Privacy notes

Local-first storage

EONAPP stores many preferences, badges, plan status, renewal reminders, result history, generated assets, optional vault profile data, and feature state in your browser. Clearing browser storage may erase local state unless you exported a vault backup or kept independent receipt proof.

Optional Google Login and account metadata

Guest use remains available. When optional Google Login is enabled, EONAPP requests only identity scopes: openid, email, and profile. It does not request Gmail, Drive, Calendar, Contacts, YouTube, or other Google-service access.

Cloudflare may hold a random EON account ID, a protected reference to the Google identity, verified-email and session metadata, plus minimal Dodo customer/subscription references and tier/status fields required for entitlement and billing support. When the separately controlled email-retention rollout is enabled, EONAPP may also retain the Google-verified email address in application-layer encrypted custody so the account can expose one-tap email preferences. Google sign-in by itself is never newsletter consent: marketing email is sent only after a separate explicit subscription action, can be unsubscribed, and is suppressed after applicable bounce/complaint signals. EONAPP does not keep raw Chat, prompts, AI outputs, Vault data, provider keys, files, projects, Realm layouts, City progress, browser storage exports, Google access/refresh tokens, or card data in this identity account service.

Important: Google Login is not a backup and does not create automatic cloud sync. Create and keep your own encrypted backup for local work you cannot lose. You can delete the minimal cloud account/session metadata from Profile; local data remains on your device because it was never uploaded.

Optional email retention

EON Weekly and other future marketing-email topics are optional and separate from Google Login, browser Push and service notifications. An explicit same-origin action is required before subscription. A normal Google sign-in cannot subscribe an account. When configured, EONAPP keeps the verified address encrypted in its account database, records consent and suppression state server-side, and uses Amazon Simple Email Service (SES) only as the outbound delivery provider. No dedicated SES IP is required by EONAPP's source contract. Delivery remains disabled until the provider identity, credentials, unsubscribe handling, bounce/complaint suppression and Preview evidence are configured and certified.

Payments and processors

Paid subscriptions use Dodo Payments hosted checkout. Dodo processes payment details under its own terms; EONAPP receives server-side lifecycle events and stores minimal customer/subscription references, plan, status and timestamps needed for entitlement, cancellation, expiry, refund/dispute handling and support. EONAPP does not store full card data.

Wallet and public transaction data

No direct wallet-payment rail is active in this release. Never send a wallet payment because of a message, link, or assumed future feature. Public transaction data should be shared with support only when a separately published payment flow explicitly requests it.

Vault and backups

Your exported vault file is controlled by you. If you encrypt it with a passphrase, remember the passphrase. EONAPP does not keep a server-side recovery copy unless a future account product explicitly says so in its own terms.

AI provider keys

If you enter your own AI API keys, keep them secret. BYOK flows should keep keys in your device vault and send them only to the relevant provider when you initiate a request. Support should only receive masked provider names or test results, not full key values.

Hosted and Free AI routes: eligible hosted EONBOT requests can use EONAPP's server-managed OpenRouter route for model inference. Sponsored recommendations are a separate mediation step and may use only providers that are currently configured and Production-ready; the current mediation set can include AgentAds, Idlen and Zyntent; AgentVine is retired from this lane, and pending Imprezia is disabled and not requested. The inference provider receives the conversation messages needed to answer the current request under the hosted route's privacy controls. Sponsor providers are not given the user's full chat history, Google identity, email address, raw account ID, private files, Vault data, Local AI content, BYOK credentials or provider secrets. Sponsor context is limited to bounded current-turn commercial intent such as a sanitized category or query summary, coarse country where allowed, a bounded response preview and an opaque conversation identifier where continuity is required. Provider no-fill, timeout or failure must not block the AI answer, and at most one clearly labelled Sponsored unit is shown. Local AI remains on the selected local runtime, and BYOK sends requests only to the user's selected provider; those lanes do not make sponsor calls. Hosted AI should not be used for secrets, API keys or material that must remain device-local. Current provider availability can change, so this policy describes the data boundary rather than promising that any particular sponsor network will always serve a result.

Aggregate measurement and local diagnostics

EONAPP can use Google Analytics for aggregate traffic and approved product-route measurement only after you enable it in Profile. The setting is off until you choose it and applies only to the production EONAPP site.

When enabled, EONAPP sends approved logical route IDs only. It does not send chat messages, files, Vault contents, credentials, account identifiers, Google OAuth information, signed Realm shares, referral codes, local model names, raw URLs, URL queries, fragments, or user-entered values to Analytics. Advertising audiences, Google Signals, remarketing, cross-domain linking, and ad personalization are disabled in the bridge.

Redacted local diagnostics are separate, off by default, and stay only in this browser profile. When you explicitly enable them in Profile, limited local route and event summaries exclude chat content, credentials, URL queries, and fragments. You can switch them off or clear them at any time.

This page does not make a legal determination for your jurisdiction. The product default is no aggregate measurement until you actively enable it.

Advertising, Free AI, Sponsored Missions and EONKEYS

Subscriptions remain EONAPP's primary direct monetization. Ordinary display or contextual advertising is limited to eligible public surfaces and is kept separate from private work, Local AI, BYOK, account, billing and City gameplay. Hosted Free AI is a distinct route: EONAPP may request one clearly labelled sponsored result through a Production-ready mediation provider using only the bounded commercial context described in this policy. AgentAds, Idlen and Zyntent can participate when configured; AgentVine is retired from this lane, and pending Imprezia is disabled and not requested. Provider no-fill or failure does not block the AI answer.

Zyntent may serve clearly labelled contextual sponsored sections on eligible public pages. MyLead Sponsored Missions are a separate voluntary rewards experience and require server-authoritative completion evidence before any eligible non-cash EONKEY unlock is recorded. EONKEYS are feature unlocks, not cash, discounts or transferable financial assets. EONAPP does not ask visitors to click advertising as a condition of receiving the core content or AI answer.

Cookies, consent and advertising storage

EONAPP keeps essential session and security storage separate from optional measurement and advertising choices. Disabling optional measurement or advertising storage does not remove ordinary Free access, Local AI or BYOK access.

Advertising providers can use cookies, local storage, device or network identifiers, or similar technologies where their approved configuration and applicable law permit. ExoClick may serve the source-approved Native ordinary-display placement on eligible public revenue surfaces under the deployed audience/consent policy; ordinary ExoClick display is not enabled on private work, account, billing, Local AI/BYOK or City gameplay surfaces. On reviewed public Guide pages, Google AdSense may process page context and advertising-event data only when the site is approved, account settings permit serving and applicable consent requirements are satisfied. Zyntent may receive only the bounded contextual fields permitted for an eligible public sponsored-discovery request; it must not receive Local AI or BYOK history, private answers, memory, files or provider keys. Free AI mediation is server-side and is governed by the separate bounded-context rules described above rather than by a general permission to read private chat history.

Sponsored Missions are separately opt-in. Opening the MyLead OfferWall does not constitute consent to unrelated display placements. A declined, unavailable or uncompleted Sponsored Mission does not reduce normal product or world progression. Provider availability, geography and consent requirements can differ, and the deployed consent authority takes precedence over a provider's fill opportunity.

Signed referral and Realm links

Public eon2 referral and eon3 Realm links carry signed public metadata and a fresh cryptographic share ID. They contain no wallet secrets, password, payment request, payout claim or browser-granted reward value. A signed referral identifier may be used for later server-side attribution, but clicks or shares alone never grant EONKEYS. Do not put real names, private notes, secrets, or sensitive details into a public label or handle.

Operator, supplier and data-controller record

Checking the deployed operator configuration…

Legal operator/supplier

Trading name

Business address

Country

Support contact

Privacy contact

Security contact

Governing law

Venue

Minimum age / parental-authorisation rule

Paid launch remains blocked if this deployment does not expose a complete, owner- and counsel-approved record.

Purposes and legal bases

EONAPP processes only the data required for the selected function: identity/session security, subscription and transaction administration, referral/Sponsor-EONKEY integrity, optional advertising and consent controls, private support cases, security/abuse prevention and legal compliance. Depending on the deployed operator jurisdiction and the request, the legal basis may be contract performance, steps requested before contract, consent, legitimate interests in security and service integrity, or compliance with a legal obligation. The deployed operator record and reviewed policy determine the applicable basis.

Data inventory, retention and deletion

• Device-owned work: Chat, Projects, Library, Vault, local AI settings, Creator media and City progress normally remain in browser storage until the user exports or deletes them.
• Identity/session: minimal account and session records are retained only for account access and security, then deleted or expired according to the identity schema.
• Billing/referral: provider references, lifecycle events, commands, entitlements and required accounting/anti-fraud records follow their declared retention and legal obligations.
• Support/security: redacted case facts, status, owner role and public response are retained only for case handling, audit, defence and required security/legal follow-up.

“Delete account” cannot truthfully promise immediate deletion of records that must be retained by law or a payment provider. The response must identify what was deleted, what remains locally, and what is retained with its reason.

International transfers and subprocessors

Google may process identity authentication; Dodo Payments processes hosted checkout, payment and customer-portal activity; OpenRouter processes eligible hosted AI requests under the server-managed route's configured privacy controls; and an active sponsored provider may process only the bounded sponsored context described above when EONAPP requests a sponsored result. Zyntent may receive contextual information on eligible public advertising surfaces, and MyLead processes voluntary Sponsored Mission traffic and verified reward callbacks where that feature is used. Cloudflare provides hosting, security and D1 infrastructure. Amazon Simple Email Service (SES) may process consented marketing email only when the separately controlled email-delivery rollout is configured and enabled. ExoClick may process ordinary native-ad delivery data on eligible public revenue surfaces, and the current Sponsored-AI mediation set may include AgentAds, Idlen and Zyntent under the bounded-context rules described above; AgentVine is retired from the Sponsored-AI provider lane. A user-selected BYOK provider processes only requests the user explicitly sends to it. Local AI and other browser-local work are not sent to hosted inference or sponsor providers merely because they exist on the device. Provider availability can change; this page describes the data boundary and should be read with the current Advertising & Sponsorship Disclosure.

Your privacy rights

Subject to applicable law, a person may request access, export, correction, restriction, objection or deletion through a private privacy-rights case. A real case ID is issued; the request is reviewed rather than decided by browser state. Identity verification must be proportionate and must not require provider keys, recovery phrases, full card data or private workspace content.

Children

EONAPP is not directed to children who cannot lawfully consent to the relevant digital service or data processing in their jurisdiction. Paid access and account use must follow the age and parental-authorisation rules that apply to the deployed operator. The operator must publish a counsel-reviewed minimum-age rule before public paid launch; the deployed launch authority remains ineligible until the current operator-record and counsel-approval versions match this policy version.