Privacy policy

Effective from 7 November 2026

This policy explains how Netrunner (“we”) processes the personal data of people who use the Carbon service and this site. Carbon is used by people all over the world, and the policy applies to everyone in the same way.

1. What data we process

• Account data: name, login, email address, profile and interface settings, the two-factor protection settings.
• What you send to the service: messages, files, images and voice recordings (they are turned into text), and the answers to them; projects, memory and artifacts.
• The AI providers, search engines and connectors you set up and their keys (kept encrypted); the skills and plugins you installed.
• Orders, payments, the balance and purchases in the store. We do not see or keep card details — they are entered straight at the payment service.
• Technical data: IP address, browser and device details, the session cookie, sign-in times and active sessions, security events (failed sign-ins, blocked requests).

Do not send the service other people’s personal data or sensitive data (health, beliefs and the like) unless you have the right to.

2. Why

• To provide the service under the user agreement: the account, the chat, the store and payments.
• To keep payment records.
• To protect the site and its users from attacks, bots, fraud and abuse.
• With your consent, which you can withdraw at any time: transfer of data to other countries (section 4), news and offers, using your chats to improve the service.

We do not make decisions about you that seriously affect you solely by automated means. Model answers are generated automatically, but they are not decisions about you.

3. Who receives the data

We do not sell personal data. It is passed only to those who help run the service, in the scope they need:

• AI model providers — your messages and attachments for the model you chose. With your own provider (for example Anthropic, OpenAI or Google) it is the one you connected, under its rules. With Carbon models — the provider the site works with (for example OpenRouter and the companies whose models it serves). Free models in general access are offered by their providers on their own terms, and some of them may keep requests and use them to train models — do not send confidential information to them.
• The search engine chosen in settings — the search query, when web search is on; connectors (MCP servers) you connected — what the model sends them.
• Cloudflare, Inc. — the network the site works through: it protects it from attacks and bots (including the Turnstile human check) and sees your IP address, browser details and requests to the site.
• Payment services (whichever you pay with) — the order amount and contents; card details are entered straight at them.
• The email service that delivers our letters — your address and the letter.
• country.is — your IP address, only when Cloudflare did not report your country; it returns the country, which picks the language and currency.
• Authorities — only when we are legally obliged to.

A chat you shared by a public link can be read by anyone who has the link, until you turn sharing off. We do not read the contents of your chats, except when you send us an answer yourself, when it is needed to investigate abuse reported to us, or when we are legally obliged to.

4. Processing in other countries

The site, Cloudflare, the AI providers and the payment and email services work in different countries, so your data is processed outside your country too, including in countries where the level of personal data protection may be lower than in yours: there you may have fewer rights, and the data may be accessed by that country’s authorities. By signing up you agree to this.

5. How long we keep data and how we protect it

• Account data, chats and settings — until you delete them or the account, or withdraw consent. After deletion they remain in backups for up to 14 days, then disappear.
• Incognito chats — a day.
• Payment records — as long as accounting requires.
• Security data — briefly: attempt counters 15 minutes, the event log its latest 10,000 entries; download statistics keep only a one-way hash of the IP address.

Passwords are stored only as a hash, API keys are encrypted, the site works only over HTTPS, and sign-in is protected by a second factor.

6. Your rights

You may: find out how your data is processed and get a copy of it; have it corrected; have it deleted; object to its processing; withdraw consent at any time (this does not affect the processing before the withdrawal). In settings you can export your data, turn mailings on or off, delete your chat history or the whole account. — we answer within 15 days and free of charge. If you refuse to give the data needed for the account, or withdraw consent, we cannot provide the service.

7. Cookies

We use only necessary cookies: the session cookie that keeps you signed in, a cookie that remembers you have seen the notice about cookies, one with your language, and Cloudflare’s security cookies (__cf_bm, cf_clearance) that tell people from bots. There are no analytics or advertising cookies.

8. Children

The service is for people aged 16 and over. If you learn that a child under 16 has given us their data, write to us and we will delete it.

9. Changes

We will publish a new version of the policy here with a new date and tell you about important changes in advance by email or on the site.