Privacy policy

The short version

The app runs on your computer. Your models, prompts and what the models say are processed there, and they never reach our servers. We hold the account data listed below and, only if you turn security reports on, the reports described further down, which never contain a model file or any part of one.

Who we are

Daniel Iwugo, a sole trader in the United Kingdom, trading as Senbonzakura, decides how your account data is used. Business address: Orchard Close, Corfe Mullen, BH21 3TW. We pay the data protection fee to the Information Commissioner's Office, unless an exemption applies.

What we hold for your account

• Your email address.
• A username.
• When your account was made, and when you confirmed your email address.
• Your sessions: the device name the app sends, and the times you signed in and were last seen.
• An audit log of account events, such as signing in.
• Your subscription status, from Paddle.
• Rate limit counters, which count how often requests are made. They are stored as a scrambled value, never your address.
• A keyed hash of your email address, kept after deletion so a trial is used once per address.

We use contract for your account and the service you buy. We use our legitimate interests for the trial check, the email hash and the rate limits, which protect the service and stop it being misused. We have weighed those interests against your rights, and they don't override them, because each one keeps only what it needs. For security reports the basis is your consent, as the Security reports section explains.

What we don't hold

We never see your card details, because Paddle holds them. We don't receive your models, prompts, model files or what the models say.

Signing in

There is no password. To sign in, we email a six digit code to your address, and you type it into the app. Each code works once and for ten minutes, and we store only a scrambled copy of it.

The waiting list

If you join the waiting list on this site, here is what we do with your address.

• What we keep: your email address, stored encrypted; when you asked to join; which part of the site you used; the version of this wording you agreed to; and whether you have confirmed.
• Why: to tell you when the app is ready, once, and nothing else.
• How long: an address you haven't confirmed within seven days is deleted. A confirmed one stays until you leave, or until we have written to everyone on the list about the launch, whichever comes first.
• How to leave: use the link in every email we send. It opens a page with one button, Leave the list, which removes your entry at once. You can also email [email protected].

Who we share data with

• Payments: Paddle, our merchant of record, which handles payments, subscriptions, tax and invoices.
• Our service providers: the companies that host our account server and its backups, deliver our network and website, and send our account emails. They act only on our instructions.

Some of these providers are based outside the UK and EEA. Where your data goes there, we rely on the transfer safeguards each provider offers.

How long we keep it

The server removes ended sessions and expired codes, and it rolls the audit log up into daily counts. We delete your account data when you delete your account. Backups are kept for up to 35 days, and deleted data leaves them when the backup that holds it expires.

Why we keep an email hash after deletion

If you delete your account, we keep a keyed hash of your email address. This stops the same address getting the free trial twice. The hash is a scrambled value, not the address itself. We keep it on our legitimate interest in stopping repeat free trials. We treat it as personal data, and it is kept only for that purpose.

Your rights

• Export everything we hold, using the export button in the app. The export is a plain JSON file.
• Delete your account, using the button in the app. We send a code to your email to confirm it.
• Ask us for a copy, a correction or a restriction, or object to some uses. These rights apply under UK GDPR, and under EU GDPR if you are in the EU.

You can't delete your account while a paid subscription is active, so cancel it first. Deleting then removes your account data, as described above.

You can complain to the Information Commissioner's Office (ICO), the UK regulator for data. If you are in the EU, you can also complain to the data protection authority of your member state.

Updates and offline use

The app checks for updates. It also contacts our account server to confirm your session and plan. It works offline for up to 14 days.

Keeping the app's safety checks up to date

While you are signed in, the app keeps its safety checks up to date from our server. The models you open are checked on your own computer.

In some cases the app contacts our server to complete a check. That request does not tell us which model you opened, and we keep only a count of these requests for each account. We never receive your model files or any part of them.

Security reports

Senbonzakura works like antivirus for AI models. When the app finds a model file that looks malicious, it sends us an anonymous report, so we can check it and protect everyone else who might open it. This is on by default, because a report describes the file, not you: it carries no account id and no address, so it can't be traced back to you.

• The file's fingerprint (a hash, which can't be turned back into the file), its size and its format.
• Which of our checks flagged it, and what the app decided.
• Signs of what the file would do, taken only from the part that looks malicious: web addresses, IP addresses, and the names of the program functions it would run.
• The model's name and version, only if it came from a public model site such as Hugging Face.
• The versions of the app and of its checks.

A report never contains your model files or any part of them, your prompts, what the model said, your folder or file names, or the name of a model that didn't come from a public model site. What we learn about a malicious file is kept, because it describes the file, not you.

To keep the service working, we also count how often your account looks up our list and how many reports it sends. This stops the list being copied out and stops anyone flooding us with false reports. These are counts only, never the contents of a report, and you can ask us to stop.

Some extra things are off unless you turn them on in settings: linking your measurement results to your account, crediting your runs by your name, and sending exact details about your computer. You can turn any of these off again at any time.

Cookies

The website sets no cookies. It stores one setting in your browser, your theme choice, so it can remember that choice. It is only read on your own device and never sent to us.

Children

Our service is for people aged 18 or over. We don't knowingly hold data from anyone younger.

Contact

Privacy questions: [email protected]. Anything else: [email protected].