Privacy Policy
Private LLM processes your prompts and the model's replies on your device, and the app does not send us your conversations.
Effective 10 October 2026.
Who we are
Numen Technologies Limited makes Private LLM and is the data controller for the processing described here.
Numen Technologies Limited
Work Hub, 77 Camden Street
Dublin D02XE80
Ireland
Registered in Ireland with CRO number 677823.
For any privacy question or request, write to us at [email protected].
What this policy covers
This policy covers the privatellm.app website and the Private LLM app for iPhone, iPad, and Mac.
The app and the website are described separately below.
This policy does not cover other companies. When you download a model, follow a link from one of our articles, or load an embedded post or video, you are dealing with that company under its own privacy policy, and we are not responsible for what it does with your data.
We publish this policy in several languages. The English version is the one that controls. If a translation and the English text disagree, the English text applies.
The Private LLM app
The app does not track you and contacts no tracking domains. There is no account, no sign-up, no analytics SDK, no advertising SDK, and no crash-reporting service anywhere in it.
Your prompts and the model's replies are processed on your device. The app does not send us analytics, usage logs, or the content of your conversations.
- Your conversations: chats are stored in the app's own storage on your device. They do not sync to iCloud and are excluded from iCloud and computer backups. Deleting a conversation in the app deletes it.
- Model downloads: the only network traffic the app generates is downloading the models you choose, from our own download host or from model hosting providers. The requests carry no account, no app-level identifier, and nothing from your conversations. Those hosts see your device's IP address, as with any download, and the hosting and content delivery entry below covers what those providers see.
- Sending us a support message from inside the app: the Help screen can assemble technical information for you, such as device, operating system, and app version details and recent crash information. That block is built on your device. Nothing is sent anywhere until you press the button that opens a pre-filled email to us, or copy the text yourself.
- Ratings: the app uses Apple's standard App Store rating prompt. Ratings and reviews are handled by Apple under its own privacy policy.
- Purchases: Apple handles the payments and refunds. The app holds no payment data.
The app is distributed through the App Store. Apple is the App Store distributor and independent controller for purchases and iCloud, under its own privacy policy, and provides us with reports about app sales and performance.
The privatellm.app website
The website is a different surface from the app.
On the website, we process the information you send us and usage and technical data, as described below.
The contact form
When you contact us through the support form, we collect your contact details, your message, and any device or platform details you provide.
We use your message to respond to you and keep it for as long as needed to deal with your request.
We use a bot-protection provider and other anti-abuse measures to protect the form.
Analytics
We use analytics to understand how the website is used.
It records usage and device information, such as pages viewed (including any advertising click IDs an inbound link carries), referring links and campaign parameters, browser and device type, language, and approximate location derived from your IP address. It also records interactions such as a button click or an App Store link being followed. Where your browser holds the analytics identifier, these events carry it.
The legal basis is our legitimate interest in understanding how our own site performs.
The app does none of this. It carries no analytics at all.
Analytics identifier
We keep a random identifier in your browser so that your visits to this site are counted as one visitor rather than many.
Clearing this site's data removes the identifier, and any identifier you are given after that is a new one.
If you are in the European Union, the European Economic Area, the United Kingdom, or Switzerland, we ask first: nothing is stored until you accept, and a decline is remembered until you close the tab. Elsewhere we rely on our legitimate interest. Where we ask first, an Analytics preferences link in the footer lets you withdraw at any time, which deletes the identifier.
Embedded posts and videos
Some articles and FAQ answers include a post from X or a video from YouTube. These embeds load only after you choose to load them. When they load, your browser fetches the content from X or YouTube directly, and those services can see your address and set their own cookies, under their own privacy policies rather than this one.
Your choice is remembered in your browser for each service, so later embeds from that service load without asking again. Clearing your browser storage withdraws the choice. The legal basis for loading an embed is your consent, and choosing to load it is how you give it.
Error reports
When something on the website breaks, we collect technical error information so we can fix it.
We limit error reports to the information we need to diagnose problems. The legal basis is our legitimate interest in keeping the site working.
We also collect technical performance data to keep the site fast and working, on the same legal basis and with the same handling as the error reports.
We do not receive crash reports or error reports from the app itself. If you want us to see a crash, you can send it to us from the Help screen.
Cookies and browser storage
The table below describes the cookies and similar technologies we use.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Language preference | First-party cookie | Remembers the language you are reading the site in, so later visits land in the same one. Strictly necessary for delivering the site in that language. | Until you close the browser |
| Theme preference | First-party local storage | Remembers whether you chose the light or the dark theme. | Until you clear it |
| Announcement dismissal | First-party local storage | Remembers that you closed the announcement at the top of the page, so it stays closed. | Until you clear it |
| Analytics identifier | First-party local storage | A random value issued by our servers so that your visits are counted as one visitor. Not strictly necessary. Where the law requires, we ask before storing it; elsewhere we rely on our legitimate interest. | Where we ask first, until you withdraw through the Analytics preferences link or clear your browser's site data. Elsewhere there is no set end: clearing your site data removes it |
| Analytics choice | First-party session storage | Remembers that you declined the analytics identifier. | Until you close the tab |
| Campaign label | First-party session storage | When you arrive through a link that names one of our marketing campaigns, remembers that campaign name so that a download you start from the App Store during this visit is counted towards it. | Until you close the tab |
| Embed consent - X | First-party local storage | Remembers your choice to load embedded posts from X. | Until you clear it |
| Embed consent - YouTube | First-party local storage | Remembers your choice to load embedded videos from YouTube. | Until you clear it |
| Cloudflare Turnstile | Third-party security challenge | Tells a person from a bot on the contact form. | Per challenge, set by Cloudflare |
| cf_clearance | Cookie, set by Cloudflare | Set only when Cloudflare needs to check suspicious traffic, so that a visitor who passes the check is not asked again. | Short-lived, set by Cloudflare |
Where the law requires consent, we ask first.
Why we process data, and on what legal basis
The table below sets out the purposes and legal bases for our processing.
| What we do | Data involved | Legal basis (GDPR) |
|---|---|---|
| Answer a message you sent us | Name, email address, question type, message, and for a technical report the platform and device model | Article 6(1)(b) and Article 6(1)(f), answering your request |
| Block bots and keep the contact form available | Connection and device data used for security | Article 6(1)(f), our legitimate interest in a form that survives abuse |
| Serve a model file you asked the app to download | The file requested and the connection data any download carries | Article 6(1)(b), taking steps at your request |
| Measure how the site is used | First-party page and event data, carrying the analytics identifier where your browser holds one | Article 6(1)(f), our legitimate interest in improving our own site |
| Count return visits to this site | A random analytics identifier held in your browser | Article 6(1)(a), your consent, where we ask first; Article 6(1)(f), our legitimate interest, elsewhere |
| Load an embedded post or video after you click it | The request your browser makes to X or to YouTube, including your address | Article 6(1)(a), your consent, given by the click |
| Diagnose errors | Technical error and performance data | Article 6(1)(f), our legitimate interest in a working service |
| Meet legal obligations, including accounting and tax | Records Apple and our accountants require | Article 6(1)(c), legal obligation |
Who else is involved
These providers process data on our behalf:
- Our hosting provider - runs our servers.
- Our content delivery and bot-protection provider - content delivery, bot protection, and backup storage.
- Our email delivery provider - delivery of messages sent through the contact form.
Apple, as the App Store distributor and independent controller for purchases and iCloud, and the model hosting providers the app downloads from, and the embedded-content services you choose to load, act under their own privacy policies.
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We disclose data to a public authority only where the law requires it.
How long we keep things
- Model downloads: connection data is kept by our hosting and content delivery providers for as long as needed for security and operations.
- Support messages: kept in our mailbox for as long as we need them to deal with your request.
- Website analytics: event records, kept for as long as we need them to understand how the site is used. The IP address behind a visit is not stored.
- Error reports and performance measurements: kept while they are still useful for fixing the fault or keeping the site fast.
Backups are kept for a limited period and then overwritten.
International transfers
We are an Irish company. Some of the providers listed above are established in the United States and may process data there or in other countries.
The safeguard for each transfer depends on that provider's arrangement: either an adequacy decision or the European Commission's standard contractual clauses, as required by Chapter V of the GDPR. Contact us if you need the current details for a particular provider.
A model download comes from wherever the host serving it is. It is a file transfer, and the file is the same one for everybody who asks for it.
Security
We use technical and organizational measures to protect personal data.
Children
Private LLM is a general-audience tool for adults, and some of the models it can run are uncensored. It is not directed at children, and we do not knowingly collect personal data from children. If you think a child has sent us personal data through the contact form, write to [email protected] and we will delete it.
Changes to this policy
We update this policy when what we do changes. The effective date at the top tells you which version you are reading.
Your rights
Which rights you have depends on where you live. To exercise any of them, write to [email protected]. We respond within the time required by law, free of charge except where the law permits a fee, and we may ask for information to verify your identity.
If we cannot find data that identifies you, we will tell you so. You can help by sending us the analytics identifier stored in your browser, if it holds one.
European Union and European Economic Area (GDPR)
You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing that already happened.
Where we rely on legitimate interests, you can object on grounds relating to your particular situation, and we will stop unless we have compelling grounds that override yours.
Our lead supervisory authority is the Irish Data Protection Commission. You can complain to it, or to the authority in the country where you live. The list of national authorities is published by the European Data Protection Board.
United Kingdom (UK GDPR and Data Protection Act 2018)
You have the same set of rights described above. You can complain to the Information Commissioner's Office at ico.org.uk.
Elsewhere
Depending on where you live, local law may give you additional rights. Write to [email protected] and we will deal with your request.
Contact us
Privacy questions, requests, and complaints all go to the same address: [email protected]
The terms that govern your use of this site are in our Terms of Use.