隐私政策

This policy explains how Crelova handles information. It applies to the crelova.ai website and the Crelova Android app. By using the product, you understand this policy.

1. The short version

Crelova is a local-first Android app. We do not require an account, we do not run a cloud service that collects your chats, and we do not ship ads or third-party analytics SDKs. Your API keys are encrypted with Android Keystore and kept on your device. Generation requests are sent by native code directly to the model provider you configure.

2. Data processed by the app

API configuration

You can add the base URL, API key and model name for an OpenAI-compatible or Anthropic endpoint. Keys are encrypted with AES-256-GCM in Android Keystore and stored in the app's private storage. They are never written into the web UI, the WebView, generated apps or a Crelova server. Generated apps can call the native configuration but cannot read the key or change the endpoint.

Projects, chats and source code

Project names, conversations, generated app source, preview settings and local logs live in the app's private directory on your device. They are not automatically uploaded to Crelova. You can delete a project, clear app data or uninstall the app to remove them.

Model requests

When you generate or edit an app, Crelova sends your prompt, the current source and the necessary conversation context to the model provider configured in Settings. That provider's own privacy policy applies. Crelova does not operate a server that proxies or stores these requests; the Pro external-agent feature uses only a local forwarding proxy on your device. Providers may be located outside your country or region.

Runtime permissions

When a preview or exported app uses the camera, microphone, location or notifications, Android asks for permission at the time of use. Denying a permission only disables that capability. Crelova does not provide silent collection, background location, SMS, contacts or call-log capabilities.

Reports and support email

If you use the in-app Report button or email [email protected], we receive your email address, the report category, description and necessary context. We redact sk- keys and Bearer tokens before sending, but please do not send real keys in the first place.

Local logs

The Pro build writes runtime installation, proxy request and agent error details to a local log directory for troubleshooting. Logs may contain conversation fragments but never real API keys or Authorization headers. Logs stay on the device unless you share them.

3. Data processed by the website

crelova.ai is a static website with no accounts and no advertising or analytics cookies. The site uses browser localStorage to remember your language preference (Chinese or English); that value stays in your browser.

The site is delivered through Cloudflare. As an infrastructure provider, Cloudflare may process standard request data such as IP address, User-Agent, request time and URL for delivery, security and abuse prevention. When you download the APK, the host also processes standard file request information. We do not run third-party analytics scripts on the website.

4. How we use information

• Provide app generation, preview, editing and export features;
• Save your API configuration and projects so you can continue later;
• Handle support requests, AI content reports and security issues;
• Keep the website and downloads available and secure;
• Comply with applicable law and platform policies.

We do not sell personal information, and we do not use API keys for advertising or training.

5. Sharing

We share information only:

• At your direction: sending generation requests to the model provider you configure;
• Infrastructure: processing necessary for hosting, CDN delivery, security and downloads;
• Legal requirements: to comply with law, regulation, valid legal process, or to protect users and the public;
• Business changes: if the product is merged, acquired or transferred, information may transfer with the business, and we will require the recipient to honor this policy.

6. Security

API keys are encrypted with Android Keystore, and the app declares allowBackup=false. Exported APKs use their own native settings and Keystore configuration and do not inherit Crelova's keys. No method is perfectly secure; use a trusted device with a lock screen and updates, and rotate API keys periodically.

7. Retention and deletion

Projects, chats, source and keys stay on your device until you delete them in the app, clear app data or uninstall. Uninstalling removes local projects and Keystore keys and cannot be undone. Support emails are kept as long as needed to resolve the issue. The website stores no account data.

8. Children

Crelova is not directed to children under 13, or under the applicable digital consent age in regions such as the EEA. We do not knowingly collect personal information from children. AI features include safety rules and reject requests such as sexual content involving minors. If you believe content harms a minor, report it immediately to [email protected].

9. Your choices and rights

You can delete projects, clear API configuration or uninstall the app. You can email [email protected] to ask about, correct or delete information you provided through support. Depending on your jurisdiction, you may also have rights to access, correct, delete, restrict, object or port your data.

10. International processing

Your model provider and website infrastructure providers may process data in other countries or regions. We take reasonable steps to require compliant handling under applicable data protection law.

11. Changes

We may update this policy. Material changes will update the effective date on this page and, where appropriate, be announced in the app or on the website. Continued use means you accept the updated policy.

12. Contact

Privacy questions, data requests or security reports: [email protected]. For AI content reports, use the in-app Report button or see Safety & reporting.