Privacy

Last updated 2 November 2026

The short version: the tools on this site run in your browser and our iPhone apps run on your phone, so your files and recordings stay with you. We need no account from you, set no cookies, load no ad trackers or third-party pixels, and never sell data. We collect an aggregate count of visits, with our own counter, and whatever you choose to send us through the contact form.

Tools in your browser

The tools (frame grabber, image-to-prompt, safe zones, caption checker, prompt builders and the rest) process files with your browser's own code. A file you drop in is read on your device and is never uploaded; closing the tab discards it. Site search runs locally too, over an index downloaded with the page.

Exceptions, each starting with a click

The contact form

The form on /contact/, /studio/ and /about/ is the one place on the site that sends something about you, and only when you press send. It sends what you typed (e-mail, name if given, topic, message), the page you sent it from and its language. Cloudflare adds the country your connection comes from. We store that in a Cloudflare D1 database and e-mail it to our own inbox through Cloudflare Email Routing, to answer you. Nobody else gets it (the one exception, the US private-AI pages, is below), and we do not add you to a mailing list. Messages are deleted after a year; to have yours deleted sooner, write to [email protected].

Against spam: when you start filling the form, the page loads Cloudflare Turnstile from challenges.cloudflare.com, which checks the browser for signs of a bot (Cloudflare's own Turnstile privacy terms apply; it sets no advertising cookies). Your IP address is used to limit how many messages one network can send: at the edge for a minute, and for the plain-HTML form and for AI agents as a salted hash that changes every day and is deleted after two days. The IP address itself is not stored.

The pilot form on the private-AI pages (/private-ai/ in English, /tr/yerel-yapay-zeka/ in Turkish) also sends your company name and team size if you give them, whether you ticked "pilot client", and the campaign tags of the link you arrived with (utm_*, gclid, fbclid), so we know which ad brought you. Until you close the tab the page keeps those tags in the tab's sessionStorage, and sends them only with the form. A request from the English pages is answered by SuperDuperAI, Corp. and is also e-mailed to the person who installs for it in the United States; a request from the Turkish pages is answered by SUPER DUPER AI TEKNOLOJİ LİMİTED ŞİRKETİ and goes nowhere else.

An AI assistant may send this form for you (the send_message tool or /api/lead, described on /contact.md); the same rules and the same one-year deletion apply, and we see which assistant sent it.

Our AI phone assistant (US private-AI pages)

If you call the number on the US private-AI pages, an AI assistant answers. The call runs on a cloud voice service, Cartesia, which records and transcribes it and keeps both until we delete them; the assistant says so at the start of every call. Please do not share client or patient details on the call. If you give your e-mail and what you need, the assistant sends it to us through the same lead form described above, and Rustam answers by e-mail. To have a call erased, write to [email protected]. Opening the page contacts no voice service; only placing the call does.

Visit counts

Every page loads one small script from analytics.superduperai.co, our own self-hosted counter (superduper-analytics). It records that a page was viewed or used (for example "prompt copied", "tool used"), the path without the query string (only the campaign tags utm_source, utm_medium and utm_campaign are kept from it, when the link has them), the referring site's host name, the country as reported by the network edge, and whether the visit looks like a browser or a bot. There is no cookie, no localStorage, nothing stored in your browser. To count unique visitors per day the server derives an anonymous id from the IP address, the browser's user agent and the date; it changes at midnight UTC and is never sent to your browser. We look at totals, not at people. No Google Analytics, no advertising or social-media pixels.

Our iPhone apps

Where an app counts usage, it uses the same counter with a random id created on first launch, kept only in the app and deleted with it: not the advertising identifier, not tied to any account.

Hosting

The site is served by Cloudflare, which, like any host, processes the requests your browser makes (IP address, requested URL) to deliver the pages and protect them from attacks.

Who is responsible, and how to reach us

SuperDuperAI, Corp., a Delaware public benefit corporation, 1207 Delaware Ave #4241, Wilmington, DE 19806, USA; and, for Türkiye, SUPER DUPER AI TEKNOLOJİ LİMİTED ŞİRKETİ (details on about). Questions, or a request about data you think we hold: [email protected]. Since we keep no accounts, the only per-person records are contact-form messages, which we export or delete on request; beyond those there is usually nothing to export, and we will say so plainly.