Skip to content
Assembly

Privacy policy

Last updated: 12 October 2026. Contact: anubhab7105@gmail.com

The short version

  • No accounts. No login. No tracking. No cookies set by Assembly.
  • Your API keys, questions and run history stay in your browser (IndexedDB, with a localStorage fallback).
  • Our server keeps a run in memory only while it executes, then drops it. Server logs hold metadata only.
  • Your question and keys are sent to the model providers you chose. Their policies apply to those inputs.

Data we handle

In your browser only: provider API keys, run history (questions, answers, sources, scores), settings, usage counters, and your privacy notice acknowledgment. Delete them anytime from History (delete) and Settings (remove keys). Clearing browser site data removes everything.

On our server, transiently: your question, model choices and API keys travel inside encrypted HTTPS request bodies for one run. Keys are never written to disk, URLs, or logs. Key-shaped text is scrubbed from logs automatically.

Server logs and limits: run id, time budget, timings, token counts, and the client IP address used only to enforce per-IP rate limits. Rate-limit records live in server memory and expire automatically.

What we never collect: names, emails, passwords, payment details, precise location, or analytics profiles. There is no sign-up form, so there is nothing to hand over.

Third parties who see your inputs

Each run sends your question to the model providers holding your keys (for example Gemini, Groq, OpenRouter, Hugging Face) and, when research is on, to search sources (for example Wikipedia, arXiv, Tavily if you added a key). Those providers process inputs under their own policies. Free tiers may reuse inputs to improve their products (Google states this for Gemini free-tier requests). Avoid sending sensitive or confidential information.

Hosting platforms (Vercel for the site, Render for the API) necessarily handle network traffic and keep their own operational logs, including IP addresses, under their policies.

Your rights (India and the EU)

Assembly is built for users in India, and EU visitors are possible, so this policy is written with India's DPDP Act 2023 and the EU GDPR in mind. Because almost everything lives in your own browser, you exercise most rights directly: view, correct, export (History, Export) and delete (History, delete or clear; Settings, remove keys) your data without asking us.

For anything held server-side (transient run data, memory-only rate-limit records, host logs we cannot see), email anubhab7105@gmail.com with your request. We reply within 30 days. You may also complain to India's Data Protection Board or your EU supervisory authority.

Children

Assembly is not directed at children under 13 (or under the age your country requires for consent). Do not use it with a child's personal information.

Changes

If this policy changes materially, the in-app privacy notice version is bumped and you are asked to acknowledge it again before running.