Privacy Policy

In short: we run no servers that hold your data, we have no accounts, we use no analytics, cookies or trackers, and your photographs never leave your device.

1. Who is responsible

Debajyoti Saikia, as an individual, is the data controller for the limited processing described below.

2. What we collect

Nothing on a server we control. Bristle has no user database, no account system, no analytics and no advertising or tracking cookies. We do not build a profile of you and we cannot identify you.

3. What is stored on your device

The following is written to your browser's local storage and stays there. You can erase all of it by clearing site data for this site.

• Model provider credentials — the API key or OAuth token you enter, so you do not have to enter it every visit.
• Your reference photograph — kept so a page refresh does not lose your work.
• Preferences — selected provider and model, reasoning level, context window, subject category, and your light/dark theme choice.
• Discovered model capabilities — cached so we do not re-query your provider on every visit.

4. What is sent to third parties

Your AI model provider. To paint, the agent sends your chosen provider a reduced-size copy of your reference photograph, small snapshots of the canvas as it works, and the text of the conversation. This is the one case where an image leaves your device, and it goes only to the provider you selected and authenticated with. That provider's own privacy policy governs what they do with it.

GitHub, if you sign in with Copilot. The OAuth device flow exchanges tokens with github.com and api.github.com. Because those endpoints refuse direct browser calls, the two requests pass through a function on our host, which forwards them and keeps nothing.

Our host. The site is served by Cloudflare Pages, which processes standard request logs including IP address for security and abuse prevention as part of delivering the site.

5. Legal basis and your rights

Because we hold no personal data on any server, there is no account to access, correct, export or delete. Everything the Service knows about you is on your own device and under your control: clearing site data removes it completely and immediately.

6. Children

The Service is not directed at children and we knowingly collect no personal information from anyone.

7. Changes

If this policy changes, the date at the top of this page will change with it.

8. Contact

Questions about privacy can be sent via the contact form on deb0.com.