Privacy Notice

1. Controller

Max Plack
Lutherstraße 79
30171 Hannover
Germany

Email: contact@consens.io. Also see the Imprint. The project is privately operated in Germany and currently not monetised.

2. Purposes and data we process

• Prompts and model outputs in the web app: used to provide the service, send requests to selected AI models, and display answers. Signed-in Consensus conversations are automatically stored in Google Cloud Firestore, including questions, model answers, consensus, differences, sources, conversation context and attachment metadata. The app also automatically saves the associated sidebar bookmark. This does not require a separate Save action. Follow-up questions reuse stored conversation context, which may be condensed by an additional AI call. These records remain until you delete the conversation/bookmark or your account; there is no general automatic chat-expiry period. A separate temporary result for sharing expires after 24 hours and is removed by periodic cleanup, independently of the saved conversation. Each model answer you receive is also kept server-side for up to 24 hours, bound to your account and that run, so the consensus is built from exactly the answers the models returned; these records expire automatically and are deleted with your account.
• Consensus API runs: the administrator-issued Consensus API stores the submitted question, server-selected model plan, model outputs, consensus, differences analysis, status, and timestamps in Firestore so clients can retrieve asynchronous results and safely retry requests. API-run content and its idempotency mapping expire 30 days after acceptance and are removed by periodic cleanup; clients can delete completed runs earlier. Early deletion removes the run content; until the original expiry only a content-free record of the hashed idempotency key remains, so a deleted run cannot be started again under the same key. API keys are stored only as a SHA-256 hash plus a short non-secret display prefix and audit timestamps. During account deletion, a minimal UID-bound block record may be retained temporarily if cleanup must be retried.
• Technical requests and logs: your IP address, requested resource, connection/browser information and time are processed to deliver pages and protect the service. Application diagnostics use content-free error categories, counts and timings. Hosting infrastructure may keep separate access logs; the absence of IP addresses from our application database does not mean that infrastructure providers never process them.
• Reviewing conversations to fix and improve the service: the operator may look at individual stored conversations, including the question, answers, sources and run details, to find and fix errors, understand slow, failed or poorly answered runs, and improve answer quality and the service. Only the operator does this; results are kept as notes without your identity and are not used for advertising, sold, or used to build a profile about you. No additional copy of the conversation is made, so deleting a conversation or your account also ends any further review of it.
• Attachments and generated documents: ordinary Consensus attachments are processed transiently. In Agent (Beta), private file bytes and generated DOCX/PDF files are retained for 30 days in a private Google Cloud Storage bucket; extraction, provenance and version records are stored in Firestore. You can remove files earlier or delete the chat/account. Relevant excerpts or supported visual content may be sent to the models used for your request. Quotations and summaries in saved chat answers remain until that chat is deleted.
• Optional Google Calendar, Gmail and Google Drive sources: with your separate OAuth permission, Consens stores your Google account email, granted permissions and encrypted access/refresh credentials for Calendar and Gmail. You select calendars or relevant Gmail queries/messages for a message. Files you pick in Google's own Drive picker are read with a short-lived permission limited to those files (no stored Drive access) and are stored like any other file you attach. Before Google information enters a chat you affirmatively allow, once for that chat, that relevant Google information and stored chat context are sent to the chat's model endpoints, only with zero data retention and to endpoints that do not collect prompts; web search is off in such chats. There is no background calendar, inbox or Drive sync. By default Consens only reads Google data and never sends, changes or deletes anything in Google. Where an installation enables writing, creating or updating an event, including attendee notifications, or sending an email requires confirmation of its exact preview. Email drafts are stored in Consens, not in Gmail Drafts; previews include all recipients, content, original-message references and private attachments. Proposals, message-reference headers and action results are retained for 30 days; derived chat answers follow chat retention. Disconnect in the Agent Google controls to remove credentials immediately, and revoke access in your Google Account if provider revocation could not be confirmed. Deleting your chat removes its proposals, message references and private files; a content-free write-intent hash/status fence remains for up to 30 days to prevent duplicate unresolved operations. Deleting your account asks Google to revoke the stored access and removes connection credentials and all associated chat data.
• Account data: if you sign up, your e-mail address and a user ID are processed via Google Firebase Authentication (including optional Google Sign-In) for access control, quota handling, and related usage features. Your tier and saved bookmarks (query, answers, sources, attachment metadata) are stored in Google Cloud Firestore until you delete them or your account.
• Account settings: while you are signed in, the settings you choose in the app (run mode, the models and Agent options you pick, your own system prompt and display options) are stored with your account in Google Cloud Firestore, so they apply on every device you sign in on. Settings you never changed are not stored; when you change a model choice, the models then selected for all model families are saved together as your selection. When you first sign in on a browser, the choices already made in that browser, including before signing in, are copied to your account where it has none yet. Your browser keeps a copy, which is removed when you log out. The settings are deleted with your account. We also store the language the app was last shown in (English or German) with your account, so that emails about your watches and the Morning Brief use it; it is deleted with your account. Your own system prompt is sent with your questions to the models of your runs; please do not put special-category data in it.
• Your memory (optional profile, notes and saved memories): in Settings you can write a short profile about yourself (who you are, what you work on, how you want answers written, constraints that always apply) and a longer manually maintained memory note. It is stored on your account in Google Cloud Firestore and is added to the instruction sent to every model you select for a run, so those model providers receive it with each question. Unless you switch on “Let Agent update memory” (below), nothing is derived, summarized, or rewritten automatically from your questions or from model answers. If you explicitly select a statement in an interactive question, Consensus, or model answer and submit a “Remember” or “Correct memory” action, we send the current Memory (up to your plan limit), the selected statement, your text, and the selected add-or-correct intent to the configured model through OpenRouter. It may return only one structured replace, append, or delete proposal; our server validates and applies it. A Remember action may append or replace one uniquely matching passage but cannot delete one. We store an idempotency record, persistent usage counters, and a copy of your previous Memory for Undo. Undo is available for a short time after the change; the copy of your previous Memory is deleted automatically 30 days after the change. A content-free record (status, revision numbers and request reference) remains until account deletion so that a repeated request is not applied twice. These records are never used for Watch or Topic runs and are deleted with your account. Settings also holds a list of short saved memories that you can add, edit and delete yourself. Only if you switch on “Let Agent update memory” (off by default) may the Agent model you use add, update or delete saved memories while it answers. It may do so only on the basis of statements in your own messages in that chat: each change must quote your words, and our server rejects changes whose quote is not found there (a passage you quote from an earlier answer does not count as your words), so content from web pages, files, emails or other tool results cannot be saved on the strength of its own text. Agent is instructed not to keep special-category data unless you explicitly ask it to, and our server rejects text that looks like a password, access key, card or bank account number. Each change is shown while Agent works on the answer, and Memory settings list every saved memory for review, editing, deletion and Undo. For Undo we keep a record of each change with the previous and the new text for at most 30 days (at most the last 50 changes); the chat in which a change was made keeps only a note of which memory was added, changed or deleted (without its text) until that chat is deleted. Saved memories are sent with your profile and note to the models of your runs while Memory is on. Switching the option off stops new automatic changes; existing saved memories remain until you delete them. Apart from that, only text you enter in Memory settings or explicitly submit through Remember or Correct memory is stored and used. You can edit it, pause it with a single switch, or clear it at any time; it is deleted with your account. Scheduled Watch reruns do not receive your Memory profile as a separate input, and published pages do not display it as a profile field. However, generated answers or questions can reflect personal details from Memory; review content before publishing it. Please do not enter special-category data (for example health, beliefs, or political opinions) or other people’s personal data.
• Abuse prevention and usage: IP-based rate limits and account-bound counters prevent overload and quota abuse. We store usage, tier, request-idempotency and vote records, but no IP-to-account registration mapping. Model-ranking votes are bound to your account internally; the public ranking contains aggregate model counts.
• Feedback: if you send feedback, we store your message, the e-mail address you optionally provide, your account ID, and a timestamp, for as long as needed to follow up on the feedback.
• Earlier interest requests: records from the former Pro-interest feature can contain account ID, email and timestamp. The current app no longer offers that submission. Existing records are removed with account deletion or on an erasure request where no overriding retention ground applies.
• Browser storage and cookies: Firebase uses browser storage to maintain your requested login, with session-only storage as a fallback. A first-party HttpOnly session cookie for protected pages expires after one hour or is removed on logout. While you are signed in, a first-party cookie (consens_app=1, no identifier, one year) lets consens.io open the app directly instead of the start page; it is removed on logout. If you choose a language, a first-party cookie (consens_lang, no identifier, one year) remembers it; choosing the browser language again removes it. Local/session storage also holds interface and model preferences (for signed-in accounts a copy of the account settings above), feature flags and, if entered, your OpenRouter key. Persistent settings remain until changed or cleared in the app or browser. Storage/access strictly necessary for a service you expressly request is based on § 25(2)(2) TDDDG; related personal-data processing uses the GDPR grounds below. Rejecting or clearing browser storage can prevent persistent login or settings.
• Your own OpenRouter key, optional: if you enter it, the key is stored in your browser only. With each request, it is transmitted over an encrypted connection through our server to OpenRouter to authenticate your model requests. We do not store your key on the server.

3. Usage analytics with Umami

We use Umami Cloud for privacy-focused web analytics. Umami records page views and selected interaction events so we can understand which parts of consens.io are used, improve the product, find friction, and prevent abuse. The tracker is configured to respect browser Do Not Track signals and to exclude URL search parameters and hash fragments.

Umami may process technical usage information such as visited pages, referrer, browser, operating system, device type, approximate country, timestamps, and the custom events listed below. Umami states that its tracking code does not use cookies, anonymizes collected data, and does not identify users across websites.

The custom events we track are limited to product usage signals: landing-page calls to action, opening or using the app, sending or cancelling a query, completing a model run, generating or cancelling a consensus, copying a consensus or citation, changing interface modes, model selection changes, sidebar section opens, settings/help/feedback actions, login/register/password-reset/account-deletion attempts and outcomes, bookmark save/open/delete actions, and API-key test outcomes.

Event properties are limited to non-content metadata, for example selected mode, number of selected models, provider or model label, status, trigger type, the chosen mode (Compare, Consensus or Agent), and boolean states such as logged-in or own-keys. We do not send prompts, model answers, consensus text, feedback message text, e-mail addresses, passwords, authentication tokens, API keys, bookmark contents, or other user-entered content to Umami as custom event data.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in measuring aggregate product usage, improving the service, maintaining security, and prioritizing development. You can object to this processing under Art. 21 GDPR using the contact details above. To disable tracking in this browser, turn off Umami tracking. This saves a local opt-out preference; clearing browser storage removes that preference. You can remove the opt-out at any time. The tracker also respects browser Do Not Track signals.

4. Provider routing

Use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. Google information is used for the requested user-facing task and is not sold, used for advertising, or used to train general-purpose AI models. Every model request in a chat with Google data requires zero data retention and excludes endpoints that may collect prompts (the operator can narrow this to a reviewed allowlist); web search and external source checks are disabled. Those routing controls do not replace the operator's obligations to verify provider processing terms and required Google approvals.

Model requests go through OpenRouter, Inc. (USA). Available model families include OpenAI, Anthropic/Claude, Google/Gemini, Mistral, xAI/Grok, DeepSeek, Moonshot AI/Kimi, Z.ai/GLM, Meta/Muse and Alibaba/Qwen. A model developer is not necessarily the company hosting the endpoint: OpenRouter can route the same model to different infrastructure providers.

Depending on the feature, requests include your question, instructions, enabled Memory, attachments, earlier conversation context, model answers and sources. Consensus, Differences, coverage checks, dispute resolution, context preparation and explicit Memory edits can involve additional configured models beyond the comparison models. Scheduled Watches and API runs use server-configured models. Deselecting a comparison model therefore does not exclude every possible processing endpoint.

Our inference requests ask OpenRouter to send each request to the endpoint with the highest measured throughput among endpoints that do not collect prompts, using OpenRouter's data-collection setting ("deny"). Endpoints that may use prompts to train models are therefore not used. Outside chats with Google data (see above), zero data retention is not required: the endpoint that answers may keep prompts and answers for a limited period under its own terms, for example for abuse monitoring or legal obligations. Temporary prompt caching can occur, operational metadata is separate, and OpenRouter's own optional content logging depends on the account's settings.

Model runs can use OpenRouter's web-search tool. Search terms derived from your input may reach the selected search service, including Exa or native search services. Their processing and retention follow those services' own terms.

There is no EU-only endpoint restriction. Processing can take place outside the EU/EEA, including the USA and, depending on the actual endpoint, Singapore or China. Model labels alone do not identify the country of processing. Do not submit confidential information or sensitive personal data. This precaution does not replace our own data-protection obligations.

5. Shared pages (public sharing)

If you publish a consensus answer as a public shared page (an explicit, opt-in action in the app), we store the shared content (question, consensus answer, differences analysis, sources, and model names) together with your internal account ID. The account ID is used solely so that you can manage and revoke your own shared pages and so that we can fulfil our moderation duties; it is never displayed publicly and never embedded in the public page.

Shared pages created through the Share action are public: anyone with the link can read them, and selected pages may appear in search engines through operator-controlled indexing, including automated publication of operator-configured Topic content. Watch pages can instead be private. A private Watch page is available only to its creator while signed in, is never submitted for indexing, and is not shown as a related page. Please do not include personal data in content you make public.

Visitors can report a shared page ("Report this page"). The report record contains counters per reason, without a reporter account, IP address or browser data. The HTTP request is still subject to ordinary technical processing and rate limits. Reports prioritize a page for our review; decisions about indexing or blocking are made in that review, not automatically by the counters.

If you enable Consensus Watch, we periodically rerun only the original question using a limited set of models. We store compact history points (date, agreement score, verdict, and a short change summary) next to the selected public or private Watch page, but not the full rerun model responses. You can choose service notifications for material changes, for every successful new consensus, or when a condition you enter is met. The selected local run time and time zone are stored with the Watch schedule. Conditions are stored with the private Watch settings and evaluated against each newly generated consensus by an AI judge; they are not displayed on public pages. A condition notification is sent when the result changes to “met”, not repeatedly while it remains met. Result notifications may include the generated consensus text. Repeated failures may also trigger a one-time pause notice. Every watch e-mail includes a signed link that pauses the watch without requiring login. Notifications (including follower and Topic updates and the Morning Brief) are first stored as a delivery job containing the recipient reference, the question, scores and the change summary, but not the full consensus text, so a temporary delivery failure can be retried for a limited time. Before every attempt we check again whether the watch is still active and the subscription or channel is still enabled; a cancelled subscription is never delivered late. Finished delivery jobs are removed by regular maintenance about 30 days after they were created, and a watch owner's jobs immediately when the account is deleted. Jobs for page or Topic followers reference the subscription only by a pseudonymous identifier, not by e-mail address.

Optional Telegram delivery: Signed-in users may voluntarily connect a private Telegram chat and enable Telegram separately for individual Watches. For this purpose we store the Telegram chat and user identifiers, the public Telegram username/first name supplied by Telegram, connection status and minimal delivery metadata. The one-time account-link token expires after ten minutes; expired token records are removed by regular maintenance. Telegram receives the alert text required for delivery (question, agreement score and change summary or generated consensus) and callback data for actions such as mute or pause. We do not read unrelated Telegram chats or use Telegram data for model training. Disconnecting removes the account mapping; account deletion also removes pending links and delivery metadata. Delivery metadata is otherwise automatically removed after 90 days. Telegram's own processing is governed by its privacy policy.

Following a public Watch page (visitors): Visitors can subscribe to change notifications for a public Watch page or Topic by entering an e-mail address, without creating an account. The subscription only becomes active after the address is confirmed via a link we send to it (double opt-in); before confirmation, we already store hashed recipient/resource identifiers, send times and abuse-prevention counters. These are pseudonymous, not anonymous. The confirmation challenge expires after three days; expiry of the link does not itself delete all anti-abuse records. For active subscriptions we store only the confirmed e-mail address, the followed page, the confirmation date and the language of the confirmation page (English or German) for the notifications, but no IP address or other browser data. The address is used exclusively to send notifications about material changes to that page. Every notification includes a signed unsubscribe link that removes the address without requiring login. Follower addresses are deleted immediately when the subscription is cancelled and when the followed page is revoked or deleted.

Retention and deletion:

• Consensus results that are eligible for sharing, and the individual model answers a consensus is built from, are kept server-side with an expiry of 24 hours and are then removed by periodic cleanup. Saved conversations and bookmarks have their own storage lifetime.
• Shared pages remain online until you revoke them or delete your account.
• When you revoke a shared page, consens.io stops serving it to the public within a few minutes, and it is scheduled for permanent deletion after a 30-day retention period by periodic cleanup. Public pages are only cached briefly by our servers and browsers; copies kept by search engines or third parties are outside our control.
• When you delete your account, all your watches, watch history, shared pages, pending results and Telegram connection/delivery metadata are deleted as part of the account-deletion process.
• Report counters are deleted together with the page.
• Follower e-mail addresses are deleted when the subscription is cancelled via the unsubscribe link and when the followed page is revoked or deleted.

Legal bases: Art. 6(1)(b) GDPR for publishing and managing pages you create and for your own Watch settings and requested service notifications; Art. 6(1)(a) GDPR for visitor email subscriptions confirmed via double opt-in (withdrawable at any time through the unsubscribe link); Art. 6(1)(f) GDPR for moderation, report handling, and abuse prevention.

6. Legal bases under the GDPR

• Art. 6(1)(b): providing your requested account, AI comparisons, conversation history, Memory, API access, sharing and Watch functions, and answering service-related requests.
• Art. 6(1)(f): protecting the service against abuse, diagnosing faults, reviewing individual conversations to fix errors and improve the service, moderating public content, handling general feedback and maintaining aggregate model statistics. Our interests are a secure, reliable service and the protection of users and third parties.
• Art. 6(1)(a): optional visitor email subscriptions and any separately requested consent. Withdrawal applies to future processing and does not affect earlier lawful processing.
• Art. 6(1)(c): where processing is required to comply with a specific legal obligation, such as handling data-subject requests or lawful authority orders.

Providing an email address is necessary for an account or email subscription; submitting a question is necessary for an AI run. These are not statutory duties, but the requested feature cannot work without that information. Memory, uploads, sharing and Telegram are optional.

We do not use AI outputs to make decisions about you with legal or similarly significant effects under Art. 22 GDPR. Technical access and usage limits are enforced automatically; contact us to request a review if you believe a restriction is mistaken.

7. Recipients, processors, and international transfers

• Hosting: Render Services, Inc. (USA), for application hosting and technical requests. Render routes all traffic through its network provider Cloudflare, Inc. (USA), which processes IP addresses and request metadata to deliver and protect the connection. Render privacy information.
• Accounts and database: Google Firebase Authentication and Cloud Firestore, supplied by Google under the applicable account agreement, for authentication and stored application data. Google Sign-In is optional. Firebase privacy information.
• Analytics: Umami Cloud for the usage analytics described in section 3.
• AI and search: OpenRouter and the inference/search endpoints described in section 4.
• Email: Firebase for account verification and password setup/reset; the configured SMTP delivery service for Watch/Topic confirmations, notifications and Morning Briefs. Delivery involves recipient address, subject and message content, which can contain your question and results.
• Browser dependencies: Google (gstatic.com) receives technical requests including IP address when pages load the sign-in library. Rendering and maths libraries are served by consens.io itself.
• Telegram: optional delivery of your Watch notifications after connection and channel activation. Separately, the operator's Telegram bot receives content-free operational alerts (such as error categories or registration events), without prompts, emails or account identifiers.
• Other recipients: readers and search engines for intentionally public content; authorities or advisers only where legally required or necessary to handle a legal claim.

International transfers require a legal basis under Chapter V GDPR in addition to the processing basis in section 6. An adequacy decision applies only to covered recipients; the EU–US Data Privacy Framework applies only to participating, certified US entities. Other transfers require appropriate safeguards, such as applicable Standard Contractual Clauses and an assessment of the transfer risks.

Model selection, acceptance of the Terms, using your own API key and provider routing do not themselves provide those safeguards. We do not rely on a blanket Art. 49(1)(b) exception for routine AI requests. Contact us for information about the applicable recipient and a copy of relevant transfer safeguards.

8. Storage periods

Account data, account settings, conversations, context versions, bookmarks, Memory and revision records remain while you use those saved features, until the relevant deletion or account deletion. API runs expire after 30 days; temporary share results expire after 24 hours. Expiry and physical deletion are different: periodic cleanup removes expired records, and failed cleanup is retried.

Public/private snapshots, Watches and subscriptions follow the deletion rules in section 5. Feedback and correspondence are retained until the matter is resolved, with longer retention only where needed for a legal obligation or a concrete legal claim. Minimal security, quota and subscription-abuse records are processed for prevention of repeated abuse; some are account-bound and removed during account deletion. A hash or expired token is not automatically anonymous or deleted.

Account deletion also covers stored chats and context. If a cleanup step fails, the account is blocked from further writes and cleanup is retried; a minimal deletion-job record is retained to complete that work. Hosting logs, email delivery records and infrastructure backups have provider/configuration-dependent retention. There is no promise of immediate deletion from every infrastructure backup.

9. Your rights in the EU/EEA

• Access, rectification, erasure, restriction, and portability, subject to legal conditions.
• Right to object: you may object to processing based on legitimate interests for reasons relating to your particular situation (Art. 21 GDPR); you may object to direct marketing at any time without giving reasons.
• Withdrawal of consent with future effect.
• Right to lodge a complaint with a supervisory authority, particularly where you live or work or where an alleged infringement occurred; for example the Lower Saxony data-protection authority, Prinzenstraße 5, 30159 Hannover, Germany.

You can delete your account yourself at any time in the app settings ("Delete account"). This removes your authentication account, profile data, account settings, your memory profile, notes and saved memories, bookmarks, watches, watch history, shared pages, pending share results, Telegram connection/delivery metadata, and entries you created in the feedback and Pro-interest lists. For anything else, contact us at the address above.

10. Security

We implement appropriate technical and organizational measures, including access limitation, logging, and up-to-date transport encryption.

11. Children

consens.io is not directed at children. The service is intended for people aged 16 or older. Users under 18 also need permission from a parent or legal guardian where required to enter into the service agreement. The age rule is not a blanket consent to data processing.

12. Changes and contact

We may update this notice and indicate the last updated date below.

Email: contact@consens.io