How your data is protected
Account protection
Password-based accounts use password hashing rather than storing readable passwords. Authentication uses server-validated sessions and HttpOnly cookies, which prevent ordinary browser scripts from reading those cookies. Secure cookie settings depend on deployment configuration.
The application includes controls to limit repeated sign-in attempts and other high-volume requests. Account settings provide password-change, login-activity, and account-deletion controls.
Use a unique password, keep one-time codes private, and sign out on shared devices. Email verification and password-recovery delivery are not currently complete features.
Access to your information
Community questions, replies, profiles, and shared attachments may be visible to other visitors. Do not treat a public post as private storage.
Personal AI conversations are associated with your account and use account-scoped access controls. Question-linked chat has different visibility rules: its opening AI response remains visible, while the question owner can restrict follow-up access. Making that chat private does not make the underlying community question private.
AI processing and saved preferences
AI study features send relevant messages and context to the configured AI provider to generate responses. That processing is distinct from public visibility: an account-private conversation can still require provider processing.
Long-term study memory is optional. You can manage saved preferences in Settings, remove individual memories, or turn memory off to delete those preferences. Conversation history is managed separately.
AI responses can be inaccurate. Do not include passwords, sign-in codes, identity documents, or unnecessary sensitive information in prompts or attachments.
Upload and content checks
Images undergo format validation and automated screening for potentially explicit sexual content. Text screening checks for inappropriate language. Those moderation checks use a private local service; they are separate from the external AI study provider.
PDF uploads have structural, size, and page-count checks. They do not receive a complete content review or antivirus certification. Automated checks can make mistakes and do not guarantee that every accepted file is safe or appropriate.
Application safeguards
The application includes server-side permission checks, parameterized database queries, request limits, upload limits, and sanitization for rendered AI content. AI output does not grant account permissions or authorize actions.
Request controls help reduce spam and excessive resource use. Their effectiveness depends on deployment and infrastructure configuration; their presence is not a promise of uninterrupted availability or protection against every attack.
Service providers
The project uses PostgreSQL for application data, Appwrite for uploaded files, and Gemini for AI study responses. Supabase-hosted PostgreSQL is part of the documented deployment setup. Optional sign-in and notification integrations process the information needed for those features when enabled.
External providers have their own terms and data practices. This page does not promise a particular data-storage country, provider retention period, or end-to-end encryption for AI conversations.
Your controls
You have direct control over your profile, interactions, study memory, and account lifecycle.
Profile visibility
Edit or remove optional details you choose to show on your public profile anytime from Settings.
Authentication & login monitoring
Review active login sessions and change your account password through account settings.
AI memory & chat privacy
Manage long-term AI study memory, delete individual stored preferences, or set question-chat visibility.
Content management
Delete questions or replies you have created using in-app deletion buttons.
Complete account deletion
Request permanent account deletion after completing identity verification. Deletion removes associated records, including authored questions, replies, and personal AI conversations. Uploaded-file cleanup may complete later.
Compliance and assurance
ApilageAI does not claim SOC 2, ISO 27001, or other independent security certification on this page. It also does not claim comprehensive compliance with every privacy law or suitability for regulated records.
Security work is ongoing. Implemented safeguards alone do not establish that a deployment has completed a production security review. Schools and organizations should confirm their privacy, safeguarding, procurement, and data-handling requirements before adopting the service for institutional use.
Please review our Privacy Policy and Terms and Conditions for additional information.
Raising a security concern
🛡️ Responsible Disclosure
Use an available official private contact channel to share a suspected security issue. Describe the affected feature, what you observed, and the minimum steps needed to reproduce it using your own test data.
Do not include credentials, another person’s records, or private conversations in a public issue. Avoid accessing other users’ information or disrupting the service to demonstrate a problem. No response deadline or bug-bounty payment is promised here.