Privacy Policy
What we collect, why we need it, and how you stay in control of it.
1. Who is responsible for your data
LayerAssist (layerassist.com) is operated privately by its owner, who is the controller of the personal data described here. For any privacy question or request, open a support ticket directly from your account (Support).
2. What we collect
Account data: your email address, display name, language, country, time zone and preferences. Your account password is stored only as a salted scrypt hash. If you turn on two-factor authentication, its secret is stored encrypted.
Signing in with Google: if you choose “Continue with Google”, Google tells us your Google account’s identifier, its email address, whether Google confirmed that address, and your name. We keep the identifier and the address with your account to recognise you when you sign in, and use the name only as your display name when the account is created. We never receive your Google password, and we do not ask for or get access to anything else in your Google account, such as your emails, files or contacts. Once your account has a password, you can disconnect Google at any time in Settings → Security.
Sites, servers and accounts you connect: names, addresses, settings and what LayerAssist learns about them while working (for example software versions or configuration). Access details such as passwords, keys and tokens are stored encrypted with AES-256-GCM in your vault.
Conversations and tasks: the messages and images you send, LayerAssist’s answers, and a record of every task — what was checked or changed and the result. For every file LayerAssist changes, the task record keeps the changed lines with a few surrounding lines, the file path and the time, so you can review and undo the change; values that look like passwords, keys or tokens are masked in what you and the Assistant see, and the exact lines needed for an undo are stored encrypted. Anything in a message that looks like a password, key or token is replaced with •••••••• before the message is stored.
Security and technical data: sign-in sessions, the IP address and browser of each session (stored hashed and encrypted), and security events such as failed sign-ins. We use them to keep your account safe and to prevent abuse.
Billing data: your plan, subscription status and a customer reference at the payment provider. Your card and payment details are handled by the payment provider; we never see or store them.
Support and email: the support tickets you open, with their messages and attachments; the account emails we send you (address confirmation, password reset, support replies); whether you chose to receive offers and product news; and the country your sign-up and latest sign-in came from, as reported by our network provider.
How you found us: when you arrive from a link that carries campaign parameters (such as an ad’s campaign name or Google’s ad-click reference), LayerAssist reads them from the link and keeps them, with the first page you opened and when, only in the open page; nothing is stored on your device. If you create an account during that visit, they are saved with your account, to know which campaigns work. We never send them to anyone else, and we use no advertising trackers or third-party cookies.
Contact form: when you write to us through the contact form, we collect your name, email address, topic and message, your country as reported by our network provider, and a one-way hash of your IP address and browser, to fight abuse. If you are signed in, the message is linked to your account. We answer by email ourselves; there are no automatic replies.
3. Why we use it
- to provide LayerAssist and carry out the tasks you ask for (performance of our contract with you);
- to keep the Service, your account and your systems secure, and to prevent fraud and abuse (our legitimate interests);
- to fix problems and improve reliability (our legitimate interests);
- to know which of our campaigns bring new customers, from the campaign parameters described above (our legitimate interests);
- to answer your support tickets and send the account emails the Service needs (performance of our contract with you);
- to answer you when you write to us through the contact form and to keep the form free of abuse (our legitimate interests, or steps before a contract when you ask about the Service);
- to send you offers, new features and product news, only if you opted in — you can switch this off at any time in Settings → Notifications (consent);
- to meet legal obligations, for example tax records kept by the payment provider or valid requests from authorities (legal obligation).
We do not sell your personal data, share it for advertising, or use it for automated decisions that have legal or similarly significant effects on you.
4. How AI is involved
To answer you, LayerAssist sends the relevant parts of your conversation and of the technical findings to an AI model provider (such as Anthropic or OpenAI). Technical findings can include limited excerpts of files, logs, command output and web pages from the systems you connected, when the task needs them. Saved passwords, keys and tokens are never included, and values that look like secrets in messages, files and output are masked first.
We use these providers through their business APIs, whose terms do not allow them to use this data to train their models. They process it only to return a response and keep it only for the limited time their terms allow for safety and abuse monitoring.
To apply Fair Usage (see the Terms of Service), we record for each AI request which provider and model answered and how much processing it used, with its cost. These usage records do not contain the content of your messages or of your systems.
6. International transfers
Some providers may process data outside your country, including in the United States. Where the law requires it, these transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses.
7. How long we keep data
- Account, connected systems, conversations and task records, including the history of changed file lines: while your account is open.
- After you ask us to delete your account: deleted or anonymised within 30 days, except what we must keep.
- Security records: only as long as needed to protect the Service, normally no longer than 12 months.
- Contact form messages: kept to handle your request and its follow-up, and deleted with your account or when you ask; messages detected as spam are deleted after 30 days.
- Payment records: kept by the payment provider for as long as tax and accounting laws require.
For files that cannot be recorded line by line (for example binary or very large files), LayerAssist saves a copy on your own server, in ~/layerassist.backups, before changing them. These copies belong to you; we do not delete them, and you can remove them whenever you choose.
8. How we protect it
- all connections to LayerAssist are encrypted with TLS;
- saved access details are encrypted with AES-256-GCM using keys derived from your vault passphrase, and can be used only while you keep your vault unlocked;
- passwords and keys are shown back only to you, when you choose to view a saved login with your vault unlocked, and for at most a minute; they are never sent to AI models and never written to logs;
- connections to your systems run from a separate, isolated server with no access to our database or your vault;
- every action is recorded, and deleting anything requires your explicit request or a separate confirmation;
- two-factor authentication is available for every account;
- our administrators can see account details, conversations, tasks and support tickets only when needed to give support, investigate a problem or prevent abuse, and every administrative action is recorded in an audit log.
No system can be perfectly secure. If a breach affects your personal data, we will inform you and the competent authorities as the law requires.
9. Your rights
Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw any consent you gave. You also have the right to complain to your data protection authority.
To make a request, open a support ticket from your account (Support) and choose “Privacy and data”; if you can’t sign in, reply to any email we have sent you. We may ask you to confirm your identity, and we answer within 30 days. We will not treat you differently for using your rights.
11. Children
LayerAssist is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
If we change how we handle personal data, we will update this page and its date. For material changes we will tell you in the app at least 14 days before they apply.
Questions about this document? Open a support ticket from your account: Support.