Skip to content

For AI agents: /llms.txt

Back to chat

Privacy

How Nathan's AI handles conversations, cookies, and approximate location, and what stays public when you share a chat.

Last updated

This page explains what Nathan's AI stores, who processes it, and what is public. It applies to the chat app at https://chat.brodin.dev.

Conversations are public

When a reply finishes, the conversation is saved with a random identifier. Each saved conversation has a public URL under /conversations, and the conversations index lists recent chats. Anyone with the link can read the full message history.

Conversations are marked noindex so search engines should not add them to their results, but that is not a privacy guarantee. Treat any conversation you save as public, and do not include passwords, API keys, private documents, or personal details you would not want others to read.

What is stored

For each conversation, the app stores:

  • a random identifier and a title derived from the first message;
  • the full message history, including model replies and tool calls;
  • the model used for each response;
  • token usage reported by the model and the cost it reports;
  • creation and update timestamps;
  • approximate location, described below.

Approximate location

The app reads Vercel's geolocation headers from each request. When available, it stores the city, country, region, latitude, longitude, and timezone associated with the request. Vercel derives these values from the IP address, so they are approximate and can be wrong. Outside Vercel, these fields are empty.

The IP address itself is not stored with the conversation. It is used for rate limiting as described below.

Cookies and local storage

  • The conversations_sidebar_open cookie remembers whether the conversation sidebar is open. It is httpOnly and expires after one year.
  • Your theme preference is stored in your browser's local storage under the key theme. It is never sent to the server. A small inline script applies the saved theme before the page loads.

The app does not include advertising cookies or cross-site tracking scripts.

Third parties

  • OpenRouter receives your messages and returns the model's output. It routes requests to model providers under its own terms and privacy policy: https://openrouter.ai/privacy. Web search requests are also handled through OpenRouter.
  • Upstash Redis stores rate-limit counters keyed by IP address. Each key expires when its window ends.
  • GitHub receives public repository names when the model looks up repository stats.
  • Vercel hosts the app and supplies the geolocation headers used for conversations.
  • Websites the model fetches receive a request from the app when the model chooses to read a page.

Rate limiting

To prevent abuse, /api/chat is limited per IP address: 5 requests in 30 seconds and 50 requests in 24 hours. The counters are stored in Upstash Redis and expire automatically. Requests over the limit are rejected with a retry time.

Retention and contact

Conversations remain stored until they are removed by the site operator. There is no self-service delete flow yet. For questions about this policy, stored data, or removal requests, email nathan@brodin.dev.