Privacy policy

This policy describes how the UltraSearch website and Windows application handle information. Use the public contact form for support or privacy questions, or Your data in account settings to download your data or submit an account request.

Account and sign-in details. Email address, optional display name or username, profile picture, appearance preference, account identifier, account creation time, and a salted scrypt password hash for password accounts. We do not store the readable password. If you use Google sign-in, we request only OpenID Connect sign-in details (openid, email, and profile); we retain the Google account identifier, verified email, and display name to find or create your UltraSearch account and sign you in. The Google tokens used to complete sign-in are not retained as account credentials, and this sign-in flow does not request access to your Google Drive or other Google content. Google sign-in details are not used for advertising or AI features.

Account, billing, and usage records. Plan and subscription status, renewal date, Stripe customer/subscription identifiers, and AI usage totals by billing period. Stripe processes payment details in its hosted payment flow. UltraSearch does not receive full card numbers.

AI feature inputs and outputs. When you use an AI feature, the service receives the information needed for that request. This can include selected or submitted text for rewriting and summarization, a prompt, and file names, paths, and modification details supplied for file assistance. The configured inference services process these requests on the service PC. AI job records retain submitted inputs and generated outputs under the cleanup schedule below.

Local file and media index. File search keeps names, paths, sizes, extensions, and modification times in the desktop app's local index. When you enable visual search, the desktop app sends small image previews and available video poster previews through the website to the AI service PC for embedding. Original image/video files are not uploaded. Preview requests are processed in memory over the private connection and are not saved as AI jobs or queued for later processing. Returned search vectors are cached in an encrypted, account-specific desktop cache, bounded to recent supported media and available cache space. Local service media indexing can also keep image/video metadata and derived vectors. Metadata matching stays on the indexing PC. With automatic indexing enabled, semantic text search also sends bounded excerpts from supported .txt, .md, and .rst files, together with their display titles, through the website to the configured AI service PC. Semantic indexing respects the configured search roots and ignored folders. Derived vectors and bounded text excerpts are stored in an encrypted, account-specific cache on the desktop; changed or removed sources are checked before search results are returned. This semantic processing is separate from metadata-only local search, and the service PC may be a different computer from the desktop. Background indexing runs while the desktop app is running; ignore a folder to stop future file indexing for that location. Original source files remain on the indexing PC.

Local clipboard history. While you are signed in to the Windows app, copied text is kept in an encrypted, account-specific local history for up to 24 hours, subject to storage limits. Text marked by supported password managers or applications as excluded from clipboard history is skipped. Clipboard matches stay on your PC and are not sent for AI processing or stored in cloud search catalogs. Pinning a clipboard item to the shortcut wheel retains a local encrypted copy until you remove it. Opening an item in a text editor creates a temporary local copy.txt file; these exports are cleaned up after 24 hours while the app runs or at its next startup.

Connected providers. If you connect an account, the service stores its provider token encrypted in the PC service database. Available connections are GitHub (repositories, code, issues, pull requests, and optional commit searches; private repositories require your explicit repository permission); Discord (profile and joined servers); Google Drive (permitted metadata and bounded text content); Google Calendar (primary calendar events); Gmail (subjects, snippets, and bounded message contents for requested detail reads); Notion (shared pages and permitted blocks); Linear (issues and descriptions); GitLab (authorized API data); Slack (authorized search results); Dropbox (authorized file metadata); and Todoist (tasks and projects). The specific data returned depends on the provider account, permissions you grant, and your saved search preferences. You can restrict supported search categories from the connection’s Search preferences. Disabling a category changes Ultrasearch searches; it does not revoke an OAuth permission. Revoke access with the provider or disconnect to remove the stored credential. The website may cache bounded repository metadata and query results in memory for a few minutes, scoped to the connected account and credential. The desktop also stores an encrypted account-specific catalog of connected titles, URLs, and permitted excerpts, and derived search vectors, for up to seven days. Background refreshes update this catalog while the app runs. Successful snapshots replace obsolete entries; disconnecting or changing search permissions invalidates that source on the next account refresh. Web search titles and snippets can be saved in the same catalog. Temporary RPC results may be retained to finish or retry an operation. Disconnecting removes the stored connector credential and attempts to revoke provider access where supported. A failed revocation or a provider without this endpoint can leave the grant active; you can revoke remaining access in provider settings. Disconnecting does not erase data held by the provider.

Company workspaces. A company workspace stores its name, membership roles, invitation email addresses and hashed invitation tokens, billing references, and administrative audit events. Owners and admins can see the members and manage invitations. Joining a workspace does not share your files, private connections, prompts, or chat history with other members, and does not change your personal plan or unrelated personal use. Company seats cover the member’s use within that company workspace while coverage is active. Organization owners manage company billing; custom-contract details are restricted to authorized administrators. Invitation links expire after seven days unless accepted or revoked earlier. We keep membership, billing, and agreement records as needed to operate the company plan and meet applicable obligations.

Optional Agent actions. Where a provider supports Agent actions, connection authorization requests read and write permissions together. The provider shows the requested permissions before you approve them. A read-only or partial grant stays limited to the access actually granted; Connections offers reauthorization if supported permissions are missing. Some connections, including Discord account OAuth, do not support write authorization. Agent can retrieve permitted item details and prepare actions such as creating a task, issue, event, page, or text file, or sending a message. Before any supported write, the application displays the destination and proposed content and requires Confirm or Deny. Confirmed content is transmitted to that provider. Proposals expire after five minutes; owner-scoped receipts prevent replay. Retrieved content, action results, and source references may be included in AI job records and conversation history. Provider permissions remain under your control and can be revoked in provider settings.

Service and request data. The service stores AI job status, submitted input payloads, completed result text, errors, usage and billing records, and security records such as webhook receipts. AI job inputs can remain with the job record until routine cleanup. The website host may also process request and diagnostic metadata, such as IP address, request time, and error information, under its own service terms and privacy notice.

Contact messages. If you use the public contact form, we store your reply email address, the request category, your message, and a request status so we can review and respond. The form is available without an account. For abuse prevention, the service also stores keyed hashes of your email address and network address for rate limiting; it does not store the raw network address in the contact-request record. Contact requests do not expire automatically.

Gmail verification codes. While the signed-in desktop app runs with Gmail connected and read permission granted, it periodically checks a bounded set of messages from the last five minutes for verification-code instructions. The service reads only the matching messages needed to extract a code and sender identity. Codes are held temporarily in account-specific memory until five minutes after the message arrived; they are not logged, saved in the connector catalog, or sent to an AI model by this feature. Copying a code hides its search suggestion, and the shortcut wheel can copy the latest code again until it expires. A bounded list of copied message identifiers and expiry times is kept with the encrypted Gmail connection so the suggestion stays hidden across service restarts. Disconnecting Gmail or signing out stops future checks. Copying a code places it on your system clipboard.

Sessions and browser storage. The website uses an HttpOnly signed session cookie for up to 14 days, a short-lived Google sign-in state cookie, an encrypted Google recovery cookie lasting up to 15 minutes when the account service is unavailable, and a separate cookie for the restricted admin area. The desktop app stores a signed session token for sign-in. Optional MFA stores an encrypted TOTP secret and hashes of recovery codes; successful setup or disabling MFA changes the security version used to revoke existing sessions. The website keeps a local theme cache and, when you are signed in, stores your appearance preference in your account profile so it can sync with the desktop app. Temporary interface state and pending billing/service operations use session storage.

• Create and secure accounts, authenticate sign-ins, and provide the requested desktop and website features.
• Process the particular text or file metadata you submit to an AI feature and return its result.
• Apply plan limits, measure usage, manage subscriptions, and address payment issues.
• Protect the service, prevent abuse and fraud, troubleshoot failures, and comply with legal obligations that apply to the operator.

Local file indexing and local media indexing run on the PC where the app and local services are installed. Account records, billing metadata, usage records, job inputs/results, and service records are held in a SQLite database on the configured PC service. The website's Vercel functions run in its iad1 region in Washington, D.C., USA. Depending on the configured transport, service requests either travel over a private Tailscale network or are placed in Vercel Queues as AES-256-GCM encrypted messages. Queue messages are configured with a maximum seven-day retention period and are removed sooner when acknowledged; failed or offline work may remain until it is retried or expires. Vercel can observe message and network metadata, but the queue payload is encrypted before it is sent to Vercel.

The packaged setup uses local language and embedding inference services on the configured PC. However, the specific AI input you submit is transmitted from the desktop app through the website/service path to that PC. A deployment that overrides the model endpoint may send it to a separate provider. Local file search itself stays on the indexing PC; AI prompts, text, and image previews are not covered by that local-search statement.

• Vercel hosts the website and, in queue transport mode, the encrypted message queue. Its infrastructure may process request, network, and operational log metadata under its own policies.
• Tailscale provides the private network when that transport is configured. Its network coordination service may process device and connection metadata; traffic between devices is end-to-end encrypted according to Tailscale's service design.
• Stripe hosts checkout and subscription management and processes payment details. UltraSearch receives subscription and customer identifiers and payment status, not full card numbers.
• Google provides optional sign-in and the Drive, Calendar, and Gmail connectors. UltraSearch receives identity data for sign-in, permitted Drive metadata and bounded document content, primary calendar event data, and Gmail subjects, snippets, and bounded message content for the features you request. Optional separately authorized and confirmed Agent actions can create Drive text files, calendar events, or send Gmail messages.
• Email delivery, when enabled, uses Resend or a configured SMTP provider to send account verification and administrator correspondence. The delivery provider receives the recipient address, message contents, and delivery metadata needed to send the email.
• Contact handling stores messages in the UltraSearch service database so we can review them and respond manually using the reply address you provide. The form does not send an automatic email response.

Connector access is limited to the provider data categories described above. Our use and transfer of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. Google connector data is used for the features you request, including search and requested AI assistance. It is not used for advertising or to train generalized AI models. Google account permissions can be reviewed and revoked from the user's Google Account settings.

Cookies are used for sign-in, the short-lived Google sign-in flow, and the restricted admin area. They are not used for advertising. The site stores your theme preference in browser local storage and temporary interface/billing state in session storage. We do not currently add advertising pixels or third-party analytics scripts.

The PC service is configured to remove completed, failed, and cancelled AI job records once they are more than 90 days old. This is routine cleanup and only runs when the service's pruning task runs, so removal may occur later. Cleanup removes the job input and result stored in that record. Pending queue messages are configured with a maximum seven-day retention period; actual queue retention depends on the deployed provider configuration. Account, password-hash, billing, usage, and other account-linked records do not have an automated self-service deletion path or a published fixed retention period. You can submit a deletion or correction request from Your data in settings. Requests are recorded for manual review; a submitted request does not immediately change or delete data, and some records may need to be retained for service security, accounting, or legal reasons.

Local indexes and other locally stored app data remain until the user removes them or an available cleanup function removes them. Uninstalling may preserve app data and should not be treated as a complete deletion request.

The implementation uses HTTPS for the website, scrypt password hashing, signed and HttpOnly web sessions, rate limits, encrypted queue payloads, and authenticated private-network service requests. These measures reduce risk but cannot guarantee security. Use a unique password and avoid submitting sensitive information that is not needed for the requested feature.

• View and update the profile fields available in dashboard settings.
• Sign out of the website or desktop app. You can also remove the website's local/session storage in your browser.
• Download a JSON copy of available account, usage, AI job, connector-name, and privacy-request submissions/status from Your data in dashboard settings. The file reports if history limits mean some records were not included; use the contact form to ask about those records. The export excludes credentials and internal notes. Local app data stored only on the Windows PC is not included in this website account export.
• Submit a correction or deletion request from Your data in settings. Requests are tracked for manual review and are not completed automatically.

UltraSearch is intended for people aged 13 and older. Account setup asks users to confirm they meet this minimum age. The service is not intended for children under 13. A parent or guardian who believes a child under 13 has provided information can submit a message through the contact form.

UltraSearch's website functions run in a US region. The PC service runs on the configured PC, and payment, sign-in, networking, and connector providers may process data in the United States or other countries. This means information may be handled outside the country where you live.

We will update this page when the product or its data practices materially change and revise the effective date. Review the page when you use the service.

Use the public contact form for questions or privacy concerns. Signed-in users can also use Your data in account settings.