Security

This page describes how ChaiComet protects the account, the credits, and the requests you send. It is a description of the controls in the product. It is not a certification.

What we collect is in the Privacy policy. The rules for using ChaiComet are in the Terms of Service.

You sign in with an email and a password. Passwords are handled by Supabase Auth. ChaiComet's database does not store the password. The website keeps you signed in with a session cookie.

The Mac or Windows app does not keep your password. After you sign in on the site, the app receives a device token. That token is a random secret, returned once.

We store only a SHA-256 hash of the token, plus a short device label, the last time it was used, and whether it has been revoked. A missing or revoked token cannot spend credits.

The site is served over HTTPS. A question, a screenshot, and microphone audio are sent to OpenAI over HTTPS so the answer or the transcript can be produced.

The keys for OpenAI and Razorpay stay on the server. They are not included in the website or in the desktop app.

The database limits each signed-in person to their own profile, their own credit history, and their own device records. Other customers cannot read those rows.

Credit changes run through server functions. A question cannot take the balance below zero. If the answer fails before you receive it, the credits for that request are returned.

Card numbers are handled by Razorpay. ChaiComet does not store them.

Credits are added only after the payment signature checks out. A Razorpay webhook is accepted only when its signature checks out. A failed check does not change the account.

You choose when to capture and when to listen.

Closing the panel does not delete the app. It remains a process on the computer. On a Mac, capturing the screen requires the Screen Recording permission. The microphone is used only when listening is on.

ChaiComet does not keep a library of your screenshots, questions, answers, or meeting audio on the account. The credit history records that credits moved, and why. It does not contain the screen.

ChaiComet does not sell account data, screenshots, audio, or transcripts.

If you find a vulnerability, write to contact@chaicomet.com. Describe what you found and how to see it. Give ChaiComet a reasonable chance to fix it before you publish it.

Do not access another person's account, and do not disrupt the service, while you report it.

Security reports go to contact@chaicomet.com.