Privacy Policy

Who we are

Stormi is made by YapsGG (“we”, “us”). This policy covers the Stormi app for iPhone and iPad, the server it talks to, and this website. Questions go to abdibrokhim@gmail.com.

What we collect

Your account

You sign in with Apple. We receive a unique identifier for your Apple ID and, if you choose to share them, your name and email address (which may be an Apple private relay address). We use these only to keep you signed in and to contact you about your account.

What you create

• Your bots: their names, jobs, avatars, chosen models, routines, and enabled plugins.
• Your chats with bots, the photos and screenshots you attach, and the threads where bots talk to each other.
• The steps bots take and the approvals you give or decline.

Connections you make

• Plugin sign-ins. When you sign in to a service so a bot can use it, we store the access token that service gives us, encrypted. We never see your password for that service. Google services are covered in detail under Google user data.
• Your OpenRouter account. If you connect it, we store the key OpenRouter creates for Stormi, encrypted. It is never sent to your device.

Usage

For each model call we record the bot, the model, the number of tokens, and the cost, so you can see your usage in the app. We don't use analytics or advertising SDKs, and we don't track you across apps or websites.

How we use it

• To run your bots: send your messages to the model you chose, use the tools you connected, and show you results.
• To run your routines on schedule and keep your chats in sync across your devices.
• To show usage and keep the service secure and working.

We don't sell your data, use it for advertising, or use it to train AI models.

Who processes it

We share data only with the providers needed to run Stormi:

• OpenRouter and the model provider it routes to (for example Anthropic, OpenAI, or Google) receive the messages, attachments, and tool results a bot needs to answer. Their own policies apply to that processing.
• Our hosting providers run our server and store our database.
• Services you connect through plugins receive the requests your bots make on your behalf.
• Apple handles Sign in with Apple and notifications.

We may disclose information if the law requires it.

Google user data

If you connect a Google plugin (Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, or Google Slides), you sign in on Google's own page and choose what to allow. This section explains what Stormi does with the Google user data it gets that way.

What we access

• Gmail: read your messages and settings, and write drafts and send email. Bots ask you before sending anything.
• Google Calendar: see your list of calendars, your events, and your free and busy times.
• Google Drive: see and download your files, and create or edit only the files Stormi makes or you open with it.
• Google Docs, Sheets, and Slides: read, create, and edit your documents, spreadsheets, and presentations.

Stormi reads this data only while a bot is working on something you asked for, or on a routine you set up, and only with the plugins you turned on for that bot.

How we use it

We use Google user data only to do what you asked for: for example, to summarize your inbox, draft a reply, find a time on your calendar, or update a spreadsheet. We don't use it for advertising, we don't sell it, and we don't use it to build profiles of you. We don't use Google user data to develop, improve, or train generalized AI or machine learning models.

Who we share it with

To answer you, the bot sends the parts of your Google data it needs to the AI model you chose for it, through OpenRouter and that model's provider (for example Anthropic, OpenAI, or Google). We share it with no one else, except when you tell a bot to (for example, by sending an email), to keep the service secure, or if the law requires it.

How we store and protect it

The access and refresh tokens Google gives us are encrypted at rest with AES-256-GCM, and are never sent to your device. We don't keep a copy of your mailbox, calendar, or files. What a bot reads while working for you is kept only as part of that chat (the bot's steps and its answer), so you can see what it did. Everything travels over HTTPS.

How long we keep it, and how to delete it

• Disconnecting a Google plugin in the app deletes its tokens from our server right away.
• Clearing a chat deletes the Google data the bot read in it.
• Deleting your account deletes all of it.
• You can also remove Stormi's access at any time in your Google Account at myaccount.google.com/connections.
• To ask us to delete your Google data, write to abdibrokhim@gmail.com. We do it within 30 days.

Limited Use

Stormi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This website

We count visits to this website with Vercel Web Analytics, which doesn't use cookies or identify you. If you ask a question in the FAQ, it's sent to OpenRouter to write the answer; we don't store it with anything that identifies you.

On your device

The app keeps a copy of your bots and chats on your device so it opens instantly, and shares a summary with its widgets. Your session token and Apple sign-in details are stored in the Keychain.

How long we keep it

We keep your data while your account exists. Clearing a chat in the app deletes it. Deleting your account deletes your account data, bots, chats, threads, attachments, plugin sign-ins, and OpenRouter connection from our server. Copies in our database provider's backups expire on their own.

Your choices

• Delete your account anytime in Settings › Delete Account. See how to delete your account.
• Disconnect a plugin or your OpenRouter account in the app at any time.
• Ask for a copy of your data or a correction by writing to abdibrokhim@gmail.com.

Security

Data travels over HTTPS. Plugin tokens and OpenRouter keys are encrypted at rest with AES-256-GCM. Bots treat what they read on web pages and in tools as information, not instructions, and ask before sending, paying, deleting, or submitting anything.

Children

Stormi isn't meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date above, and tell you in the app if the change is significant.