): covered by DeepSeek's privacy policy and API terms

If you use managed voice, your spoken audio is processed by an additional subprocessor for the audio itself:

• OpenAI (Realtime voice model): processes your spoken audio during managed voice sessions. Your audio streams directly from your device to OpenAI and does not pass through our proxy server, and InnerZero does not receive or store it. Covered by OpenAI's privacy policy and API terms.

Managed voice works differently from managed text. Our proxy only issues a short-lived session credential and records the session minutes used for billing, so your voice audio never reaches our servers. See Section 7 (Voice and Microphone) for details.

When using BYO (Bring Your Own) API keys, your prompts are sent directly to the provider from your device. InnerZero's servers are not involved.

5. BYO API Keys

If you use the BYO (Bring Your Own) API key feature, your API keys are encrypted and stored locally on your device only. Keys are never transmitted to Summers Solutions Ltd or any InnerZero server. Requests using BYO keys go directly from your machine to the provider.

6. Unrestricted Mode

Enabling Unrestricted Mode does not cause any additional data to be collected or transmitted. The uncensored models run locally on your device, and all generated content remains on your machine.

7. Voice and Microphone

If you use InnerZero's voice features, the application accesses your microphone to capture speech. By default, and whenever cloud voice is off, all audio is processed locally on your device using offline speech recognition models: no audio recordings are transmitted, stored, or sent to any server, and audio is discarded immediately after transcription.

If you enable cloud voice, how your speech is handled depends on the mode you choose:

• In text-in mode (including the standard and premium cloud voice options), your speech is transcribed locally first, and only the transcribed text, not your audio, is sent to OpenAI to generate a response.
• In speech-to-speech mode, and for managed voice subscriptions, your raw microphone audio is streamed directly from your device to OpenAI's Realtime service, which returns spoken audio. Your audio goes directly from your device to OpenAI; it does not pass through InnerZero's servers, and InnerZero never receives or stores it. OpenAI processes this audio as a subprocessor under its own privacy policy and API terms. For managed voice, InnerZero's server only issues a short-lived session credential and records the session minutes used for billing; it never handles your audio.

Speech-to-speech voice is off by default, is blocked entirely in Offline and Private modes, and is gated behind a one-time in-app notice explaining that the Privacy Blacklist cannot scrub raw audio. See Section 4 (Cloud AI Service) for the managed subprocessor list.

Proactive Assistant (optional)

Proactive Assistant briefings may pull from your local memory, connected mail (if Gmail is enabled), and knowledge packs to compose briefing output. Composition happens on your machine. If you have routed automation tasks to a cloud model, that routing is covered by the Cloud Mode disclosures above.

Action Hub: web research and job applications (optional)

The optional Action Hub has two parts, both off by default and both run from your machine.

Web research.Research uses your own Apify API key. When you start a research task, only your run parameters (such as search terms or target URLs) and your Apify token are sent to Apify's servers to run the scraper. Your memory database, files, and profile are never sent. Your Apify token is encrypted and stored locally on your device. Apify processes your request under its own terms of service and privacy policy. You are responsible for what you choose to research and for complying with the terms of any site you target.

Job applications. If you use the job-application assistant, the profile details you enter (such as your name, contact details, CV information, answers, and an optional AI-tailored note) are submitted directly from your machine to the third-party job or company website you choose. InnerZero does not receive, store, or proxy this information. Each submission requires your explicit approval, and you can keep the assistant to draft-only and review everything first. The destination website processes your details under its own privacy policy.

8. What Data the Website Collects

When you create an account on innerzero.com, we collect your email address. Payment information for InnerZero Pro, cloud plans, and Business Licences is processed by Stripe, and payment information for one-off donations is processed by Ko-fi and PayPal; we never receive or store your payment card details.

Newsletter subscriptions (optional)

If you choose to subscribe to our email list, we store your email address, the date you subscribed, and which page you subscribed from. We use this only to send you occasional product updates. Your email is stored in our Supabase database and never shared with third parties. You can unsubscribe from any email we send, or request deletion by contacting help@innerzero.com.

9. Cookies

InnerZero is built privacy-first, and that principle extends to this website. We collect the bare minimum needed for the site to function. No advertising. No marketing. No third-party tracking. No fingerprinting.

The InnerZero website sets only essential cookies for core functionality. They are listed below.

We also use Vercel Analytics for aggregate site traffic insights. It is cookieless by design and uses anonymised page-view signals only. No persistent identifier is set on your device.

Your theme preference (dark or light mode) is stored in your browser's localStorage, not in a cookie. It never leaves your device.

We do not use:

• Advertising or marketing cookies
• Third-party tracking pixels (no Google Analytics, no Facebook Pixel, no equivalent)
• Cross-site behavioural profiling
• Fingerprinting

You can clear or block cookies through your browser's settings. Doing so will prevent login and form submissions from working, since both rely on essential cookies.

10. Data Processors

We use the following third-party services:

• Supabase: authentication and database hosting (EU region)
• Vercel: website hosting and deployment
• Cloudflare Turnstile: bot-detection challenge on form submissions (United States); processes IP address and ephemeral challenge signals per Cloudflare's privacy policy. The challenge is essential for form security and is not used to track or profile you across the site.
• Ko-fi and PayPal: one-off donation payment processing
• Stripe: InnerZero Pro, cloud AI subscription, Business Licence, and credit pack payment processing
• Formspree: contact form submissions
• Resend: delivery of in-app feedback emails (your message and, if you attached one, the redacted activity log) to our support inbox (United States); processes the email content under its data processing terms

11. Data Retention and Deletion

All desktop data is stored locally on your machine and can be deleted at any time by you. Feedback messages and any attached redacted log are kept only for as long as we need them to investigate and respond, and are deleted on request via the contact address below. Account data (email address) is retained for as long as your account is active. You can permanently delete your account and all associated data at any time from your account settings page.

12. Your Rights (UK GDPR)

Under UK GDPR, you have the right to: access your personal data; correct inaccurate data; request deletion of your data; object to processing; request data portability; and withdraw consent at any time. To exercise any of these rights, contact help@innerzero.com. We will respond within 30 days.

13. Children

InnerZero is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it promptly.

14. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated date.

15. Contact

For any privacy-related questions or data requests: help@innerzero.com.