The short version
- Your conversations are end-to-end encrypted when you are signed in. They are encrypted on your device with a key derived from your password. We store only ciphertext and cannot read your chats.
- Spike runs on our own hardware. Your prompts are not sent to OpenAI, Anthropic, Google or any other model provider.
- No analytics, no tracking, no advertising. The site loads no third-party scripts, tracking pixels, external fonts or CDNs.
- We use essential cookies or local storage only—to keep you signed in and remember your settings. There is no advertising or profiling cookie.
What we store
| Data | Why | Notes |
|---|---|---|
| Email address | Account identity, sign-in, verification and important notices | Required for an account |
| Username and display name | To identify your account | Chosen by you |
| Password | Sign-in | Stored only as a salted hash—never in readable form |
| Session tokens | To keep you signed in | Stored hashed |
| Chat history | To sync your conversations across your devices | End-to-end encrypted—unreadable to us |
| Settings and preferences | Language, appearance and model choices | |
| Profile picture | Shown in the app | Encrypted at rest |
| Subscription status | To give you the plan you paid for | Card details are handled by Stripe, never by us |
Using Spike without an account
You can use Spike signed out. In that case your conversations stay in your browser’s local storage on your device and are not synced to us. There is also a private mode that keeps a conversation in memory only, so it is not written to your device at all.
End-to-end encryption, and its one honest limitation
Stored chat history is encrypted on your device before it reaches us, so our servers hold ciphertext we have no key for. This is real, not marketing.
The honest limitation: to answer you, the model has to see your message. Your prompt is processed in memory on our own inference server at the moment you send it. It is not sold, not used to train models, and not shared with a third-party AI provider—but it is briefly readable in memory while it is being answered.
Who else processes data
| Processor | What for | What they receive |
|---|---|---|
| STRATO (Germany) | Hosting the website and API front end | Standard server access data |
| Stripe | Payments and subscriptions | Your payment details go to Stripe directly and are never stored by us |
| Brevo | Sending account emails, such as address verification | Your email address |
| Apple (APNs) | Push notifications to the iOS app | A device token and a short notification preview |
Model inference and speech-to-text run on our own hardware, not on a third-party service.
Server logs
Our web server keeps ordinary access logs—IP address, time, requested page and browser user agent—for security, abuse prevention and diagnosing faults. We also rate-limit by IP address to stop abuse.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. You can also complain to a data protection authority.
You can delete your account from Account settings in the app. That permanently removes your account, synced chat history, memory, settings and profile picture, signs out every device, and cancels an active subscription paid by card. For this or any other request above, email support@spikeai.de.
A subscription bought through the App Store is the one thing we cannot cancel for you. Apple bills it, and only you can stop it—in Settings › Apple Account › Subscriptions on your iPhone. Deleting your Spike account does not end it, so cancel it there first or immediately afterwards.
One exception we keep: invoices and payment records. Tax law requires us to retain these even after an account is deleted, so they are kept on that legal basis rather than erased. They are held by our payment processor, not in the app.
One consequence of end-to-end encryption worth knowing: because we cannot read your chat history, we also cannot recover it for you. If you lose your password, that history cannot be restored.
Changes
If this policy changes materially we will update the date above and, where it matters, tell you in the app.