Privacy

Privacy Policy

rand0m.ai launched June 6, 2026. This policy takes effect on the day the production release that carries it publishes this page, and it is not backdated.

rand0m.ai is run by Random Knights, LLC ("we" or "us"). This policy covers the rand0m.ai web app. It says what the app collects, why, where it is kept, who else sees it, and how to have it deleted. It does not cover other websites that rand0m.ai links to.

The short version

• We do not sell your personal data.
• You can use most of rand0m.ai without signing in.
• If you sign in, we get your email address, name, profile photo, and account id from the service you sign in with. We use them only to run your account.
• AI keys you add stay in your browser. They pass through our server only to reach the AI provider you picked. We never store or log them.
• Our servers do not save the text of your prompts or the AI's answers. Your chat history stays in your browser.
• Our usage analytics never include your email address, your API keys, the text of your prompts, or your location beyond a county name.

Signing in

Without signing in

When you first open rand0m.ai, the app signs your browser in anonymously with Firebase Authentication, a Google service. This creates a random account id with no name or email attached. Our servers need that id to answer requests for weather, Earth data, and AI, and to apply fair-use limits.

Sign in with Google

If you choose Google, Google shares your basic profile with us: your email address, your name, your profile photo, and your Google account id. We do not ask for access to your Gmail, Google Drive, contacts, calendar, or any other Google data.

Sign in with GitHub

If you choose GitHub, GitHub shares your public profile (name, photo, and account id) and, with your permission, your email address, so a private primary address can still reach us. We do not ask for access to your repositories.

Email link

If you sign in with an email link, you give us your email address and Firebase Authentication emails you a one-time sign-in link. While you wait for the link, your browser remembers the address so you do not have to type it again. The app erases it when sign-in finishes or fails.

Where it is kept, and why

Your sign-in details are stored in Firebase Authentication in our Google Cloud project. We do not copy your name, email address, or photo into our own database. We use them to keep you signed in, to show who is signed in, and to decide which features your account can use. For example, some test features open only to verified @rand0m.ai addresses or to addresses we have invited as testers.

How rand0m.ai uses Google user data

• What we access: only your basic Google profile: email address, name, profile photo, and Google account id.
• How we use it: to sign you in, show who is signed in, and check whether your account may use tester features. We do not use it for advertising, and we do not use it to train AI models.
• How we store it: in Firebase Authentication in our Google Cloud project, until you delete your account in the app or ask us to delete it.
• How we share it: we do not sell it or share it with anyone. Google processes it for us as our sign-in and hosting provider.

Your AI keys

You can add your own API key for an AI provider: OpenAI, Google Gemini, Anthropic Claude, xAI Grok, or Hugging Face. The key is saved in your browser's storage on this device. It is not saved in your account, and it does not follow you to another device.

When you send a prompt, the app sends the key with that one request to our server. The server uses it to call the provider you picked and keeps it only for that request. We never store or log the key. Our logs record only whether a request used your key or ours.

To remove a key, clear it in the app's settings, or clear this site's data in your browser.

Prompts and AI answers

When you use an AI feature, the text you send goes through our server to the AI provider for that request. That provider handles it under its own terms and privacy policy. Our servers do not save your prompt or the answer.

For each AI answer we do save a cost record under your account id: the provider, the model, the number of tokens, the estimated cost, and the estimated energy, carbon, and tree-time. This is our AiEDs disclosure. It is a cost estimate, not the content of your chat. When an AI agent uses a built-in server tool, such as web search, it runs on your own provider key, the same way a chat request does, and we record the account id, the tool, and whether it worked, but not what was asked.

Your chat history, notes, and settings are saved in your browser on this device, not on our servers.

Location

Weather, tide, and local map features need a location. By default the app rounds your device position to about 11 km (roughly city level) before any feature sees it. The app uses your precise position only if you turn that on in the app.

The app sends the location to our server, which asks weather and map data services for results. Our server keeps those results in temporary memory caches, not in your account. The data services see a request from our server, not your name or account.

Usage analytics

We collect anonymous usage events so we can tell which parts of the app people actually use. Things like which lab you opened, which agent ran, whether the benchmark completed, and which sign-in method was used. Events never include your email address, your API keys, the text of your prompts, or your location beyond a county name.

We use Google Analytics to collect these events. On the web, that may set a cookie in your browser. On phones, it uses a device identifier instead. Either way, it only tells one visit apart from another; it does not carry your name. Google Analytics receives browser language and broad browser, device, and platform categories. It derives country plus broader region, subcontinent, and continent from the IP address before Google discards it. Granular location and device collection is turned off for every region, so it does not collect city or city coordinates, the browser user-agent or minor version, device brand, model, or name, operating-system or platform minor versions, or screen resolution. Random Knights, LLC is the entity responsible for this data. Google's own privacy policy is at policies.google.com/privacy.

Connected accounts

On the c0nnect page you can connect a GitHub, Slack, Atlassian (Jira), or Hugging Face account. The provider then sends us an access token. We store it in our database under your account id. No browser can read it back, not yours and not ours: only our server uses it. We use it only for what you ask, such as an AI request billed to your Hugging Face account. When you disconnect, we delete the token and, where the provider supports it, revoke it.

Bug reports from testers

Invited testers can send bug reports and feature requests from the app. The text and any files you attach are filed in our private GitHub repository so we can fix the problem.

Who else handles data

We use these services to run rand0m.ai. Each one gets only what it needs for its job.

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Firebase Hosting, Google Analytics, and reCAPTCHA): runs our servers, sign-in, database, and analytics, and checks that requests come from the real app.
• GitHub: if you sign in with GitHub or connect a GitHub account.
• The AI provider you pick (OpenAI, Google, Anthropic, xAI, or Hugging Face): receives your prompt for that request.
• Weather, Earth, and map data services: receive a location or map area from our server, not your identity.

We may also share data if the law requires it, or to protect people from harm.

Cookies and browser storage

• Google Analytics may set a cookie, as described above.
• Firebase Authentication keeps you signed in using your browser's storage.
• The app saves your settings, AI keys, chat history, and notes in your browser's storage on this device.
• Google reCAPTCHA helps us check that requests come from the real app. Google may set its own cookies for this.
• If you use the music or video player, the player loads from Spotify or YouTube, and they may set their own cookies.
• Some maps, map outlines, and fonts load straight from their providers into your browser. Like any website, those providers can see your IP address and browser type.

We do not use advertising cookies. You can clear cookies and site data in your browser at any time. That signs you out and removes any AI keys and chat history saved on this device.

How long we keep data

We keep your account, your AI cost records, and your connected-account tokens until you delete your account, disconnect the account, or ask us to delete them. Deletion finishes within 30 days. Our server logs record the account id, provider, and model for each AI request, and errors. Google Cloud keeps those logs for 30 days, then deletes them.

Your choices

• Use rand0m.ai without signing in.
• Sign out at any time.
• Remove your AI keys in settings.
• Keep location at the rounded default, or turn precise location off.
• Disconnect connected accounts on the c0nnect page.
• Delete your account in the app: open the profile pop-out and use Delete account, under Account controls. That removes your sign-in details and the records stored under your account id.
• Or email us from the address on your account, to delete your account or to ask for a copy of your data. Deletion finishes within 30 days, and we reply to confirm.

Children

Part of our K13 mission is to make AI friendly and safe for every age group. You must be at least 13 years old to use rand0m.ai. If you are 13 to 17, you may use it with the consent of a parent or guardian. We recommend rand0m.ai for people 18 and older.

rand0m.ai is not directed to children under 13, and we do not knowingly collect personal data from them. If you think a child under 13 has given us personal data, email knights@rand0m.ai and we will delete it.

Security

The app talks to our servers over encrypted connections. Our database rules stop anyone else from reading your account's data, and they stop every browser, including ours, from reading connected-account tokens at all. No system is perfectly secure, so we cannot promise that data will never be exposed.

Changes to this policy

If we change this policy, we will update the effective date at the top of this page. If a change is significant, we will also post a notice in the app.

Contact

See also our Terms of Service.