The short version. Starnexus sends what you type to an AI model and shows you the answer. We do not sell your data, we do not show ads, and we do not use your conversations to train models.
We are not the ones running the models. Your messages are sent to outside AI companies, five of them, and this policy names each one, what they say they do with your data, and where in the world it goes. Four of the five are based in China or are subsidiaries of Chinese companies. If that matters to you, read the section on where your messages go. It is the part of this document that actually tells you something.
Last updated 16 October 2026.
Starnexus is operated by Starwisp. Contact us at support@starwisp.co.
Your account. You sign in with Google, or with Apple in our iPhone, iPad and Mac apps. We keep your email address, your name, and the account ID Google or Apple gives us. If you sign in with Apple and choose to hide your email, we get the private relay address Apple creates instead. If you use Starnexus without signing in, we create an anonymous guest account.
Your conversations. The messages you send, the replies you receive, each conversation's title, and which model wrote each reply, with technical details such as response time, token counts, which app you used, your plan at the time, how the model was chosen, including whether another model was tried first, and whether the message matched the sensitive-topic list described under routing. These are stored on our server so your history is there when you come back, on any device.
Things you attach. Images and files you attach are sent to the AI company answering that message so it can read them. We do not save the image or the file. If you send an attachment without typing anything, its file name may be saved as your message.
Images you create. Images you ask Starnexus to make are saved on our server so you can see them again. Each one has a long, unguessable web address, and anyone who has that address can open the image.
Memory. While memory is on, Starnexus picks out facts about you worth remembering every few messages, such as your projects and preferences, saves them, and adds them to later chats so answers fit you better. Memory is on by default. You can turn it off with the “Use memory” switch in Settings, under Personalization, in the web app and in all our apps. The choice applies to your account everywhere. While memory is off, saved memories are not used in replies and nothing new is saved. The memories you already have stay, and you can see and delete them in Settings, under Personalization, in the web app and in all our apps. Guests do not get memory.
Settings you write. Your display name, custom instructions, "about you" text, workspace names and instructions, and app settings such as theme and text size.
Usage. Token counts and credits used per request, so we can meter your plan, and an activity record such as which model answered and which features you used. If you use the look-up feature, the record keeps the first 60 characters of what you looked up.
Feedback, if you send it. If you rate a reply or fill in a feedback form, we keep what you send. The feedback section below lists exactly what that includes.
Payments. If you subscribe, Stripe takes the payment. We keep your Stripe customer ID, your subscription, and a record of each payment: plan, amount and date. Your card details go to Stripe and never reach our server.
Weather and location. The weather widget in our iPhone, iPad, Mac and Android apps is on by default. If you allow location access, your device's coordinates are sent to Open-Meteo for the forecast and air quality, and to Apple (iPhone, iPad, Mac) or your phone's built-in geocoding service (Android, which on most phones is Google's) to find the name of the place. If you add a city by name, the name is looked up the same way and its coordinates go to Open-Meteo. None of this reaches our server. If you deny location access and add no city, the widget stays empty; nothing else in the app changes.
Voice, if you use it. See the voice section below, which you should read, because voice does not behave the way the rest of the app does.
Your IP address. We do not save it in our database. Our server keeps it in memory, until the server restarts, to limit repeated sign-in attempts. If someone fails to log in to our own admin page, we log their IP address. Cloudflare and DigitalOcean, which carry and host our service, see your IP address and may keep it in their logs.
We do not collect your contacts, your photo library, your browsing history, or advertising identifiers.
We do not sell or rent your data. We do not show ads or share data with ad networks. We do not use your conversations to train our own models — we do not have models of our own.
This is the section worth reading carefully. When you send a message, it leaves our server and goes to the company that runs the model answering it. That is the model you picked, or the one Automatic picked for you, with the exceptions described under routing below. The app shows which model wrote each reply, under the reply. We pass your messages on, and those companies do the computing on our behalf.
The five AI companies. Google (Gemini) is based in the United States; we use its global Gemini API. Alibaba Cloud (Qwen) is a subsidiary of Alibaba, a Chinese company; we use its international region, in Singapore. Z.ai (GLM), formerly called Zhipu AI, is based in China; we use its international platform. Moonshot AI (Kimi) is based in China; we use its international platform. Xiaomi (MiMo) is based in China; we have not found where it processes API requests.
We send your messages, and any images or files you attach, to the company answering them. Your display name, custom instructions, "about you" text and, when memory is on, saved memories go along with ordinary chat messages, so that company sees them too. Each of the five says that, on the tiers we use, it does not train on your data. Two of those statements are weaker than they sound.
Moonshot contradicts itself. Its binding Terms of Service say it may use submitted content by default, with opt-out available only by negotiation. Its privacy policy says otherwise. We cannot tell you which governs, and we are not going to pick the flattering one.
Z.ai's no-training clause is published inside square brackets in their own terms — a drafting convention that normally marks text as not yet settled. Their claim to store no request content also sits alongside a clause reserving the right to use that content to prevent abuse, which would require storing it.
Only Google publishes a retention period. The other four do not say how long they keep your messages. We asked their documents and got no answer.
None of the five publishes whether a human ever reads API content. We are not going to tell you they don't, because we don't know.
Turning your speech into text works differently in each of our apps, and the difference is worth knowing before you use it.
On Mac, iPhone and iPad, transcription runs entirely on your device using Apple's on-device speech framework. The audio never leaves your device, and it never reaches us.
On Android, transcription uses your phone's built-in speech recognition service, which on most phones is Google's and may send your audio to Google. The audio never reaches us.
On the web, transcription is performed by your browser's own built-in speech recognition, not by us. In practice that means Chrome sends your audio to Google and Safari sends it to Apple. This is your browser's behaviour rather than ours, and again the audio never reaches our servers.
Xiaomi — voice output. When a reply is read aloud, its text is sent to Xiaomi's text-to-speech model, whichever model you chose for the conversation. The exception is a reply to a message, or to an attached file, on a sensitive topic from the keyword list described under routing: your device reads it with its own voice instead, which is your browser's voice on the web, the system voice on iPhone, iPad and Mac, and the phone's voice on Android. On the web, whether that voice runs on your device depends on your browser. Our server also refuses to send Xiaomi any text that contains a listed word. If neither your message nor its files matched but the reply does, the web, iPhone, iPad and Mac apps send the reply a sentence at a time, so sentences without a listed word may still be read by Xiaomi's voice; the Android app sends the whole reply at once, so one match keeps all of it on the phone. In our Android app, if Xiaomi's voice is unavailable, the phone's own voice reads the reply instead; in the other apps the reply then stays as text.
Sensitive topics. Before routing, the words you type in your message and the text of any files you attach (up to the first 200,000 characters) are checked against a keyword list of politically sensitive topics. Short keywords count only as whole words. Earlier messages and images are not checked. So an image on these topics, or a later message without a listed word in a chat about them, is handled like any other message and can go to any of the five companies, along with the earlier messages it carries. On Automatic, a matching message is answered by Google's Gemini; on Pro and Max, Gemini's thinking model answers first, except for quick questions and voice. If Google cannot answer, the message is not sent to another company and you see an error. If you picked a model from Xiaomi, Moonshot, Z.ai or Alibaba yourself, including through the Deep Thinking, Most Powerful, Creative Writing or Code buttons, a matching message is not answered, and you are asked to pick a different model or use Automatic. A guest's matching message is answered by Google's Gemini. This is automated keyword matching, never human review. A refusal is noted in your account's activity record, without your message, and is not reported to anyone. The helper steps below follow the same rule for a matching message: it is not searched on the web, except by Google in Deep Research on paid plans; its title, memories and summary are written by Google's model or not at all; follow-up suggestions use Google's model or are skipped; a look-up uses Google's model with no web search and no pictures; Compare declines to run; Deep Research declines on Free and for guests, and on paid plans uses only Google's models, which plan the research, search the web with Google Search and write the report; and an image request uses a Google image model, and is refused if you picked Alibaba's. Read-aloud follows the rule too: a reply to a matching message is read by your device's own voice, not Xiaomi's, with the limits described under voice.
Harmful requests. A second automated check reads the words you type in the message you are sending, not earlier messages or attachments, for requests about serious harm. The most dangerous, such as making weapons that can kill many people or sexual content involving children, get a standard refusal and no model writes a reply. Other matches, such as self-harm, making weapons or dangerous drugs, hacking and hurting other people, are answered by Google's Gemini, whichever model you picked, with no web search. A refused message is never sent to a model to write a chat title or to decide whether to search. Deep Research and Compare do not run on a matching message. In look-ups and image creation, the most dangerous matches are refused, and other matches are handled by Google's models, with no web search or pictures for a look-up. In chats and Deep Research, a refused message and the refusal are saved in the chat like any other message; a refused look-up, image request or Compare is not saved. Refusals are noted in your activity record, with the kind of request but not your text. Some helper steps do not use this check, so the text of a matching message can still reach the models they use: memory, summaries, follow-up suggestions in the web app, the code check on Pro and Max, the check that tells an image edit from a new picture, and the search decision for later messages in the same chat.
Other exceptions. Guests are answered by Xiaomi's MiMo, including in voice mode, except that a message matching the sensitive-topic list or the harmful-request check is answered by Google's Gemini; the most dangerous harmful requests get the standard refusal, as for everyone. On Automatic, a demanding question on Free and Plus can go first to Z.ai's model as one of your daily tastes of a higher plan, and in very long conversations on Pro and Max it can go first to Moonshot's Kimi; neither happens to a sensitive-topic message. In voice mode in our iPhone, iPad, Mac and Android apps, replies come from the model Automatic picks (Google's Gemini first, then Alibaba's Qwen, and on Free and Plus Xiaomi's MiMo), even if you picked a different model; voice mode in the web app uses the model you picked. If you pick a model that cannot read images and attach one, that message goes to a model that can, chosen the way Automatic would. On Automatic, if the first model fails, the same message is sent to the next one in line, so a company that did not end up answering may still have received it; for a sensitive-topic message, every model in that line is Google's.
Helper steps. Some steps run on a different model from the one answering you, chosen for speed and cost:
Titles. The start of the first message in each new chat goes to Z.ai's model, or to Xiaomi's if that fails, to write the chat's title.
Memory. When memory is on, every third message you send in a conversation, the last few messages, including the AI's replies, and up to 40 of your saved memories go to Z.ai's model to pick out new facts to remember.
Follow-up suggestions. These are on by default in the web app and our iPhone, iPad and Mac apps, and you can turn them off in Settings. In the web app, your last message and the AI's reply go to Z.ai's model to suggest what to ask next. In the iPhone, iPad and Mac apps they are sent like a normal Automatic message, to whichever model Automatic picks.
Summaries on Pro and Max. When a conversation gets long (past 40% of a model's context size), nears a model's higher-price tier, or moves to a different model after a few messages, older messages go to Z.ai's model to be summarised. The summary is stored with the conversation.
Deciding whether to search. On Automatic, the start of your message and a little of the conversation go to Google's Gemini, with Z.ai's model as a backup, to decide whether a web search would help. If you picked a model yourself, this runs on a small model from that same company.
Web search. The search query goes to Google for Gemini answers, to Xiaomi's search for MiMo answers, and to Z.ai's search service for GLM answers and some other models. On most searches in the app, Z.ai also receives the query and the start of your question to find and choose preview images. A short follow-up question may be turned into a full search query by Xiaomi's model, using your last few messages.
Deep Research. Your question goes to Z.ai to plan the research and run the searches, and to several models to write the report.
Look-up. When you look something up, the text (up to 120 characters) goes to Z.ai's search service, candidate pictures go to Z.ai's model to choose from, and Xiaomi's MiMo writes the summary, whatever model you use for chat.
Code checks on Pro and Max. When you use the Code button and the question has no image and needs no web search, your question and the first answer go to Z.ai's GLM 5.3 to be reviewed. If it finds problems, you see the corrected answer.
Images you create. Your prompt goes to the company whose image model you chose, Google or Alibaba Cloud. In a chat that already has an image you created, a new request goes to Google (except Regenerate in the web app, which uses the model you chose), and when you ask to change that image, the earlier image is sent to Google too. In such a chat, each new image prompt and the previous one also go to Z.ai's model to tell an edit from a new picture.
Compare. Each model you compare receives your message and recent messages from the chat. One more model, usually from a company you did not pick, receives your message and all the answers to write the comparison.
Websites. When a search finds web pages, our server visits up to five of them to fetch preview images; those sites see our server, not you. Your browser or app then loads the preview images directly from those sites, so they see your IP address. If you open a web page in the side panel of the web app, our server first requests that page to check it can be shown there, and then your browser loads it. Our iPhone, iPad, Mac and Android apps load it directly.
In these roles they are not acting as model providers, and they receive this data whether or not you have picked their company's model.
Google and Apple — sign-in. When you sign in, Google or Apple confirms who you are and tells us your email address and name. The web app loads Google's sign-in script when it opens, so Google sees your IP address then.
Stripe — payments. If you subscribe, we send Stripe your email address, your name and our ID for your account. Stripe handles your card.
Cloudflare and DigitalOcean — hosting. Cloudflare handles all traffic to our service, so it processes the contents of requests, including your messages, as they pass through. DigitalOcean runs our server and database.
Google — news headlines. The home screen in our iPhone, iPad, Mac and Android apps loads headlines from Google News. This sends your IP address to Google whenever the home screen loads, after you sign in or continue as a guest, regardless of any model choice.
Open-Meteo, and Apple or your phone's geocoding service — weather. Coordinates and place names, as described under weather and location above.
Apart from the companies named on this page and the websites a search visits, there are no other recipients. We do not sell your data and we do not share it with advertisers or data brokers.
We do not read your conversations. Feedback is the exception: when you send it, we read it, and it can include part of a conversation. Feedback is saved with your account, and we keep it even if you later delete that conversation.
Rating a reply. Each reply has a thumbs up and a thumbs down. Pressing either one saves only your rating, which reply it was about, which model and company produced it, what kind of task it was, your plan, and which app you were using. It does not save a copy of the reply or anything you wrote. Either button also opens a short form asking what was good or what went wrong. If you close it without sending, only the rating is kept. If you press Send, we save a copy of that reply with the same details, the options you pick, and anything you write in the comment box. If you also tick “Also include my message”, we save the message you sent just before that reply. That box is off unless you tick it. To take back a rating, tap the same thumb again. That deletes it, along with any copy we saved.
The feedback form in Settings. We save the type of feedback you pick, what you write, your plan, and a contact email so we can reply. The email starts as your account email, and you can change it or clear it. “Include app details” adds your platform, app version, operating system and its version, and on the web your browser. It never adds your messages, and you can untick it.
What we use it for. We read feedback to find wrong or unhelpful answers, fix problems, and decide which model should handle which kind of question. We use the email address only to reply to that feedback. We do not send feedback to any model provider or share it with anyone else, and we do not use it to train models.
Your conversations stay until you delete them or close your account. Deleting a conversation moves it to Recently Deleted, where you can restore it for 30 days. After that, or straight away if you delete it permanently from Recently Deleted, it is removed from our database along with the images created in it. Memories picked out of a conversation are not removed with it; delete those in Settings. Feedback you sent about a reply in it is not removed either: it is a separate copy you chose to send us, and we keep it. Usage and activity records stay while your account exists. A sign-in lasts 30 days, and then you sign in again. A guest session lasts 7 days; a guest's chat stays on our server after that, and we will delete it if you ask.
Closing your account deletes your account and everything above straight away, including all feedback you have sent and our own records of your payments. To have feedback deleted without closing your account, email us. Closing your account also cancels any paid subscription straight away, with no refund for the rest of the period you have paid for. If Stripe cannot confirm the cancellation, we do not delete your account, and we tell you the subscription is still active. Stripe keeps its own customer and payment records, including the email address, name and account ID we sent it, under its own policy.
You can export your data from Settings at any time. The file includes your account details, personalisation, saved memories, conversations and messages (including chats in Recently Deleted), feedback you have sent, usage, payments and subscriptions, workspaces, public share links, plan grants and free previews, agent runs, sign-in dates, any registered devices, and an activity log. It leaves out login and notification tokens, so the file cannot be used to sign in as you.
We cannot delete anything already sent to a model provider — that is governed by their terms, summarised above.
Depending on where you live, for example under the CCPA in California or the GDPR in the EU and UK, you may have the right to access, correct, export or delete your data, and to complain to a regulator. If you need something the Settings export does not cover, ask us and we will provide it. Email support@starwisp.co. We reply within one month, and we will not treat you differently for asking.
If you are in the EU or UK: the companies named above are outside your region, in the United States, Singapore and China. Your data is sent to them only to provide the service.
You must be 18 or older to use Starnexus, with or without an account. We do not knowingly collect data from anyone under 18. We do not ask for your date of birth and we do not check ages; our Terms set the minimum age. If we learn that someone under 18 is using Starnexus, we will delete their account and its data.
Traffic is encrypted in transit. You sign in through Google or Apple, so we never hold a password for you. If a breach affects your data, we will tell you.
We will post changes here and update the date at the top. Material changes will be notified in the app.