Legal
Privacy Policy
Last updated 16 August 2026
Tokad is an ad-supported AI chat service. This policy explains exactly what we collect when you use it, who your messages are sent to so they can be answered, how advertising and measurement work, and how you can export or delete everything at any time.
1. Who we are
Tokad is operated at tokad.ai. For any privacy question, request or complaint, write to privacy@tokad.ai. We answer data requests within 30 days.
Where the GDPR applies, Tokad is the data controller for your account and your conversations, and the AI providers listed below act as processors for the single request they answer.
2. Age requirement
Minimum age
You must be at least 13 years old to use Tokad, or at least 16 if you are in the European Economic Area or the United Kingdom. Tokad is not directed to children, we do not knowingly collect data from anyone below these ages, and advertising shown on Tokad is not personalised to children.
If you believe a person below the minimum age has created an account, tell us at privacy@tokad.ai and we will delete the account and its conversations.
3. What we collect
| Data | Why we have it |
|---|---|
| Account email address | Created when you sign up with email or with Google. It identifies your account, secures sign-in and lets us contact you about the service. |
| Display name and preferences | Optional. Theme, default model, default tier, voice and language settings you choose in Settings. |
| Chat content | Your prompts, the model replies, and any files you attach or that Tokad generates. Stored against your account so your history is there next time you open Tokad. |
| Usage and product analytics | Page views and non-content events such as which model or tier you selected, whether an ad loaded and completed, and which tools were used. Collected with Google Analytics 4 and only after you accept analytics cookies. |
| Advertising identifiers and cookies | Set by Google and other advertising partners when ads are served, and only after you accept advertising cookies. These may include a device or browser identifier used for frequency capping, fraud prevention and measurement. |
| Reward and credit records | When you complete a rewarded ad or an offer from an advertising partner, we record the transaction identifier and the credits granted, so a reward is granted once and fraud can be reviewed. |
| Technical logs | IP address, browser type and timestamps, kept briefly for security, rate limiting and abuse prevention. |
| Connected accounts | If you connect Google Drive, Gmail, Google Calendar or Slack, we store an encrypted access token and only use it to run the action you ask for in chat. |
We do not sell your personal information, and we do not use the contents of your conversations to target advertising.
4. How your messages are processed by AI providers
Tokad does not train or run its own models. To answer you, the text of your message, any attached files and the recent messages in that conversation are transmitted to the model provider you selected, or to the provider our router selects when you leave the choice on Auto.
- Anthropic, for the Claude models.
- Google, for the Gemini models.
- OpenAI, for the GPT models.
- Requests may be routed through the Lovable AI Gateway, which forwards them to those providers on our behalf.
- If you turn on web search, your search query is sent to a search provider so results and citations can be returned.
Each provider handles that request under its own terms and privacy policy, and we send only what is needed to produce the answer. Never paste anything into Tokad that you are not permitted to disclose to a third-party AI provider.
5. Advertising
Tokad is free because advertising pays for the model usage. Two kinds of advertising appear:
- Rewarded ads, which you start yourself by choosing to view one in exchange for answering a message with a specific model tier.
- Standard display banners on pages that carry substantive content, such as the landing page, shared conversations and an active chat thread.
Ads are delivered by third parties, including Google, and by offerwall or rewarded-ad partners. Those third parties may set and read cookies or similar identifiers on your device to serve the ad, cap how often you see it, detect invalid traffic and measure performance. We do not give them your email address, your prompts or your replies.
Google's use of advertising cookies is described in Google's Advertising and Privacy pages, and you can manage personalisation in your Google Ads Settings.
7. How long we keep data
| Data | Retention |
|---|---|
| Conversations and attachments | Kept until you delete the conversation or your account. Deleting a chat removes it and its messages. |
| Account record and settings | Kept for as long as your account exists. |
| Shared conversation snapshots | Kept until you revoke the share link, and revoking it removes public access immediately. |
| Analytics events | Retained by Google Analytics for up to 14 months, then deleted automatically. |
| Reward, credit and postback records | Kept for up to 24 months for fraud review and advertising partner reconciliation. |
| Technical and security logs | Kept for up to 90 days. |
When you delete your account, your profile, conversations, messages, settings, connected accounts and credit balance are deleted from our database. Backups roll off within 30 days.
8. Your controls and rights
- Export: Settings, then Data and privacy, then Export my data downloads everything you have written and every reply, as a file.
- Delete: Settings, then Data and privacy, then Delete account permanently removes your account and its data. This cannot be undone.
- Correct: change your display name and preferences at any time in Settings.
- Disconnect: remove a connected Google or Slack account from the Connectors panel, which deletes the stored token.
- Object or restrict: depending on where you live, you may have the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority.
You can also make any of these requests by writing to privacy@tokad.ai.
9. Security and transfers
Data is encrypted in transit. Conversations are protected by row level security so an account can read only its own rows, and access tokens for connected accounts are encrypted at rest with AES-256-GCM.
Our infrastructure, our AI providers and our advertising partners operate internationally, so your data may be processed outside your country, including in the United States, under appropriate safeguards such as the European Commission's standard contractual clauses.
10. Changes to this policy
We update this policy when the product changes. The date at the top of this page always reflects the current version, and material changes will be announced in the app. Questions go to privacy@tokad.ai.