1. Overview
AI Research Agent (“the Service”) is a personal portfolio project built by Tabish Ali (“tabishbot”). This policy explains how the Service collects, uses, and protects your data.
2. Data We Collect
- Account data: Email address and authentication provider (Google or email/password) when you sign up.
- Conversations: Messages you send and responses generated by the AI, stored to provide conversation history.
- Memories: Information you explicitly ask the agent to remember (e.g., “remember that I prefer Python”).
- Feedback: Thumbs up/down ratings you provide on responses.
- Usage data: Request timestamps, response latency, and error rates for observability (no personal content in traces).
3. How We Use Your Data
- Provide conversation history and memory features across sessions.
- Improve response quality through evaluation and feedback analysis.
- Monitor service health and debug issues.
- We do not sell your data, use it for advertising, or share it with third parties for marketing.
4. Third-Party Services
The Service uses the following third-party providers to function:
- Supabase: Database and authentication (hosted in Asia-Pacific).
- Groq: LLM inference for generating responses. Your messages are sent to Groq’s API.
- Google Gemini: Fallback LLM, embeddings, and evaluation judge.
- Tavily / Google Custom Search: Web search results when the agent searches online.
- Upstash: Redis for rate limiting and caching (no message content stored).
- Resend: Transactional email delivery (account confirmation, password reset). Processes your email address only.
- Vercel: Application hosting.
Each provider has its own privacy policy governing data it processes.
5. Guest Users
Guest users (not signed in) receive a temporary session. No data is persisted to the database. Conversations exist only in browser memory and are lost on page refresh.
6. Data Retention
Conversation data is retained indefinitely while your account is active. You can delete individual conversations from the sidebar. Account deletion removes all associated data (conversations, memories, feedback).
7. Security
- All data transmitted over HTTPS with HSTS enforcement.
- Database access protected by Row Level Security (users can only access their own data).
- API endpoints protected by authentication and rate limiting.
- Input sanitization and prompt injection detection on all user messages.
8. Cookies
This site uses only essential cookies required for the Service to function. We do not use any tracking, analytics, or advertising cookies.
| Cookie | Purpose | Duration |
|---|
| sb-*-auth-token | Authentication session (Supabase) | Session / 1 hour |
| guest_session_id | Identifies guest users for rate limiting | Session (cleared on browser close) |
| csrf_token | Prevents cross-site request forgery attacks | 24 hours |
Since these cookies are strictly necessary for the Service to operate securely, they are set without requiring consent under GDPR Article 6(1)(f) and the ePrivacy Directive. You can disable cookies in your browser settings, but this will prevent the Service from functioning correctly.
9. Your Rights
You can request deletion of your data by contacting support@tabishbot.com. You can also delete conversations individually through the app interface.
10. Changes
This policy may be updated occasionally. Changes will be reflected by updating the “Last updated” date above.