Privacy policy
Last updated October 24, 2026
This policy covers the lytt website at lytt.arlenh7.com and the lytt chat assistant. Questions or requests go to lytt@arlenh7.com.
What we collect
| Data | Why | Kept until |
|---|---|---|
| Email address | Your login, and account emails you ask for | You delete your account |
| Password | Your login. Stored only as a bcrypt hash by Supabase Auth, never in plain text | You delete your account |
| Age confirmation | To keep lytt for people 13 and older. Your date of birth is checked on the server during signup and never stored, only a yes flag | You delete your account |
| Terms acceptance time and email preference | Record of consent, and whether you want product emails (off by default) | You delete your account |
| Chats, messages and the text of files you attach | To show your history and give lytt the context of the conversation. Encrypted with AES-256-GCM before storage | You delete the chat or your account |
| Sign-in sessions and auth logs, including IP address and browser details | Keeping you signed in and protecting accounts | Sign out, session expiry, or account deletion |
| Rate limit counters, keyed by your account ID or a SHA-256 hash of your IP address or email | Stopping password guessing and spam | Removed after one day |
We do not collect payment details, contacts, location, or analytics. We do not sell or share your data for advertising, and there are no ads.
Where your data goes
| Service | What it does with your data | Location |
|---|---|---|
| Supabase | Database and login system. Stores everything in the table above | AWS ap-northeast-2, Seoul, South Korea |
| Vercel | Hosts this website and runs its server code. Your messages pass through it on the way to the model. Keeps standard request logs such as IP address and page requested | Server functions in the icn1 region, Seoul, South Korea. Pages are delivered through Vercel's global network |
| Cloudflare | Carries messages from the website's server to the lytt machine through Cloudflare Tunnel, behind Cloudflare Access so nobody else can reach it. Also runs the Turnstile bot check on signup, login and password reset | Cloudflare's global network |
| The lytt machine | A computer run by lytt's operator that runs the model with Ollama. It reads your conversation to write a reply and does not save chats | Operator's own hardware |
| Resend | Delivers confirmation and password reset emails to your address when Supabase Auth requests them, from noreply@lytt.arlenh7.com | AWS ap-northeast-1, Tokyo, Japan |
Each provider handles data under its own privacy policy and keeps its own logs for its own limited retention period. Fonts are served from this site, so your browser does not contact Google or any font service.
Cookies
| Cookie | Purpose | Type |
|---|---|---|
| sb-...-auth-token | Keeps you signed in. HttpOnly, Secure, SameSite=Lax | Essential |
| theme | Remembers light or dark mode if you pick one | Preference |
| cookie_notice | Remembers that you closed the cookie notice | Preference |
There are no analytics, advertising or tracking cookies.
Security
- All traffic uses HTTPS with HSTS.
- Chat text and titles are encrypted before they are written to the database, and database rules only let you read your own rows.
- The model can only be reached by this website's server using a secret access token.
- Logins are rate limited and protected by a bot check.
Your choices and rights
- Delete everything: Settings has a delete button. It immediately erases your login, profile, chats, messages and the auth logs tied to your account from our database. Copies in a provider's backups, if any, expire on that provider's backup schedule.
- Delete a chat: use Delete next to any chat.
- Emails: product emails are off unless you turn them on. Turn them off in Settings or on the unsubscribe page.
- Access or correction: email lytt@arlenh7.com and we will answer within 30 days.
Children
lytt is not for children under 13. If we learn that an account belongs to someone younger, we delete it.
Changes
If this policy changes in a meaningful way, we will update the date above and tell signed-up users by email before the change applies.