The short version. Starnexus sends what you type to an AI model and shows you the answer. We do not sell your data, we do not show ads, and we do not use your conversations to train models.
We are not the ones running the models. Your messages are sent to one of five outside companies, and this policy names each of them, what they say they do with your data, and where in the world it goes. Four of the five are based in China or are subsidiaries of Chinese companies. If that matters to you, read the sub-processor section — it is the part of this document that actually tells you something.
Last updated 24 August 2026.
Starnexus is operated by Starwisp. Contact us at support@starwisp.co.
Your account. Email address and display name. If you sign in with Google, we receive your email address, name and profile picture from Google.
Your conversations. The messages you send, the replies you receive, and which model produced each reply. These are stored on our server so your history is there when you come back.
Usage. Token counts and credit consumption per request, so we can meter your plan.
Location — only if you allow it. If you turn on the weather widget and grant permission, your device's coordinates are sent to Open-Meteo to fetch a local forecast. We do not store them. Deny the permission and the widget stays empty; nothing else in the app changes.
Voice, if you use it. See the voice section below, which you should read, because voice does not behave the way the rest of the app does.
We do not collect contacts, photos, browsing history, or advertising identifiers.
We do not sell or rent your data. We do not show ads or share data with ad networks. We do not use your conversations to train our own models — we do not have models of our own.
This is the section worth reading carefully. When you send a message, it leaves our server and goes to whichever company runs the model you picked. We are a processor in the middle; they are the ones doing the computing.
We share your messages and any attachments with the AI lab whose model you selected — five providers, listed in the app's model picker. We share your email address and payment details with our payment processor. On the tiers we use, neither trains on your data. There are no other recipients: we do not sell your data and we do not share it with advertisers or data brokers.
Three honest caveats, because a summary like that invites more confidence than the underlying documents support.
Moonshot contradicts itself. Its binding Terms of Service say it may use submitted content by default, with opt-out available only by negotiation. Its privacy policy says otherwise. We cannot tell you which governs, and we are not going to pick the flattering one.
Zhipu's no-training clause is published inside square brackets in their own terms — a drafting convention that normally marks text as not yet settled. Their claim to store no request content also sits alongside a clause reserving the right to use that content to prevent abuse, which would require storing it.
Only Google publishes a retention period. The other four do not say how long they keep your messages. We asked their documents and got no answer.
None of the five publishes whether a human ever reads API content. We are not going to tell you they don't, because we don't know.
Turning your speech into text works differently in each of our apps, and the difference is worth knowing before you use it.
On Mac, transcription runs entirely on your device using Apple's on-device speech framework. The audio never leaves your Mac, and it never reaches us.
On iPhone and iPad, transcription uses Apple's speech recognition, which may send your audio to Apple to be processed. Apple performs the transcription; the audio never reaches us.
On the web, transcription is performed by your browser's own built-in speech recognition, not by us. In practice that means Chrome sends your audio to Google and Safari sends it to Apple. This is your browser's behaviour rather than ours, and again the audio never reaches our servers.
Xiaomi — voice output. Every spoken reply is generated by Xiaomi's text-to-speech model, regardless of which model you chose for the conversation. If you picked a particular model on purpose, read-aloud still sends that reply's text to Xiaomi.
These are not model providers, and they receive data whether or not you have picked their company's model.
Google — news headlines. The home screen loads headlines from Google News. This sends your IP address to Google when you open the app, before you sign in and regardless of any model choice.
Open-Meteo — weather. Your coordinates, if you granted location.
Before routing, your message is checked against a keyword list. If it matches, the request is routed to a provider outside China rather than to the model you selected. It is automated keyword matching, never human review, and it changes which model answers — it does not block your question or report it anywhere.
Naming a conversation and extracting memory facts both send parts of your conversation to a model, which may not be the model you selected for that conversation.
Your conversations stay until you delete them or close your account. Deleting a conversation removes it from our database. Closing your account removes your account record and all conversations attached to it. You can export your data from Settings at any time: your account details, personalisation, saved memories, conversations and messages, usage, and payment and subscription history. Workspaces are not currently included in that file.
We cannot delete anything already sent to a model provider — that is governed by their terms, summarised above.
Depending on where you live you may have the right to access, correct, export or delete your data, and to complain to a regulator. If you need something the Settings export does not cover, ask us and we will provide it. Email support@starwisp.co.
Starnexus is not intended for children under 13, and we do not knowingly collect their data. We do not ask for your date of birth; the age rating on the App Store and Google Play is what enforces this.
Traffic is encrypted in transit. The database is encrypted at rest and backed up to object storage with encrypted nightly snapshots. Passwords, where used, are hashed.
We will post changes here and update the date at the top. Material changes will be notified in the app.