Privacy Policy

This Privacy Policy explains how InverseAI ("InverseAI," "we," "us," or "our") collects, uses, shares and protects information when you use ToolGPT: AI Media Assistant on Android, iOS and toolgpt.io, including its assistant, local and online tools, and cloud features (the "Service" or "App"). Processing depends on the platform, app release and feature you choose. This policy does not mean that every listed feature is available on every platform.

Many editing, conversion, compression and file-management tools run on your device. Other features use our servers or connected services. When you choose an online feature, selected content may be uploaded for tasks such as AI analysis, image or video generation, document processing, cloud storage, email or social publishing. The chat assistant also sends your messages, relevant file details and task results to our servers and AI providers. The sections below explain these different data flows.

1. Summary of key points

• Processing depends on the feature. Local tools work on your device. Online tools, cloud storage and connected services receive the selected files or content needed to carry out the action you request.

• The AI assistant runs in the cloud. Your chat messages and basic details about the files you select (such as file name, type, size, duration, and resolution) are sent to our servers and to our AI provider so the assistant can respond. Conversations are saved to your account so you can return to them.

• Account and sign-in. Supported versions create a guest account or browser identity when you use the assistant. You may choose the Google or Apple sign-in options offered on your platform. We receive the identity information needed to link and authenticate your account; we do not receive your Google or Apple password.

• Ads and purchases depend on platform. Mobile ads may use Google AdMob. Android in-app purchases use Google Play Billing and iOS in-app purchases use Apple In-App Purchase. Web checkout, where offered, uses its displayed processor, such as Stripe.

• Your controls. You can use the history, cloud, connector and account controls available in your version, request permanent erasure through support, manage browser or device permissions and advertising choices, and manage subscriptions with the provider that bills you. Deactivation and erasure are different; see section 10.

2. Who this policy applies to

This policy applies to ToolGPT on Android, iOS and toolgpt.io. References to device permissions, billing, sign-in and local storage apply only where those features are used. Third-party destinations, websites and services have their own policies for the information they receive.

3. Information we collect

a. Your selected files and online processing

To use a tool, you select the files it needs. Many video, audio, image, PDF and archive operations run locally and save their outputs on your device. Online features may send selected files, extracted text, images or video frames, prompts, captions and related task information to our backend and the providers needed to perform the requested operation. Examples include AI media analysis and generation, text extraction, online document conversion or translation, cloud storage and social publishing. Inputs, outputs and job records for online features may be stored on our servers or storage providers. A file processed locally is not automatically uploaded solely because you edit it; uploads depend on the online feature or connected action you use.

b. Chat conversations and file details

To help you, the assistant needs to know what you asked and what you are working with. When you use the chat, we collect:

• Your messages — the text you type, or the text produced from your speech if you use voice features (see section 3.e).

• File details — information about the files you select or create, such as file name, file type, size, duration, resolution, frame rate, codecs, bitrate, and page count, and where the App saved an output file on your device, together with the settings you choose and the result of each task (for example, the output size or an error message).

• Device storage figures — such as free and total storage space, so the assistant can warn you when space runs low.

• The assistant's replies — the responses it generates and the actions it takes for you.

• Conversation information — such as conversation titles and times, your App version, and the App language you selected.

We store conversations and related task results on our servers, linked to the relevant account or session, to provide history and continuity. Mobile apps and the website may also keep local copies, preferences, session identifiers and file references. A local file reference or browser preview is not the same as storing the original in your cloud.

c. Account information

• Guest identity. Supported mobile and web flows create an anonymous account, installation identity or browser principal without asking for your name or email. We use its identifiers and authentication/session data for chat, limits, usage and any linked purchases. Losing local app or browser data may prevent us from identifying or recovering a guest account. Personal cloud features can require sign-in.

• Optional sign-in. Google can share your account identifier, name, email and profile photo. Apple can share your account identifier, name and email, including a private relay email if you choose Hide My Email; availability depends on what Apple supplies and your choices. We use identity tokens to verify sign-in and link the account. Guest history or balances may be linked or reconciled where the relevant platform supports it; cross-platform merging is not guaranteed. We do not receive your provider password.

d. Purchases, credits, and rewards

Android purchases are processed by Google Play, and iOS purchases by Apple. Web purchases, where enabled, are handled by the processor shown at checkout, such as Stripe. We receive product and order identifiers, purchase tokens or transaction verification data, subscription status, payment status and the account references needed to fulfill and reconcile purchases. We maintain credit balances, grants, expiry and usage records. A rewarded-ad confirmation can be linked to your account to grant credits. Apple and Google do not give us your full payment card details; web card entry is handled by the checkout processor, and we may receive limited payment information and billing details needed for the transaction.

e. Voice features and the microphone

Voice behavior depends on the client and feature. Mobile dictation and browser speech recognition may use the device, operating system, browser or their speech provider to convert microphone audio into text; processing is not always on-device. The resulting text is sent as a chat message. Spoken replies may use device or browser text-to-speech. If you choose an audio upload, transcription, enhancement or other online audio tool, the selected audio can be uploaded to our backend or the processing provider; this is separate from dictation. Microphone access is requested by the relevant device or browser control. The text-only dictation path does not require ToolGPT to retain the original microphone recording.

f. Feedback and reports you choose to send

• Ratings and feedback. If you rate a reply, send feedback about the assistant, or rate the App, we receive your rating, any issues you select, any comments you write, and basic device and App version details.

• Failed-task reports. If you report a failed task, the report can include file name/size, error details, technical logs, the related conversation identifier/title and device or browser details. Logs can include file paths and technical properties. Standard diagnostic reporting is separate from an original-file upload. If you choose to attach a file to a support or feedback request, that file is also sent for the request.

g. Information collected automatically

• Device and usage data — device or browser type, operating system, language, region, app version, request/session identifiers and events about feature use and performance. Depending on platform, we use Firebase Analytics or Google Analytics and our own server event records.

• Crash and diagnostic data — crash reports and diagnostic logs collected through Firebase Crashlytics. Logs may include technical details of the task being run, such as file names.

• Identifiers — account, app-instance, installation, browser/session and notification identifiers; advertising identifiers may be processed by mobile advertising services under the relevant permissions and settings.

• Approximate location — our advertising and analytics providers may infer your approximate location (for example, your country or city) from your IP address. We do not collect your precise location.

h. Permissions the App may request

Depending on your platform, version and selected feature, the App or browser may request:

• Selected files and storage access — to open files you select using the system picker and to save results. Available access controls depend on your Android version and the selected feature.

• Microphone and speech access — for voice input or supported voice features. Browser, Android and iOS permission controls differ.

• Notifications — to show task progress and results, and occasional updates about the App.

• Display over other apps — only for the optional floating ToolGPT chat bubble, which lets you open the assistant from other apps. Android requires you to turn this on yourself in system settings. The bubble does not read or capture what is on your screen.

• Background activity — supported mobile versions may use background task or foreground-service controls to keep work running. Android battery-optimization exemptions and overlay permissions do not apply to iOS or web.

You can grant or revoke permissions at any time in your device settings. Some features may not work without them.

i. Facebook and Instagram connections

Connecting Facebook or Instagram is optional. If you connect an account, we receive authorization data and the profile or business-asset information needed for the selected integration. This can include an app-scoped Meta user ID, account or Page IDs, account names or usernames, permitted publishing destinations and the permissions you grant. We use this information to connect your account, display the correct destination and publish content you approve. We do not receive your Facebook or Instagram password.

Authorization data is handled by the selected client, our backend and the connected provider as needed to establish and use the connection. Mobile integrations can store returned access tokens encrypted on the device; storage and session handling differ by client. The backend can retain a mapping between a Meta identifier and ToolGPT account for authorization, deauthorization and deletion requests. Never paste access tokens or passwords into chat.

When you approve publication, the selected content, destination, caption and related information are sent to Meta. Publishing options depend on the integration and platform. Android publishing uses an explicit Post action. New Instagram connections can use Instagram Business Login; legacy Facebook-linked connections may require a professional Instagram account linked to a Facebook Page. Facebook publishing supports Pages rather than personal profiles or Groups.

For the Instagram video-handoff flow, your selected video is uploaded to our backend/storage so Meta can retrieve it through a signed, time-limited URL. That URL is valid for at most one hour, or until the upload expires. This describes access-link validity, not a guarantee that all stored content is deleted within an hour. Captions, account or destination labels, post identifiers and result links may also appear in ToolGPT’s stored conversation or task results and be processed by the chat assistant.

You can disconnect a service from ToolGPT’s Connectors controls to remove the connection from this device. Disconnecting locally does not by itself guarantee that authorization at Meta has been revoked or that backend records have been erased. You can also remove ToolGPT’s access through the Facebook or Instagram authorization controls available for the integration. For deletion of retained ToolGPT data associated with a Meta connection, contact support@inverseai.com as described in section 10.

j. Website storage and interaction analytics

Toolgpt.io uses cookies or similar session storage for sign-in, security and preferences, and browser storage for chat and local file workflows. Website interaction records can include clicks, setting changes, previews, playback, download attempts and outcomes, control identifiers, file type/size, timestamps and a related chat/session identifier. Our servers retain session-linked events for history, support and improvement. Google Analytics and the connected Firebase property can receive usage events and session identifiers. The action-event payload excludes typed text, filenames, file URLs and file contents; the chat and online-tool data flows described above remain separate. A download event does not prove a file was saved to disk. Google services may also support advertising measurement or personalization depending on property settings and your choices. You can use available consent controls and browser cookie/site-data settings; blocking necessary session storage may prevent sign-in or history from working.

4. How we use information

We use the information described above to:

• Provide and operate the App, its tools, and the AI assistant, including understanding your requests, suggesting settings, and carrying out tasks.

• Save your conversation history and account so they stay available to you.

• Manage your credits, usage limits, subscriptions, purchases, and rewards.

• Display advertising in the free version and measure its performance.

• Improve ToolGPT. We review conversations, feedback, and reports, including with automated tools, to fix errors, improve the assistant's answers and features, and understand how the App is used.

• Diagnose crashes and technical problems, and prevent fraud, abuse, and security incidents.

• Send notifications about your tasks and, where permitted, about App news and features.

• Respond to your support requests and communicate with you about the App.

• Comply with applicable legal obligations and enforce our Terms of Use.

5. AI features and our AI provider

The chat assistant is powered by large language models. Our servers pass the conversation, relevant file details and tool results to the AI provider used for the request, such as OpenAI, so it can generate a reply. When you request an online media or document feature, the service may also process the selected content, extracted text, images, video frames or other inputs needed for that feature. Providers and processing routes depend on the selected tool and the service configuration.

• Online features can send file contents. Local editing alone does not require sending a file to an AI provider, but analysis, generation, text extraction, translation and other online features may require selected content to be processed remotely.

• Please avoid sharing sensitive information. The assistant does not need personal details to work on your files. Please do not include sensitive personal information, such as health, financial, or government ID information, in your messages.

• AI can make mistakes. Check important results before relying on them.

6. Advertising

The free version of the App shows ads served through Google AdMob (Google Mobile Ads SDK), including optional rewarded ads that you can watch to earn credits. To deliver and measure ads, Google may collect and process data such as your advertising identifier, device information, IP address, and interactions with ads. Depending on your settings and region, ads may be personalized or non-personalized.

• Mobile advertising controls are available in Android advertising settings and iOS privacy/tracking settings. Browser cookie and site-data controls apply on the web. Available consent controls and the effect of refusing personalization depend on the service and region.

• Where the law requires it (for example, in the European Economic Area, the United Kingdom, and Switzerland), ads are personalized only with your consent. Without consent, you may see non-personalized or limited ads.

• An eligible subscription or lifetime plan removes ads, as described in the App and our Terms of Use. Credit packs do not remove ads.

Google's handling of data collected through advertising is governed by Google's Privacy Policy and related policies. We encourage you to review them at https://policies.google.com/privacy and how Google uses information from partner services (https://policies.google.com/technologies/partner-sites).

7. Subscriptions, credits, and payments

Android in-app purchases use Google Play Billing and iOS in-app purchases use Apple In-App Purchase. Web checkout, where available, uses its displayed payment processor, such as Stripe. These providers process payment information under their own policies. We use transaction verification and subscription information to fulfill purchases, manage separate purchased and subscription/free credit balances, and prevent fraud. We do not collect full card details through Apple or Google purchase notifications. Review the relevant store or checkout for payment handling and cancellation; deleting ToolGPT data does not automatically cancel a subscription.

8. How we share information

We do not sell your media files or your conversations. We share the information we handle only as follows:

• AI and processing providers — your messages, relevant file details, tool results and, for online content-processing features, the selected content needed to deliver the result (see sections 3 and 5).

• Service providers — companies that help us operate, host, monetize, and distribute the App, including those listed below. They process information to provide their services to us, or as described in their own privacy policies.

• Legal and safety — when we believe disclosure is reasonably necessary to comply with a law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of users, the public, or us.

• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

• At your direction — when you use a connected service to save a file, send an email or publish a post, the relevant file, caption, destination and other action details are sent to that service. Files shared through another app on your device are handled by the app you choose.

The main services used by the App, depending on the features you select, include:

• DigitalOcean — hosts our backend and related storage used for online processing and connector authorization (https://www.digitalocean.com/legal/privacy-policy).

• Meta (Facebook and Instagram) — account authorization and publishing the content you approve to the connected account (https://www.facebook.com/privacy/policy/).

• AI and online processing — routes can include OpenAI, Anthropic (Claude), Google Gemini or Cloud Vision, OpenRouter and its selected model providers, BytePlus, fal.ai and workers hosted on services such as RunPod. A provider receives only the inputs routed to it for the selected feature; the listed providers are not all used for every request. Provider retention and use of inputs are governed by the applicable service terms, settings and agreements.

• OpenAI — generates assistant replies and supports selected AI content-processing or generation features. The inputs it receives depend on the feature used (https://openai.com/policies/privacy-policy/).

• Google Firebase (Analytics, Crashlytics, Cloud Messaging, Remote Config, In-App Messaging, Realtime Database) — usage analytics, crash reports, notifications, App configuration and in-app messages, and storage of feedback and failed-task reports (https://firebase.google.com/support/privacy).

• Google AdMob — serves and measures ads, including rewarded ads (https://policies.google.com/privacy).

• Google Play services (Sign-In, Play Billing, in-app reviews and updates) — optional sign-in, purchases and subscriptions, ratings, and App updates (https://policies.google.com/privacy).

• Platform and payment services — Apple (Sign in with Apple and App Store purchases on supported clients, https://www.apple.com/legal/privacy/), Stripe for supported web checkout (https://stripe.com/privacy), and your device or browser speech services for dictation and spoken replies.

Note on advertising and privacy laws: sharing an advertising identifier with advertising partners for personalized advertising may be considered a "sale" or "sharing" of personal information under certain laws (such as the California Consumer Privacy Act). You can opt out of personalized ads as described in the "Advertising" and "Your privacy rights" sections.

9. Data retention

• Local files and browser data. Originals and downloaded results on your device are controlled by you and your device/browser storage. Removing local data does not necessarily delete server or cloud copies. Browser storage can also be cleared or evicted independently of ToolGPT.

• Conversations, task results and assistant memory. We retain server history and, where enabled, saved preferences or memory for continuity, support and service improvement. Removing a chat from a client or deactivating an account is not a guarantee of permanent erasure from every server record. Memory and cloud files are distinct from a chat; include them in an erasure request if appropriate.

• Account, purchase, credit and usage records. We retain these while needed to operate accounts, verify purchases, reconcile balances, prevent fraud, investigate disputes and meet legal record-keeping obligations. Relevant financial or security records can remain after account deactivation or erasure of other personal data.

• Online-processing files and outputs. These can have feature-specific configured expiry and cleanup schedules. A signed URL expiry limits access to that URL; it is not a promise of deletion of every processing file, job record or backup. Cleanup can occur after expiry rather than at the exact second a link stops working.

• Personal cloud files. Files saved in your ToolGPT cloud are separate from temporary tool uploads and chat history. They remain subject to the account, storage plan and cloud deletion controls. Moving a file to Trash, permanent deletion and deleting a chat are different actions; a recoverable Trash item may still exist until purged. Use the cloud controls or identify the file in an erasure request. Where an enabled client retains an original at the actual online-tool upload boundary, that creates a separate cloud copy; metadata-only chat selection and local-only processing do not themselves create that copy. Guest online uploads do not provide permanent personal cloud storage.

• Feedback and failed-task reports are kept only as long as needed to investigate and fix problems and to improve the App.

• Erasure and remaining copies. Account deactivation revokes access but does not automatically purge all data. For permanent erasure, contact support@inverseai.com. We assess retained data by its purpose, whether the account or feature still requires it, applicable expiry settings, legal obligations, disputes and security needs. There is no single deletion timer for all ToolGPT data. We do not promise immediate deletion of backups or all third-party copies when a link expires or a chat is hidden.

• Third-party providers apply their own retention practices and the settings or agreements applicable to the service. The retention of a post, email or cloud file at a destination service is separate from the retention of ToolGPT data.

10. Deleting your data and your account

• Conversations and memory. Use the history and memory controls offered by your client to remove chats or saved preferences. These controls do not by themselves guarantee removal of separate cloud files, processing records, provider copies or records retained for legal and security purposes.

• Account controls. Current mobile versions can deactivate (soft-delete) the backend account, revoke its sign-in sessions and sign out, while retaining server data. Client behavior and local cleanup differ by platform and release. Do not assume a control labeled Delete account permanently erases all records. To request permanent erasure, email support@inverseai.com and identify the account and relevant data categories.

• Without the App. Email support@inverseai.com from the email address linked to your account to request deletion of your account or retained data. Describe whether your request concerns ToolGPT account data, chat content, uploaded files or a connected Meta account. We may need to verify account ownership before acting.

• Cloud and uploaded files. Use the relevant cloud file controls where available. For separate tool uploads, outputs, chat records or assistant memory, identify those categories in your support request. A deleted chat, expired download link or disconnected service does not prove those other records have been erased.

• Guest accounts. A guest account is not linked to your name or email address, so an email alone may not identify it. Contact support from within the app where possible and provide the account or conversation identifier available to you. Avoid sending an access token or password.

• Subscriptions. Account deactivation or deletion does not automatically cancel an Apple or Google Play subscription. Cancel through the Apple Account or Google Play subscription settings for the account that paid. For a web subscription, use the provided billing controls or contact support.

• Your device and browser. Uninstalling the App or clearing site/app data may remove local history, sessions and file references; it does not automatically erase server records, cloud storage, files saved elsewhere on your device or data already sent to another service.

• Meta deletion requests. Meta’s data-deletion or deauthorization callback removes the backend’s Meta-to-ToolGPT identity mapping. It does not automatically erase ToolGPT chat messages, captions, uploaded media or your entire ToolGPT account. To request deletion of those retained records, contact support@inverseai.com. Disconnecting or deleting ToolGPT data does not remove posts already published on Facebook or Instagram; manage those posts in the destination service.

11. Security

We use technical and organizational safeguards, including HTTPS to our backend and access controls for server systems and storage. Supported mobile connectors use encrypted device token storage; website sign-in uses browser/session controls. Cloud sharing permissions and any links you choose to create affect who can access a file. No transmission, storage system or device can be guaranteed completely secure.

12. Children's privacy

The App is not directed to children under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children. Advertising shown in the App is not intended for children. If you believe a child has provided personal information to us, for example in a chat conversation, please contact us at support@inverseai.com and we will take appropriate steps, including deleting the information.

13. Your privacy rights

a. Users in the European Economic Area, United Kingdom, Switzerland, and similar regions (GDPR)

If you are located in the EEA, UK, Switzerland, or a region with comparable laws, you may have the right to access, correct, delete, or restrict the processing of your personal data; to object to certain processing (including profiling for advertising and processing based on our legitimate interests); to data portability; and to withdraw consent at any time where processing is based on consent. Our legal bases for processing are:

• Performance of a contract — providing the App, the AI assistant, your account, conversation history, credits, and purchases.

• Consent — personalized advertising, and any other processing for which we ask your consent.

• Legitimate interests — analytics, security, fraud prevention, and improving the App, including reviewing conversations to improve the assistant.

• Legal obligation — complying with applicable laws, such as tax and accounting rules for purchases.

b. Users in California and other U.S. states

If you are a California resident (or a resident of a state with comparable laws), you may have the right to know what personal information is collected, to request access or deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information for targeted advertising. We do not sell your media files or your conversations. You can opt out of personalized ads through your device's advertising settings. We will not discriminate against you for exercising your rights.

To exercise any of these rights, use the in-App controls described in section 10 or contact us at support@inverseai.com. We may need to verify your request before acting on it. You also have the right to lodge a complaint with your local data protection authority.

14. International data transfers

InverseAI is based in Bangladesh. Our confirmed production backend hosting is DigitalOcean in New York, United States (NYC1). Our team and the providers used for your selected features may process or access data in countries other than your own. These include Bangladesh and the United States, and may include other locations used by the relevant processing or destination service.

15. Third-party links and services

The App may contain advertisements or links that direct you to third-party websites or services. We are not responsible for the privacy practices or content of those third parties, and we encourage you to review their privacy policies.

16. Changes to this Privacy Policy

We may update this policy to reflect changes in our practices, technology or legal requirements. We will update the Last updated date and give additional notice where appropriate, such as in the Service or store listing. Where a change requires consent, we will seek that consent; merely publishing a revised policy does not replace legally required consent.

17. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your information, please contact us at:

• InverseAI

• Email: support@inverseai.com

• Registered address: #401, Road 29, Mohakhali DOHS, Dhaka