Privacy Policy

Last updated: August 14, 2026

This policy explains what New Axiom AI ("we", "the Service") collects, why, and the choices you have. We aim to collect the minimum needed to run the product.

1. Who we are

New Axiom AI is a conversational AI product whose distinguishing feature is honest reliability tiering: answers to checkable claims are decided by exact verification gates, and only those gate-decided results are labelled "verified." This policy covers the website and app at our hosted domain.

2. Information we collect

• Account information — your username, your email address (if you provide one), and a salted, one-way hash of your password. We never store your password in plain text.
• Your conversations — the messages you send, the answers produced, and their reliability tiers, stored so your chat history and saved tools persist across sessions.
• Usage metadata — request counts and timestamps used to enforce rate limits, prevent abuse, and operate plan quotas. Rate-limit identities are stored as keyed pseudonyms rather than readable email addresses or IP addresses. Operational telemetry records route, status, latency, and response size; it does not record prompts, response bodies, account identifiers, tokens, or IP addresses. We do not build advertising profiles.
• Research artifacts: when you start a Research Lab capsule, we retain its status, exact-gate ledger, summaries, hashes, and certificate bundle in your account storage.
• Billing information — if you subscribe to a paid plan, payments are processed by Stripe. We store your Stripe customer/subscription identifiers and plan status; we do not receive or store your full card number.

3. How we use your information

• To provide the Service — generating answers, running verification gates, and saving your history.
• To operate accounts, authentication, and (if applicable) subscriptions.
• To enforce fair-use rate limits and protect the Service and other users from abuse.
• To diagnose errors and keep the Service reliable.

4. AI providers and how your prompts are handled

To answer you, the Service may send the text of your prompt (and relevant conversation context) to third-party large-language-model providers, which currently include OpenAI, Anthropic, and Google. These providers process the text to generate a response and are bound by their own terms and privacy policies. Please avoid submitting sensitive personal data, secrets, or confidential information you would not want processed by a third-party model.

Optional AI video-planning enrichment. When configured, the Service may send Runway only a sanitized summary of one proposed concept and the locally rendered PNG reference frame for that concept. It does not send conversation history, attachments, usernames, account identifiers, or the original raw prompt to Runway. Completed clips are copied into the Service's signed, account-scoped asset storage; planning and building still work from the local motion prototype when Runway is unavailable or a usage limit is reached.

4a. Code mode in the terminal client

The terminal client's newaxiom code command reads files from a folder on your computer and, in the default (hosted) lane, uploads them to this Service so a model can propose an edit. Specifically:

• What is sent. Only the files listed to you in the prompt shown before the first upload in a given folder. The client shows the full list, its size, and everything it withheld, and does not send anything until you answer. Consent is remembered per folder; you can see what is remembered in ~/.newaxiom/cli.json and delete it.
• What is never sent. Files whose names or contents look like credentials (.env, *.pem, id_rsa, .npmrc, private-key blocks, API-key-shaped strings, and similar) are withheld and named to you. Version-control internals (.git/), virtual environments, node_modules/ and caches are never read. There is no flag that overrides the credential screen.
• Who processes it. The same third-party model providers named in section 4 above. Uploaded file content is used to answer that one request; it is not used to train our systems.
• Retention. Code-mode requests are subject to the retention in section 6. We do not log the file contents of a code-mode request separately from the request itself.
• Sign-in required. Code mode does not work in the shared guest workspace, so your code is always associated with your own account rather than an anonymous one.
• Keeping it local. With the --local-key option the client uses your own provider API key from your environment and contacts that provider directly. In that mode nothing is sent to this Service at all.
• On your machine. Before any file is written, the client saves a snapshot outside the folder (in ~/.newaxiom/code-sessions/) so the change can be undone. Those snapshots stay on your computer and are never uploaded.

5. Sharing

We do not sell your personal information. We share it only with the service providers we rely on to operate — hosting (Render), payments (Stripe), and the AI providers named above — and only as needed to run the Service. If you deliberately publish a conversation via a share link, the content you chose to share becomes accessible to anyone who has that link until you revoke it.

Contributing to the community library. If you contribute a tool or a discovery (Terms, section 5A), that is a publication, and this is exactly what it publishes:

• Your username is attached publicly and is shown as the contribution's author. It is not anonymous and cannot be made anonymous while the contribution is published.
• The contribution's content, its verification tier, and its receipt are published. For a contributed code tool, the source code is served publicly so other users can read it before running it.
• The community library and the leaderboard are readable without signing in, so contributor usernames and shared tools — including that source — are visible to anyone who reaches those endpoints, not only to signed-in users. The contributed-discoveries database does require sign-in to read.
• Contribution is opt-in throughout, and uploading discoveries is off unless you turn it on. Nothing from your conversations is contributed by default.

Withdrawal. You can withdraw a contribution at any time. A withdrawn discovery is removed from the database. A withdrawn tool is delisted and can no longer be installed — but copies other accounts installed before you withdrew are independent copies in those accounts, and we cannot reach into them to delete them. We would rather say that plainly than promise an erasure we cannot perform.

6. Data retention

Account data, conversation history, and Research Lab artifacts are retained while your account exists. You can delete chats from within the app. To delete your account and associated data, contact us (below) and we will remove it, subject to records required for security, legal, or accounting reasons. Backups are retained on a rolling operational schedule and age out through that schedule.

Contributions are retained differently, because other people rely on them. A published contribution stays in the library until you withdraw it or we remove it — deleting a chat does not withdraw a contribution that came from it. Withdrawal works as described in section 5, including its limit on copies already installed elsewhere. Credit and tool-point ledger entries are kept as an audit record of what was earned and why; credits themselves expire 365 days after being earned.

7. Security

Passwords are stored only as salted one-way hashes, password resets require a short-lived code sent to a previously verified email, and a successful reset revokes older sessions. Sessions use signed tokens and access to per-account data is authenticated. No system is perfectly secure, but we take reasonable measures to protect your information.

8. Your rights

Depending on where you live (for example under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise any of these, contact us and we will respond within a reasonable time.

9. Children

The Service is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

10. Changes

We may update this policy as the Service evolves. Material changes will be reflected by the "Last updated" date above.

11. Contact

Questions, refunds, privacy or account-deletion requests: use the contact form (it records your message on the server and does not depend on email delivery), or write to support@newaxiomai.com.