{ "feedVersion": 2, "generatedFrom": "verifywise.ai/ai-trust-index", "meta": { "name": "VerifyWise AI App Trust & Transparency Index", "scopeStatement": "Every grade scores what an app discloses about its data governance in its public privacy policy and terms, not its verified behaviour. A strong policy can hide weak practice, and a thin policy can hide good practice.", "rubricVersion": "1.2", "model": "temperature-0 automated scoring", "rankingSource": "a16z Top 100 Gen AI Consumer Apps, 6th Edition (Mar 2026)", "rankingSourceUrl": "https://a16z.com/100-gen-ai-apps-6/", "assessedDate": "2026-06-20", "methodologyNote": "Apps are scored across 7 data-governance domains (training-data use, data-subject rights, retention, third-party sharing, transparency, sensitive data & children, security & accountability) on a 10-point additive scale, scaled to 100. Every score is anchored to a quoted clause or a recorded silence. An app with an active dealbreaker clause (sells data with no opt-out, claims a perpetual content licence, or refuses deletion) is capped at a displayed B." }, "design": { "gradeStyles": { "A": { "bg": "#13715B", "text": "#ffffff", "ring": "#13715B", "label": "Strong disclosure" }, "B": { "bg": "#2E8B6F", "text": "#ffffff", "ring": "#2E8B6F", "label": "Good disclosure" }, "C": { "bg": "#C8941E", "text": "#ffffff", "ring": "#C8941E", "label": "Partial disclosure" }, "D": { "bg": "#C2683B", "text": "#ffffff", "ring": "#C2683B", "label": "Weak disclosure" }, "F": { "bg": "#B23B3B", "text": "#ffffff", "ring": "#B23B3B", "label": "Poor disclosure" } }, "gradeBands": [ { "grade": "A", "range": "85–100" }, { "grade": "B", "range": "70–84" }, { "grade": "C", "range": "55–69" }, { "grade": "D", "range": "40–54" }, { "grade": "F", "range": "0–39" } ], "faviconUrlTemplate": "https://icons.duckduckgo.com/ip3/{domain}.ico" }, "count": 53, "apps": [ { "slug": "claude", "name": "Claude", "vendor": "Anthropic", "domain": "claude.ai", "category": "Assistant", "scoreOutOf100": 83, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "The strongest policy in the set, though consumer chats train by default, which caps it below A.", "highlights": [ { "label": "Training", "text": "Trains by default with a named account-settings opt-out." }, { "label": "Deletion", "text": "Explicit deletion; conversations purged from the backend within 30 days." }, { "label": "Transfers", "text": "Adequacy decisions and Standard Contractual Clauses named." }, { "label": "Accountability", "text": "Named DPO; ISO 42001 and SOC 2 claimed on the Trust Center." } ], "policyUrl": "https://www.anthropic.com/legal/privacy", "policyLastUpdated": "2026-06-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/claude.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" } ], "lastChange": null } }, { "slug": "chatgpt", "name": "ChatGPT", "vendor": "OpenAI", "domain": "openai.com", "category": "Assistant", "scoreOutOf100": 76, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Full rights suite and a 30-day deletion window; trains by default with a clear opt-out.", "highlights": [ { "label": "Training", "text": "Trains by default; a named control turns model training off." }, { "label": "Deletion", "text": "Deleted data removed within 30 days." }, { "label": "Selling", "text": "Does not sell; Free/Go tiers see personalised ads with an opt-out." }, { "label": "Transfers", "text": "Acknowledged, but no specific mechanism named." } ], "policyUrl": "https://openai.com/policies/privacy-policy/", "policyLastUpdated": "2026-04-28", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/openai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 76, "grade": "B" } ], "lastChange": null } }, { "slug": "perplexity", "name": "Perplexity", "vendor": "Perplexity AI", "domain": "perplexity.ai", "category": "Assistant", "scoreOutOf100": 74, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A concise policy that still grants real rights, and it scores on substance rather than length.", "highlights": [ { "label": "Training", "text": "AI-training opt-out available in settings." }, { "label": "Rights", "text": "Access, delete, correct, portability, restriction and objection." }, { "label": "Selling", "text": "Does not sell; SCCs and the EU-US Data Privacy Framework named." }, { "label": "Retention", "text": "Aims to delete within 30 days of account deletion." } ], "policyUrl": "https://www.perplexity.ai/hub/legal/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/perplexity.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" } ], "lastChange": null } }, { "slug": "gemini", "name": "Gemini", "vendor": "Google", "domain": "gemini.google.com", "category": "Assistant", "scoreOutOf100": 72, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A 'Keep Activity' toggle stops training; long default retention and human review weigh it down.", "highlights": [ { "label": "Training", "text": "Trains by default; 'Keep Activity' off stops future-chat training." }, { "label": "Retention", "text": "Default auto-delete 18 months (adjustable to 3); temporary chats 72h." }, { "label": "Transparency", "text": "Human reviewers disclosed; reviewed chats kept up to 3 years." } ], "policyUrl": "https://support.google.com/gemini/answer/13594961", "policyLastUpdated": "2026-05-19", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gemini.google.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" } ], "lastChange": null } }, { "slug": "meta-ai", "name": "Meta AI", "vendor": "Meta", "domain": "meta.ai", "category": "Assistant", "scoreOutOf100": 64, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Graded on the shared Meta privacy policy: your AI interactions help develop Meta's AI and AI for third parties, with no training opt-out named.", "highlights": [ { "label": "Training", "text": "Interactions with AI at Meta develop and improve AI for Meta products and for third parties; no training opt-out is named in the policy." }, { "label": "Selling", "text": "States it does not sell your information and never will, and binds partners by contract." }, { "label": "Retention", "text": "Kept as long as needed on a case-by-case basis, with no fixed window stated." }, { "label": "Children", "text": "Access to AIs is blocked under age 13, and sensitive categories such as religion, sexual orientation and health need explicit consent." } ], "policyUrl": "https://www.facebook.com/privacy/policy/", "policyLastUpdated": "2025-12-16", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/meta.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" } ], "lastChange": null } }, { "slug": "canva", "name": "Canva", "vendor": "Canva", "domain": "canva.com", "category": "Productivity", "scoreOutOf100": 73, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Named AI-training opt-out and mature rights; sharing data with ad partners is the drag.", "highlights": [ { "label": "Training", "text": "Trains AI on user content with a named opt-out; never on Canva Education." }, { "label": "Transfers", "text": "EU Model Clauses and the Data Privacy Framework named." }, { "label": "Sharing", "text": "Shares data with ad partners (with an opt-out)." } ], "policyUrl": "https://www.canva.com/policies/privacy-policy/", "policyLastUpdated": "2026-04-15", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/canva.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 73, "grade": "B" } ], "lastChange": null } }, { "slug": "elevenlabs", "name": "ElevenLabs", "vendor": "ElevenLabs", "domain": "elevenlabs.io", "category": "Audio", "scoreOutOf100": 71, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Treats voiceprints as biometric data with a named retention limit; trains on voice data.", "highlights": [ { "label": "Biometrics", "text": "Voice data treated as biometric; voice models kept max 3 years; no profiling." }, { "label": "Rights", "text": "Full suite via account and an online request form." }, { "label": "Transfers", "text": "Certified to the EU-US Data Privacy Framework." }, { "label": "Sharing", "text": "Cookie/ad sharing with an opt-out." } ], "policyUrl": "https://elevenlabs.io/privacy-policy", "policyLastUpdated": "2026-05-20", "modalities": [ "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/elevenlabs.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 71, "grade": "B" } ], "lastChange": null } }, { "slug": "character-ai", "name": "Character.AI", "vendor": "Character Technologies", "domain": "character.ai", "category": "Companion", "scoreOutOf100": 60, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Better rights disclosure than most companion apps, but data is shared for advertising.", "highlights": [ { "label": "Training", "text": "Trains on user data and public sources; no opt-out stated." }, { "label": "Rights", "text": "Access, portability, object, correct, delete." }, { "label": "Selling", "text": "Offers an opt-out of sales and targeted advertising, which implies data is shared." }, { "label": "Children", "text": "Not for under-13 (under-16 in the EEA/UK)." } ], "policyUrl": "https://character.ai/privacy", "policyLastUpdated": "2025-08-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/character.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" } ], "lastChange": null } }, { "slug": "deepseek", "name": "DeepSeek", "vendor": "Hangzhou DeepSeek AI", "domain": "deepseek.com", "category": "Assistant", "scoreOutOf100": 57, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Solid rights, but data is stored in China with only vague transfer safeguards.", "highlights": [ { "label": "Training", "text": "Trains on user inputs; no opt-out stated." }, { "label": "Transfers", "text": "Data stored in the People's Republic of China; only 'appropriate safeguards'." }, { "label": "Rights", "text": "Full suite incl. portability; no automated decision-making / profiling." }, { "label": "Retention", "text": "Vague, no number given." } ], "policyUrl": "https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html", "policyLastUpdated": "2026-02-10", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/deepseek.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" } ], "lastChange": null } }, { "slug": "grok", "name": "Grok", "vendor": "xAI", "domain": "x.ai", "category": "Assistant", "scoreOutOf100": 54, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Trains by default with no general opt-out, and no 'we don't sell' statement.", "highlights": [ { "label": "Training", "text": "Trains by default; only Google-OAuth content excluded. Private Chat deletes in 30 days." }, { "label": "Rights", "text": "Access, correct, update, delete; portability not explicitly named." }, { "label": "Selling", "text": "No explicit 'we do not sell' in the main policy." }, { "label": "Children", "text": "Under-13 gate with 13–17 parental supervision." } ], "policyUrl": "https://x.ai/legal/privacy-policy", "policyLastUpdated": "2026-04-04", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/x.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 54, "grade": "D" } ], "lastChange": null } }, { "slug": "janitor-ai", "name": "Janitor AI", "vendor": "JanitorAI Inc.", "domain": "janitorai.com", "category": "Companion", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Grants real rights and doesn't sell, but stays silent on training, retention, and breaches.", "highlights": [ { "label": "No dealbreaker", "text": "Does not sell; grants access, portability, correction and deletion; named security controls." }, { "label": "Silence", "text": "No training opt-out, vague retention, no breach-notification commitment." }, { "label": "Children", "text": "18+ age gate." } ], "policyUrl": "https://janitorai.com/policy", "policyLastUpdated": "2025-12-11", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/janitorai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 47, "grade": "D" } ], "lastChange": null } }, { "slug": "leonardo-ai", "name": "Leonardo.Ai", "vendor": "Leonardo Interactive (a Canva brand)", "domain": "leonardo.ai", "category": "Image & video", "scoreOutOf100": 93, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Strong data rights and opt-out controls for training and ads, with named transfer safeguards; the gap is no synthetic-image marking.", "highlights": [ { "label": "Training", "text": "Free content is trained on by default; paid subscribers opt out via private mode, and tier differences are disclosed." }, { "label": "Rights", "text": "Access, deletion, portability, correction and objection, plus an opt-out of ad sharing and sales." }, { "label": "Transfers", "text": "EU Model Clauses and the UK International Data Transfer Addendum named; adequacy referenced." }, { "label": "Transparency gap", "text": "The policy does not say generated images are AI-created or commit to marking synthetic output." } ], "policyUrl": "https://leonardo.ai/privacy-policy/", "policyLastUpdated": "2026-01-19", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/leonardo.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 93, "grade": "A" } ], "lastChange": null } }, { "slug": "notion", "name": "Notion", "vendor": "Notion Labs", "domain": "notion.com", "category": "Productivity", "scoreOutOf100": 89, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "A no-train-by-default commitment with named encryption, certifications, deletion timelines and SCCs; the cleanest policy in the set.", "highlights": [ { "label": "Training", "text": "No-train default, with a contractual ban on AI sub-processors training on customer data; zero retention on Enterprise, 30 days otherwise." }, { "label": "Deletion", "text": "Full server deletion 30 days after workspace deletion, with markdown export for portability." }, { "label": "Transfers", "text": "Standard Contractual Clauses named for EU and UK transfers, with annual sub-processor reviews." }, { "label": "Security", "text": "AES-256 at rest, TLS 1.2+ in transit, SOC 2 Type 2 and ISO 27001, plus a bug-bounty program." } ], "policyUrl": "https://www.notion.com/trust/privacy-policy", "policyLastUpdated": "2025-04-10", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/notion.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 89, "grade": "A" } ], "lastChange": null } }, { "slug": "photoroom", "name": "Photoroom", "vendor": "Photoroom", "domain": "photoroom.com", "category": "Image & video", "scoreOutOf100": 86, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "A named training opt-out, an explicit no-sell commitment, full rights and detailed retention periods; light on named security controls.", "highlights": [ { "label": "Training", "text": "Trains on user images by default, with a clear opt-out in account settings and an API exemption." }, { "label": "Sharing", "text": "Explicit no-sell policy, with named sub-processors (Apple, RevenueCat, Dub) for defined purposes." }, { "label": "Deletion", "text": "Full rights including access, deletion, correction, portability and objection, with a 30-day deletion timeline." }, { "label": "Security", "text": "Named DPO and CNIL contact, but no specific encryption standards or breach-notification procedure." } ], "policyUrl": "https://www.photoroom.com/legal/privacy", "policyLastUpdated": "2026-03-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/photoroom.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 86, "grade": "A" } ], "lastChange": null } }, { "slug": "grammarly", "name": "Grammarly", "vendor": "Grammarly", "domain": "grammarly.com", "category": "Productivity", "scoreOutOf100": 80, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "An opt-out of AI training, a full rights suite and strong transfer safeguards; missing breach notice and a concrete deletion timeline.", "highlights": [ { "label": "Training", "text": "Users can opt out of AI model training in account settings." }, { "label": "Rights", "text": "Access, deletion, portability and correction across all product variants." }, { "label": "Transfers", "text": "EU-US Data Privacy Framework certified, with Standard Contractual Clauses for other routes." }, { "label": "Gaps", "text": "No breach-notification procedure, no concrete deletion timeline, and no point-of-use AI disclosure." } ], "policyUrl": "https://www.grammarly.com/privacy-policy", "policyLastUpdated": "2025-10-29", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/grammarly.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 80, "grade": "B" } ], "lastChange": null } }, { "slug": "kling-ai", "name": "Kling AI", "vendor": "Kuaishou", "domain": "klingai.com", "category": "Image & video", "scoreOutOf100": 74, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Solid regional protections for children and transfers, but the global policy stays silent on training use and synthetic-output marking.", "highlights": [ { "label": "Training", "text": "The policy lists processing purposes but never says whether personal data is used for model training." }, { "label": "Rights", "text": "Access, correction and deletion, with a 30-day access-request window in the Singapore section." }, { "label": "Transfers", "text": "Singapore terms promise comparable protection, but no SCCs or named mechanism for other regions." }, { "label": "Children", "text": "Regional sections set a minimum age of 16 with parental consent; the global section lacks a clear age rule." } ], "policyUrl": "https://kling.ai/docs/privacy-policy", "policyLastUpdated": "2026-04-21", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/klingai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" } ], "lastChange": null } }, { "slug": "faceapp", "name": "FaceApp", "vendor": "FaceApp", "domain": "faceapp.com", "category": "Image & video", "scoreOutOf100": 72, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "Terms grant FaceApp a perpetual, irrevocable, worldwide licence to use and create derivative works from any user feedback, for any purpose." ], "summary": "Photos are not used for training and auto-delete within 48 hours, but a perpetual licence to user feedback trips a dealbreaker flag.", "highlights": [ { "label": "Training", "text": "Photos and videos are not used for training beyond providing the editing features." }, { "label": "Biometrics", "text": "Facial data is encrypted with locally-stored keys and cached only 24 to 48 hours before automatic deletion." }, { "label": "Transfers", "text": "Standard Contractual Clauses named, with encryption, pseudonymisation and a process to challenge unlawful government requests." }, { "label": "Rights", "text": "Access, deletion, correction and portability; photos can be removed from the cloud before auto-deletion." } ], "policyUrl": "https://www.faceapp.com/privacy", "policyLastUpdated": "2024-11-04", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/faceapp.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" } ], "lastChange": null } }, { "slug": "microsoft-copilot", "name": "Microsoft Copilot", "vendor": "Microsoft", "domain": "copilot.microsoft.com", "category": "Assistant", "scoreOutOf100": 69, "letterGrade": "C", "displayedGrade": "C", "confidence": "Low", "dealbreakerFlags": [], "summary": "The shared Microsoft policy allows training but is thin on Copilot-specific retention, deletion timelines and output ownership.", "highlights": [ { "label": "Training", "text": "Data may be used to develop and train AI models, with no opt-in or tier differences disclosed." }, { "label": "Deletion", "text": "Retention is context-dependent with no named period for Copilot chats; deletion is by request." }, { "label": "Output ownership", "text": "The policy does not say whether users own generated output or bound Microsoft's reuse." }, { "label": "Transparency", "text": "Copilot is labelled as AI and the policy is dated, but synthetic-image marking is absent." } ], "policyUrl": "https://privacy.microsoft.com/en-us/privacystatement", "policyLastUpdated": "2026-03-01", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/copilot.microsoft.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" } ], "lastChange": null } }, { "slug": "midjourney", "name": "Midjourney", "vendor": "Midjourney", "domain": "midjourney.com", "category": "Image & video", "scoreOutOf100": 62, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Users grant Midjourney a perpetual, irrevocable, sublicensable licence to reproduce and distribute their outputs for any purpose." ], "summary": "Users own their images but grant Midjourney a perpetual licence to reuse them, and prompts and outputs train the model unless declined.", "highlights": [ { "label": "Training", "text": "The policy trains on user prompts and outputs; there is no named opt-out, though deletion requests can affect model updates." }, { "label": "Output ownership", "text": "Users own generated assets but grant a perpetual, worldwide, sublicensable licence to reproduce and distribute them." }, { "label": "Rights", "text": "European users get access, deletion, portability and correction; California residents can opt out of cookie sharing." }, { "label": "Retention", "text": "Data is kept 'as long as necessary' with no numeric window given." } ], "policyUrl": "https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy", "policyLastUpdated": "2025-06-02", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/midjourney.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" } ], "lastChange": null } }, { "slug": "civitai", "name": "Civitai", "vendor": "Civitai", "domain": "civitai.com", "category": "Image & video", "scoreOutOf100": 46, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A short 2024 policy that explains what it collects and shares but stays silent on AI training, retention periods, formal data rights, and labelling of generated images.", "highlights": [ { "label": "Training", "text": "Mentions only improving its services; it never says whether user content trains AI models, and names no opt-out." }, { "label": "Rights", "text": "The 'Your Choices' section covers email unsubscribe; it does not state access, deletion or portability rights." }, { "label": "Retention", "text": "No retention period is given for any category of data." }, { "label": "Children", "text": "Does not knowingly collect data from anyone under 13, and asks for reports to hello@civitai.com." } ], "policyUrl": "https://civitai.com/content/privacy", "policyLastUpdated": "2024-02-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/civitai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 46, "grade": "D" } ], "lastChange": null } }, { "slug": "pixelcut", "name": "Pixelcut", "vendor": "Pixelcut", "domain": "pixelcut.ai", "category": "Image & video", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A generic compliance policy with a full set of data rights, but it never mentions AI at all: nothing on whether your images train models or whether outputs are marked.", "highlights": [ { "label": "Rights", "text": "Grants access, erasure, rectification, portability, objection and restriction of processing." }, { "label": "Training", "text": "For an AI image editor, the policy says nothing about model training or any opt-out." }, { "label": "Transfers", "text": "Data can leave the EU and UK on the user's explicit consent, with no adequacy decision or named safeguard." }, { "label": "Retention", "text": "Kept as long as the collection purpose requires, with no fixed period stated." } ], "policyUrl": "https://www.pixelcut.ai/privacy", "policyLastUpdated": "2026-05-18", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pixelcut.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 45, "grade": "D" } ], "lastChange": null } }, { "slug": "freepik", "name": "Freepik", "vendor": "Freepik Company (Magnific)", "domain": "magnific.com", "category": "Image & video", "scoreOutOf100": 80, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A detailed GDPR policy (Freepik now trades as Magnific) that deletes uploaded images right after generation and caps model-provider retention at 30 days.", "highlights": [ { "label": "Inputs", "text": "Images and audio you upload are deleted immediately after the synthetic content is generated from them." }, { "label": "Training", "text": "Uses content for AI development only in aggregate form, and excludes image-rights documents from model training." }, { "label": "Rights", "text": "Full GDPR suite: access, rectification, erasure, restriction, portability and withdrawal of consent." }, { "label": "Selling", "text": "States it does not sell or share sensitive personal information, nor data about anyone under 16." } ], "policyUrl": "https://www.magnific.com/legal/privacy", "policyLastUpdated": "2026-04-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/magnific.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 80, "grade": "B" } ], "lastChange": null } }, { "slug": "picsart", "name": "Picsart", "vendor": "Picsart", "domain": "picsart.com", "category": "Image & video", "scoreOutOf100": 68, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A thorough rights-and-retention policy with standard contractual clauses named, but it predates the AI features and never addresses model training.", "highlights": [ { "label": "Rights", "text": "EU and UK users get access, correction, deletion, restriction and portability; transfers use standard contractual clauses." }, { "label": "Training", "text": "Says nothing about whether your images train AI models, despite offering AI generation and editing tools." }, { "label": "Retention", "text": "Held until you delete your account; some data kept up to three years, or indefinitely for policy violators." }, { "label": "Biometrics", "text": "Scans face geometry from uploaded images and calls it biometric data; under-14s are barred." } ], "policyUrl": "https://picsart.com/privacy-policy/", "policyLastUpdated": "2023-11-16", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/picsart.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" } ], "lastChange": null } }, { "slug": "higgsfield", "name": "Higgsfield", "vendor": "Higgsfield", "domain": "higgsfield.ai", "category": "Image & video", "scoreOutOf100": 66, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Openly says it trains its algorithms on your prompts and uploads with no opt-out, but balances that with named deletion windows and a full rights suite.", "highlights": [ { "label": "Training", "text": "States plainly that your text, media, queries and prompts train its algorithms, and names no training opt-out." }, { "label": "Deletion", "text": "Cancelled accounts become inaccessible at once and are purged within 90 days; removed content lingers up to 30." }, { "label": "Rights", "text": "Access, deletion, objection and the rest of the GDPR suite, with adequacy decisions and the EU-US framework named." }, { "label": "Children", "text": "Not intended for anyone under 18." } ], "policyUrl": "https://higgsfield.ai/privacy-policy", "policyLastUpdated": "2025-08-30", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/higgsfield.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" } ], "lastChange": null } }, { "slug": "ideogram", "name": "Ideogram", "vendor": "Ideogram", "domain": "ideogram.ai", "category": "Image & video", "scoreOutOf100": 63, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Trains the models behind its service on your data as a legitimate interest with no opt-out, but commits clearly to never selling or sharing personal information.", "highlights": [ { "label": "Training", "text": "Names training the models that power the service among its uses, with no opt-out, and does not honour Do Not Track." }, { "label": "Selling", "text": "States it does not sell or share personal information, and has not in the past 12 months." }, { "label": "Rights", "text": "Access and deletion rights, with a CCPA data table listing what it collects and discloses." }, { "label": "Retention", "text": "Kept as long as reasonably necessary, with no fixed window stated." } ], "policyUrl": "https://ideogram.ai/legal/privacy", "policyLastUpdated": "2025-01-15", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/ideogram.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" } ], "lastChange": null } }, { "slug": "manus", "name": "Manus", "vendor": "Manus", "domain": "manus.im", "category": "Assistant", "scoreOutOf100": 62, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A recent agentic-assistant policy with solid transfer and advertising controls, but it never says whether your tasks and prompts train any model.", "highlights": [ { "label": "Training", "text": "Silent on model training; the only opt-outs cover marketing and targeted-advertising sharing." }, { "label": "Rights", "text": "Access, correction and deletion, routed through the Team Owner first for workspace data." }, { "label": "Transfers", "text": "Uses adequacy decisions and approved frameworks for international transfers." }, { "label": "Retention", "text": "No fixed window; says it purges customer data when customers leave the service." } ], "policyUrl": "https://manus.im/privacy", "policyLastUpdated": "2026-04-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/manus.im.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" } ], "lastChange": null } }, { "slug": "quillbot", "name": "QuillBot", "vendor": "Learneo", "domain": "quillbot.com", "category": "Productivity", "scoreOutOf100": 69, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A detailed multi-service policy that uses your inputs to improve its AI models, paired with a full rights suite and named transfer safeguards.", "highlights": [ { "label": "Training", "text": "Uses user inputs to help improve its AI models, without a clearly named training opt-out." }, { "label": "Rights", "text": "Access, update, correction and deletion across its services." }, { "label": "Selling", "text": "States it does not currently sell personal data under CCPA and Nevada definitions." }, { "label": "Children", "text": "Does not knowingly collect from under-13s; under-16 in the EEA needs parental consent." } ], "policyUrl": "https://quillbot.com/privacy", "policyLastUpdated": "2025-11-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/quillbot.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" } ], "lastChange": null } }, { "slug": "kimi", "name": "Kimi", "vendor": "Moonshot AI", "domain": "kimi.com", "category": "Assistant", "scoreOutOf100": 67, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Trains on user content (prompts, audio, images, videos, files) by default with no opt-out named in the policy." ], "summary": "Grants a full set of GDPR-style rights and says it does not sell data. It also trains on your content by default with no opt-out, and retention is vague.", "highlights": [ { "label": "Trains on inputs by default with no opt-out", "text": "User Content including prompts, audio, images, videos, and files is processed to provide and improve the Services, including training and optimizing the models, with the legal basis given as legitimate interests or consent depending on jurisdiction. The policy names no general training opt-out toggle. That absence sets the training dealbreaker flag." }, { "label": "Full data-subject rights", "text": "The policy grants explicit rights of access, rectification, erasure, restriction, data portability in a structured machine-readable format, objection, and consent withdrawal, with requests routed to membership@moonshot.ai." }, { "label": "Does not sell, sharing enumerated", "text": "It states the company does not sell personal information and lists processor categories such as hosting, payment, analytics, and security partners, though it does not link a named sub-processor list or DPA." }, { "label": "Vague retention and no named transfer safeguard", "text": "Retention is held only for as long as necessary with no day-count, deletion on account closure carries no timeline number, and international transfers cite appropriate safeguards and adequate protection without naming SCCs, adequacy, or DPF." } ], "policyUrl": "https://www.kimi.com/user/agreement/userPrivacy?version=v2", "policyLastUpdated": "2025-07-07", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/kimi.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" } ], "lastChange": null } }, { "slug": "mistral-le-chat", "name": "Mistral Le Chat", "vendor": "Mistral AI", "domain": "mistral.ai", "category": "Assistant", "scoreOutOf100": 84, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A detailed GDPR policy with strong rights, an account-level training opt-out, named retention windows, and a clear statement that it does not sell or run targeted advertising.", "highlights": [ { "label": "Training opt-out exists but is on by default", "text": "The policy uses Le Chat inputs and outputs to train models subject to your opt-out, and offers a control to object to the use of your input and output data for model training directly from your account. Paid API use and Le Chat Enterprise are excluded from training. Training by default with an opt-out keeps the grade at B." }, { "label": "Does not sell or share for advertising", "text": "Mistral states it has not sold, shared, or engaged in targeted advertising with any consumer personal data in the preceding 12 months, which earns full credit on the ad-sharing indicator." }, { "label": "Concrete retention with user-controlled deletion", "text": "Le Chat inputs and outputs are kept until you delete your account or delete the conversation. API inputs default to thirty rolling days for abuse monitoring with a zero-data-retention option, and named multi-year ladders cover identity, account, billing, and lead data." }, { "label": "Named international safeguard and DPO, thinner security detail", "text": "International transfers rely on the European Commission Standard Contractual Clauses under Article 46 GDPR, and a Data Protection Officer is named with a contact route. Security safeguards are described only generically, and breach notification is silent." } ], "policyUrl": "https://legal.mistral.ai/terms/privacy-policy", "policyLastUpdated": "2026-04-07", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/mistral.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 84, "grade": "B" } ], "lastChange": null } }, { "slug": "seaart", "name": "SeaArt", "vendor": "SeaArt", "domain": "seaart.ai", "category": "Image & video", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "A 2023 policy that spells out a full set of data rights but stays silent on whether prompts and generated images train its models, with only vague retention and security.", "highlights": [ { "label": "Strong, named user rights", "text": "The rights section grants access, deletion, portability in a machine-readable format, correction, restriction, and objection, each routed to customer@seaart.ai, so the data-subject rights domain scores near full." }, { "label": "Silent on AI training", "text": "Nothing in the policy says whether prompts or generated images feed model training, and there is no training opt-out, so every training-data indicator resolves to silent rather than a disclosed safeguard or an adverse reservation." }, { "label": "Vague retention and security", "text": "Data is kept until the end of its life cycle with no day-count or deletion timeline, and security is described only as administrative, physical and technical measures with no named TLS, encryption, breach window, or certification." }, { "label": "Advertising data shared without an opt-out", "text": "The policy collects data for advertising and shares it with partners for advertising and analysis, yet it never states it does not sell data nor offers an advertising opt-out, leaving that indicator unearned as silent." } ], "policyUrl": "https://node1.cdn2.seaart.ai/mirror/static/upload/policy.html", "policyLastUpdated": "2023-07-03", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/seaart.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 44, "grade": "D" } ], "lastChange": null } }, { "slug": "talkie", "name": "Talkie", "vendor": "Talkie AI", "domain": "talkie-ai.com", "category": "Companion", "scoreOutOf100": 59, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Grants full data rights and maps each purpose to a legal basis, but never says whether conversations train its models and keeps retention vague while sharing browsing data with advertisers.", "highlights": [ { "label": "Data-subject rights", "text": "The policy grants access, deletion, correction, portability in a portable machine-readable format, and the ability to object and withdraw consent. Account deletion is available directly in account settings." }, { "label": "Retention is vague", "text": "Talkie commits only to retaining personal information for as long as necessary to fulfil the purposes it was collected for. There is no day-count, no deletion timeline, and no shorter window for conversation logs." }, { "label": "Advertising sharing with opt-out", "text": "Talkie shares website visit data such as IP address, advertising ID, and clicked links with advertising partners and treats this as a sale or share under CCPA, while providing a Your Privacy Choices opt-out and honoring global privacy control signals. It states it will never share conversation content for advertising." }, { "label": "Training disclosure gap", "text": "The policy says the chatbot learns from your interactions to improve your conversations and limits feature improvement to aggregated and anonymized data. It never states whether raw conversations train AI models and offers no training opt-out." } ], "policyUrl": "https://www.talkie-ai.com/static/privacy", "policyLastUpdated": "2025-12-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/talkie-ai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" } ], "lastChange": null } }, { "slug": "cutout-pro", "name": "Cutout.Pro", "vendor": "Cutout.Pro", "domain": "cutout.pro", "category": "Image & video", "scoreOutOf100": 59, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "States plainly that it does not train on uploads and does not share data, and gives short numbered retention windows. It says nothing about portability, breach notice, certifications, or versioning.", "highlights": [ { "label": "Uploads not used to train", "text": "The policy says it will only use uploads to perform requested image or video processing and does not use the photos for any reason other than providing the editing functionality." }, { "label": "Short, numbered retention", "text": "Edited photos remain in the cloud for a very short period of 24 to 48 hours, and all server logs are stored for no longer than 3 months." }, { "label": "No third-party sharing or selling", "text": "A share or publish of information to any third parties is prohibited, with AWS and Google Analytics named as the only processors." }, { "label": "Thin on rights and accountability", "text": "Access and self-service deletion are granted. The policy says nothing about portability, rectification, breach notification, certifications, a DPO, international-transfer safeguards, or children's age gating, and it carries no version or effective date." } ], "policyUrl": "https://www.cutout.pro/privacy", "policyLastUpdated": null, "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cutout.pro.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" } ], "lastChange": null } }, { "slug": "hypic", "name": "Hypic", "vendor": "Hypic", "domain": "hypic.com", "category": "Image & video", "scoreOutOf100": 64, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Trains its machine learning models on user content by default, with no opt-out disclosed in the policy." ], "summary": "Names strong rights, transfer safeguards, and careful face-data handling, but it trains its models on your content by default with no opt-out and keeps retention vague.", "highlights": [ { "label": "Trains by default, no opt-out", "text": "The policy lists a purpose to train and improve our technology, such as our machine learning models and algorithms, on a legitimate-interests basis. No opt-out mechanism for model training appears anywhere in the document, which makes this an explicit adverse reservation rather than silence." }, { "label": "Strong face-data minimization", "text": "Images collected to provide face features are deleted promptly after the feature runs and are not retained. Hypic states it does not use face or body information to identify people and does not share that information with third parties." }, { "label": "Full rights with named transfer safeguards", "text": "The EEA section grants access, rectification, erasure, portability, objection, and consent withdrawal. It names adequacy decisions under Article 45 and standard contractual clauses under Article 46 as the transfer safeguards it relies on." }, { "label": "Vague retention, no global timeline", "text": "The main policy keeps information for as long as necessary and for as long as you have an account, with no global day-count. Concrete numbers appear only in country supplements such as Indonesia five years and the Korea statutory periods." } ], "policyUrl": "https://m.hypic.com/clause/hypic-privacy-policy", "policyLastUpdated": "2026-01-22", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/hypic.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" } ], "lastChange": null } }, { "slug": "facemoji", "name": "Facemoji", "vendor": "Facemoji", "domain": "facemojikeyboard.com", "category": "Image & video", "scoreOutOf100": 69, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Discloses strong rights and concrete retention numbers, but it sells personal information for advertising (with an opt-out) and collects biometric face scans with no governance regime.", "highlights": [ { "label": "Sells data with opt-out", "text": "The California notice states that Facemoji sells Internet/Network and Other Information to third parties subject to a Do Not Sell or Share My Information link. The sale is disclosed and an opt-out exists, so it scores as a sale with opt-out rather than an adverse no-opt-out reservation." }, { "label": "Concrete retention window", "text": "The policy retains information for as long as needed plus thirty days thereafter before deletion or anonymization, and translation text is stored encrypted for only seven days before deletion. Both give real day-count anchors instead of vague language." }, { "label": "Biometric collection without governance", "text": "The CCPA table marks eBiometric Information such as face, eye or other biometric scans as collected, and the policy describes developing facial recognition technology. There is no biometric-specific consent, notice, or retention regime to govern it." }, { "label": "Generic security and vague breach handling", "text": "Security rests on commercially reasonable physical, administrative, and technological safeguards with no named standard such as TLS or AES-256, and breach notice is promised in accordance with applicable laws with no stated timeframe." } ], "policyUrl": "https://www.facemojikeyboard.com/page/privacy/appstore/privacy.html", "policyLastUpdated": "2025-11-11", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/facemojikeyboard.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" } ], "lastChange": null } }, { "slug": "gamma", "name": "Gamma", "vendor": "Gamma Tech, Inc.", "domain": "gamma.app", "category": "Productivity", "scoreOutOf100": 57, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Uses personal information to train its AI models with no opt-out disclosed in the policy." ], "summary": "Grants a full slate of European data rights and names standard-form contracts for transfers, but it trains its AI models on your data with no opt-out and names no retention period or specific security controls.", "highlights": [ { "label": "Trains on user data, no opt-out", "text": "The research and development clause says Gamma may use personal information to train its artificial intelligence models, and the policy discloses no opt-out for that training, which raises the train-by-default dealbreaker on an explicit reservation." }, { "label": "Full data-subject rights for Europe", "text": "The Notice to European Users grants access, correction, deletion, a machine-readable transfer, restriction, objection, and consent withdrawal, all exercisable by email to privacy@gamma.app." }, { "label": "No concrete retention period", "text": "Retention is described only as keeping data to fulfil the purposes for which it was collected, with no fixed number named, so the disclosure stays vague rather than time-bound." }, { "label": "Named transfer safeguard, generic security", "text": "International transfers rely on adequacy decisions and standard-form contracts approved by relevant authorities, while security is described only as technical, organizational and physical safeguards with no controls such as TLS or encryption named and no breach-notice commitment." } ], "policyUrl": "https://gamma.app/privacy", "policyLastUpdated": "2025-04-10", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gamma.app.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" } ], "lastChange": null } }, { "slug": "candy-ai", "name": "Candy.AI", "vendor": "EverAI Limited", "domain": "candy.ai", "category": "Companion", "scoreOutOf100": 68, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "A detailed GDPR notice with a full rights suite and named retention windows, but it trains its models on companion chats by default with only a general objection right and stays silent on marking AI-generated media.", "highlights": [ { "label": "Trains by default with only a general objection right", "text": "Under legitimate interest the notice says it will train and develop its AI models and moderation technologies and prepare datasets for further training, which may include human review of de-identified or anonymized interactions. The only relief is the general right to object to legitimate-interest processing." }, { "label": "Full slate of GDPR rights", "text": "Section 9 grants access under Article 15, rectification, erasure, restriction, portability in a machine-readable form, free withdrawal of consent, and the right to object to legitimate-interest processing and to direct marketing." }, { "label": "Short log retention, long account retention", "text": "Debug log files are automatically deleted after 30 days, while account data is kept for three years after the last account activity and financial data for ten years." }, { "label": "Does not sell, but silent on synthetic-image marking", "text": "The notice states it will not disclose, sell, trade, or otherwise transfer personal data to third parties without consent. Despite generating images, videos, and voice notes, it says nothing about watermarking or labelling AI-generated media." } ], "policyUrl": "https://candy.ai/privacy-policy", "policyLastUpdated": "2026-05-27", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/candy.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" } ], "lastChange": null } }, { "slug": "remini", "name": "Remini", "vendor": "Bending Spoons", "domain": "remini.ai", "category": "Image & video", "scoreOutOf100": 73, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A GDPR-grounded policy that trains on user images only with explicit opt-in, names standard contractual clauses, and gives a full rights flow, though its own retention figures contradict each other (1, 14, and 15 days).", "highlights": [ { "label": "Training is opt-in for user content", "text": "User photos feed model training only in the narrow case of \"user-provided images where users have explicitly opted in to model training,\" which keeps Remini off the train-by-default ceiling." }, { "label": "Short but self-contradictory media retention", "text": "The retention section says uploaded \"images, videos and audio-recordings\" are deleted \"after 1 day,\" yet the purposes section says the same media is deleted \"after 15 days\" and unauthenticated users' media \"after 14 days.\" All three fall in the short-retention band, but the policy contradicts itself." }, { "label": "Full GDPR rights with an in-app mechanism", "text": "Access, rectification, erasure, restriction, portability, object, and withdraw-consent are all enumerated and exercisable via \"Tap Send a Privacy Request\" inside the My Account area." }, { "label": "Silent on biometric and breach handling", "text": "Despite processing images \"often of people\" for face transformations, there is no biometric-specific governance clause and no breach-notification commitment anywhere in the policy." } ], "policyUrl": "https://app.remini.ai/privacy-and-cookie-policy", "policyLastUpdated": "2026-01-20", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/remini.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 73, "grade": "B" } ], "lastChange": null } }, { "slug": "pixverse", "name": "PixVerse", "vendor": "PixVerse (AISphere)", "domain": "pixverse.ai", "category": "Image & video", "scoreOutOf100": 66, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Reserves a free, worldwide, perpetual and sublicensable licence to use, reproduce, modify, distribute, and display your content (clause 1.2(12))." ], "summary": "Names a no-sale commitment, standard contractual clauses, and one-shot facial-data deletion, but it trains on your content by default and reserves a free, worldwide, perpetual and sublicensable licence to it.", "highlights": [ { "label": "Trains by default with a vague opt-out", "text": "Clause 1.2(12) grants a license for model training and optimization unless you opt out where such option is made available, so training is on by default and the opt-out is conditional with no named mechanism." }, { "label": "Perpetual content license reserved", "text": "The same clause has users grant a free, worldwide, perpetual and sublicensable license to use, reproduce, modify, distribute, and display their Information Content, which trips the perpetual content licence dealbreaker even though it is scoped to aggregated and anonymized service improvement." }, { "label": "No sale plus named transfer safeguard", "text": "Section 1.3 commits to never selling personal and sensitive user data, and Section 8 names signing standard contractual clauses as the cross-border safeguard from its Singapore base to the United States and elsewhere." }, { "label": "Retention stays vague while facial data is one-shot", "text": "Section 4.1 retains data for no longer than is necessary with no day count, while the facial-data clause says extracted facial data is not stored or shared and is permanently deleted once processing is complete." } ], "policyUrl": "https://pixverse.ai/en/privacy-policy", "policyLastUpdated": "2026-05-07", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pixverse.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" } ], "lastChange": null } }, { "slug": "veed", "name": "VEED", "vendor": "VEED", "domain": "veed.io", "category": "Image & video", "scoreOutOf100": 74, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A detailed UK GDPR policy that limits AI training to free-tier uploads with a named opt-out, grants the full rights suite, and does not sell personal data, held back by vague retention and generic security.", "highlights": [ { "label": "Training limited to free tier with opt-out", "text": "Model training applies only to content uploaded under a Free subscription and excludes content submitted via the mobile applications. Free-tier users may object and opt out at any time, though doing so means they must leave the free tier or upgrade to a paid subscription." }, { "label": "Does not sell personal data", "text": "The policy states that VEED does not sell your personal data to third parties and requires express consent before sharing data with any third party for that party's own marketing purposes." }, { "label": "Full rights and named transfer safeguards", "text": "Section 9 sets out access, correction, erasure, objection, restriction, and portability. International transfers rely on adequacy decisions and on specific contracts approved by the UK or the European Commission, with a one-month window to respond to requests." }, { "label": "Retention and security stay vague", "text": "Retention is described only as as long as reasonably necessary, with no day-count and no shorter retention period for AI logs. Security is described as appropriate security measures, with no named TLS, encryption standard, or certification." } ], "policyUrl": "https://www.veed.io/privacy", "policyLastUpdated": "2025-01-06", "modalities": [ "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/veed.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" } ], "lastChange": null } }, { "slug": "hugging-face", "name": "Hugging Face", "vendor": "Hugging Face", "domain": "huggingface.co", "category": "Productivity", "scoreOutOf100": 49, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "This dated, GDPR-aware policy names a full subprocessor list and grants access and deletion rights. It says nothing about AI training inputs, output ownership, retention periods, or portability, which places it in the D band. No adverse reservations are present, so no dealbreaker flags apply.", "highlights": [ { "label": "Does not sell personal information", "text": "Section 3 states the company will not sell, rent or lease personal information except as provided by the policy. It also honors do-not-track signals and California opt-out requests, so the ad-sale indicator scores full. The separate disclosure of aggregated anonymous information to advertisers does not involve identifiable data, so it does not trigger an adverse reservation." }, { "label": "Named subprocessor list", "text": "Section 10 lists every third-party processor with its function and location, including AWS, Stripe, MongoDB Atlas, Google Cloud, OVHCloud and others. This earns full credit for sub-processor disclosure and third-party categories." }, { "label": "Vague retention with no deletion timeline", "text": "Retention is described only as for as long as necessary to deliver the Services and pursue legitimate interests, with no day count. Erasure is available on written request, but the policy gives no timeline for honoring it, so retention scores at the low end." }, { "label": "Silent on training and output ownership", "text": "The policy describes improving the Services and performing research. It never says whether user content trains AI models, offers no training opt-out, and grants no ownership of outputs. All four D1 indicators score zero as documented silence rather than an adverse reservation, so no perpetual-licence or train-by-default flag is raised." } ], "policyUrl": "https://huggingface.co/privacy", "policyLastUpdated": "2023-03-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/huggingface.co.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 49, "grade": "D" } ], "lastChange": null } }, { "slug": "photomath", "name": "Photomath", "vendor": "Google", "domain": "photomath.com", "category": "Productivity", "scoreOutOf100": 60, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "Uses your content to train or improve its models with no opt-out disclosed in the policy." ], "summary": "Photomath spells out a full set of GDPR-style data-subject rights and a clear no-sale commitment. On a legitimate-interest basis with no opt-out, it also uses captured images and feedback to improve its service and affiliate machine vision technologies. Retention periods are not specified, and there is no breach-notification clause.", "highlights": [ { "label": "Trains on inputs without opt-out", "text": "The policy says images and feedback are used to improve the service and affiliate machine vision technologies, relying on legitimate interest, with no named opt-out from this use. D1.1 scores zero and an adverse training reservation is recorded." }, { "label": "Full data-subject rights", "text": "Section 8 enumerates the right to be forgotten, object, rectification, access, and data portability with contact mechanisms, which earns full credit across all five D2 indicators." }, { "label": "Does not sell personal data", "text": "The policy states it does not sell, lease, rent or otherwise disclose personal data and repeats this for California residents, earning full credit on the sell-or-share indicator with no dealbreaker on sales." }, { "label": "Vague retention and silent breach response", "text": "Retention is described only as as long as it is necessary with no day count, shorter AI-log retention is not addressed, and there is no breach-notification clause, which caps the retention and security domains." } ], "policyUrl": "https://photomath.com/privacy/", "policyLastUpdated": "2023-10-31", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/photomath.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" } ], "lastChange": null } }, { "slug": "brainly", "name": "Brainly", "vendor": "Brainly sp. z o.o.", "domain": "brainly.com", "category": "Productivity", "scoreOutOf100": 62, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Explicitly promises not to train models on personal data, grants a full rights suite, and names standard contractual clauses, held back by no security, breach, or retention detail.", "highlights": [ { "label": "No training on personal data", "text": "Section 9 states twice that Brainly does not use your personal data for training models, and Notes audio recordings are transcribed locally on the device and are not stored or processed by Brainly. This is the most favorable training posture a policy can take." }, { "label": "Full data-subject rights", "text": "Section 10 grants access, correction, deletion via Preferences, portability in machine-readable form, objection, and restriction, plus an opt-out of sales and targeted advertising. Every standard right is covered." }, { "label": "Named transfer safeguard", "text": "Section 5 commits to requiring data recipients to sign and abide by the Standard Contractual Clauses approved by the European Commission. The international transfer indicator is met with a named mechanism." }, { "label": "Security and retention gaps", "text": "The policy never describes any security safeguards or breach notification process. Section 6 retains data for so long as it may be relevant to the purposes and as long as you have an account, with no fixed day-count, which leaves retention vague." } ], "policyUrl": "https://brainly.com/pages/privacy_policy", "policyLastUpdated": "2026-02-26", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/brainly.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" } ], "lastChange": null } }, { "slug": "notebooklm", "name": "NotebookLM", "vendor": "Google", "domain": "notebooklm.google", "category": "Productivity", "scoreOutOf100": 81, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Keeps user content out of foundational model training by default (only used if you send thumbs up or down feedback), lets you own generated content, and names a three-year feedback retention window.", "highlights": [ { "label": "Training is opt-in", "text": "The NotebookLM article states content will not be used to directly train foundational AI models unless the user chooses to provide feedback, and Workspace and Education uploads are never reviewed by humans or used to train models." }, { "label": "User owns generated content", "text": "The copyright section says NotebookLM lets users generate original content and that Google will not claim ownership over that content." }, { "label": "Three-year feedback retention named", "text": "Reviewed feedback, included content, and related data are retained for up to three years, disconnected from the user's Google Account, which is a named period above ninety days." }, { "label": "Full data-subject controls", "text": "The Google policy provides export of account content, deletion of items or the entire account via My Activity, review and update of personal info, and ad and activity opt-out controls through My Ad Center." } ], "policyUrl": "https://support.google.com/notebooklm/answer/17004255", "policyLastUpdated": "2026-05-26", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/notebooklm.google.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 81, "grade": "B" } ], "lastChange": null } }, { "slug": "qwen", "name": "Qwen", "vendor": "Alibaba", "domain": "qwen.ai", "category": "Assistant", "scoreOutOf100": 57, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Scored on Alibaba Cloud's generic policy, which grants core rights and names transfer safeguards but omits any AI-specific disclosure.", "highlights": [ { "label": "Rights", "text": "Access, deletion, correction and portability, with stronger EEA/UK object and restriction rights." }, { "label": "Transfers", "text": "Names the EU-US Data Privacy Framework and Standard Contractual Clauses." }, { "label": "Training", "text": "Entirely silent on whether user inputs train models, with no opt-in or opt-out." }, { "label": "AI transparency", "text": "Does not disclose that Qwen is an AI service or mark synthetic output; reads as generic cloud infrastructure." } ], "policyUrl": "https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-privacy-policy", "policyLastUpdated": "2026-01-21", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/qwen.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" } ], "lastChange": null } }, { "slug": "poe", "name": "Poe", "vendor": "Quora", "domain": "poe.com", "category": "Assistant", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "Third-party developers may train models on user chats, with no opt-in or opt-out disclosed.", "Hashed email is shared with ad-platform partners for advertising, with no do-not-sell provision." ], "summary": "Poe lets third-party developers train on user chats and shares data with ad platforms, with no user control over either.", "highlights": [ { "label": "Training", "text": "Developers may view and store user chats on their own servers to train models, with no opt-in or opt-out." }, { "label": "Sharing", "text": "Hashed email is shared with ad-platform partners for advertising, with no named do-not-sell provision." }, { "label": "Output ownership", "text": "Silent on whether users own their outputs or can limit developer reuse of shared content." }, { "label": "Transparency", "text": "Dated and discloses third-party AI providers, but defers data-subject rights to Quora's policy." } ], "policyUrl": "https://poe.com/privacy", "policyLastUpdated": "2026-04-30", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/poe.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 42, "grade": "D" } ], "lastChange": null } }, { "slug": "crushon-ai", "name": "CrushOn AI", "vendor": "CrushOn", "domain": "crushon.ai", "category": "Companion", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "Low", "dealbreakerFlags": [], "summary": "A thin template policy: deletion rights are stated, but training use, retention, output ownership and security are all absent.", "highlights": [ { "label": "Training", "text": "Completely silent on whether conversations train the model; no disclosure, opt-in or opt-out." }, { "label": "Rights", "text": "Users can delete personal data and request access or correction by contacting support." }, { "label": "Sharing", "text": "Shares with service providers, affiliates and partners; does not say whether data is sold or offer an opt-out." }, { "label": "Security", "text": "Vague 'commercially acceptable' language, with no named controls, certifications or breach procedure." } ], "policyUrl": "https://crushonaiapk.com/privacy-policy/", "policyLastUpdated": "2025-07-09", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/crushon.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 32, "grade": "F" } ], "lastChange": null } }, { "slug": "cursor", "name": "Cursor", "vendor": "Anysphere", "domain": "cursor.com", "category": "Productivity", "scoreOutOf100": 83, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Does not train on your code by default, with narrow named exceptions; a strong privacy posture for a coding tool.", "highlights": [ { "label": "Training", "text": "Does not use inputs or suggestions to train models, except when flagged for security review, explicitly reported, or you opt in." }, { "label": "Retention", "text": "Keeps personal data only as long as needed to run the service and meet legal and safety needs." }, { "label": "Children", "text": "Not for under-18s; accounts found to belong to minors are investigated and deleted." }, { "label": "Privacy mode", "text": "A privacy mode is offered so code is not stored or used beyond serving the request." } ], "policyUrl": "https://www.cursor.com/privacy", "policyLastUpdated": "2025-10-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cursor.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" } ], "lastChange": null } }, { "slug": "lovable", "name": "Lovable", "vendor": "Lovable", "domain": "lovable.dev", "category": "Productivity", "scoreOutOf100": 81, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Does not sell data, names SCCs for transfers, and only uses anonymized data for model improvement with permission.", "highlights": [ { "label": "Training", "text": "Does not train general-purpose models on identifiable data; anonymized or aggregated data is used only with permission." }, { "label": "Selling", "text": "Does not sell personal data." }, { "label": "Transfers", "text": "EU Standard Contractual Clauses (Module 2) named for international transfers." }, { "label": "Retention", "text": "Customer and log data retained up to 90 days, then deleted or isolated." } ], "policyUrl": "https://lovable.dev/privacy", "policyLastUpdated": "2026-04-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/lovable.dev.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 81, "grade": "B" } ], "lastChange": null } }, { "slug": "polybuzz", "name": "PolyBuzz", "vendor": "PolyBuzz", "domain": "polybuzz.ai", "category": "Companion", "scoreOutOf100": 78, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "A companion app that states it does not sell user information and gates access at 18, with clear rights.", "highlights": [ { "label": "Selling", "text": "States plainly that it does not sell user information to any company or organisation." }, { "label": "Children", "text": "Users under 18 are denied access; full content is 18-plus only." }, { "label": "Rights", "text": "Account and data deletion available through the service." }, { "label": "Training", "text": "Limited disclosure of whether chats train the model." } ], "policyUrl": "https://www.polybuzz.ai/privacy-policy", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/polybuzz.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 78, "grade": "B" } ], "lastChange": null } }, { "slug": "genspark", "name": "Genspark", "vendor": "Genspark", "domain": "genspark.ai", "category": "Assistant", "scoreOutOf100": 72, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "States it does not train AI on user data beyond the requested service, does not sell, and deletes within 30 days.", "highlights": [ { "label": "Training", "text": "Does not use user data to build or enhance AI beyond the specific service requested." }, { "label": "Selling", "text": "Does not sell, trade, or share personal data except in described circumstances." }, { "label": "Deletion", "text": "Account data deleted within 30 days of closing the account." }, { "label": "Children", "text": "The service is not intended for children." } ], "policyUrl": "https://www.genspark.ai/privacy", "policyLastUpdated": "2026-03-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/genspark.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" } ], "lastChange": null } }, { "slug": "suno", "name": "Suno", "vendor": "Suno", "domain": "suno.com", "category": "Audio", "scoreOutOf100": 76, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Does not sell data and grants deletion rights, but trains its music models on user submissions without a clear opt-out.", "highlights": [ { "label": "Training", "text": "Uses submissions and activity to train and enhance the models that power the service; no training opt-out is stated." }, { "label": "Selling", "text": "Does not sell information to third parties." }, { "label": "Rights", "text": "Deletion requests are supported." }, { "label": "Synthetic output", "text": "No commitment to mark or watermark AI-generated audio." } ], "policyUrl": "https://suno.com/legal/privacy", "policyLastUpdated": "2026-03-26", "modalities": [ "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/suno.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 76, "grade": "B" } ], "lastChange": null } }, { "slug": "capcut", "name": "CapCut", "vendor": "ByteDance", "domain": "capcut.com", "category": "Image & video", "scoreOutOf100": 67, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Trains its models on user content and is light on a no-sell commitment, though it says face and body data is not used to identify you.", "highlights": [ { "label": "Training", "text": "Uses data to improve and develop the service, including training its machine learning models; no clear training opt-out." }, { "label": "Biometrics", "text": "States it does not use face or body information to identify you in your content." }, { "label": "Children", "text": "Not directed at children under 13." }, { "label": "Transfers", "text": "Cross-border transfer with an opt-out where the transfer is not needed to provide the service." } ], "policyUrl": "https://www.capcut.com/privacy-policy", "policyLastUpdated": "2024-03-28", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/capcut.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" } ], "lastChange": null } }, { "slug": "spicychat", "name": "SpicyChat", "vendor": "SpicyChat", "domain": "spicychat.ai", "category": "Companion", "scoreOutOf100": 21, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "A thin policy that grants deletion and an 18-plus gate but is silent on training, retention, sharing and security.", "highlights": [ { "label": "Training", "text": "Silent on whether conversations train the model." }, { "label": "Rights", "text": "Deletion of personal data is offered." }, { "label": "Children", "text": "The service does not address anyone under 18." }, { "label": "Gaps", "text": "No retention period, no named security controls, and no breach-notification commitment." } ], "policyUrl": "https://spicychat.ai/privacy", "policyLastUpdated": "2023-05-04", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/spicychat.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-20", "lastChecked": "2026-06-20", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-20", "score": 21, "grade": "F" } ], "lastChange": null } } ] }