Privacy policy

Who we are and what this notice covers

Elyxir, Inc. operates Elyxir and Alvin. This notice covers elyxir.ai, tryalvin.com, and the Elyxir and Alvin services that link to it. A separate agreement or feature-specific notice may explain additional processing. Where we process an organization’s content on its instructions, that organization may be responsible for responding to requests about that content.

This notice describes our practices; reading or using a website is not consent to optional analytics, advertising, sensitive-data processing, or model training. When consent is required, we request it separately. Your statutory rights are not waived by this notice.

Information collected and why

The information involved depends on the service you use. Visiting a marketing page does not itself submit a prompt to an AI model. Please provide only information needed for your request and avoid including sensitive information in general contact forms.

• Contact and support: names, email addresses, correspondence, and any details you choose to provide, used to answer questions, investigate problems, and maintain a record of the conversation. Contact messages are not newsletter subscriptions.
• Newsletter: email address, subscription status, confirmation and unsubscribe records, and evidence of the signup wording, used to deliver requested updates and honor opt-outs. Security checks may also process IP addresses and request metadata.
• Accounts and transactions: account identifiers, sign-in details, organization information, plan and transaction records, and billing information used for access, service delivery, and accounting. Payment details are handled through the payment flow and its processor; do not send card details through a contact form.
• Product content: prompts, responses, documents, generated media, project content, and information from connections you authorize, processed to provide the features you use. Content may include personal information about you or other people. Only submit information you are entitled to share.
• Technical and security information: IP addresses, browser and request metadata, logs, and anti-abuse signals used to deliver pages, diagnose service failures, and prevent fraud or abuse.
• Optional marketing-site analytics: when you allow it, PostHog receives page paths and a temporary random identifier for page-visit measurement. The website integration removes query strings, fragments, referrers, and form content from page events. It does not enable session recording or identify you by your account. Network services necessarily receive connection metadata when serving requests.

Mobile usage and diagnostics

Mobile versions with controlled analytics send a fixed screen category, operating-system platform, and native-app or embedded-canvas indicator to our authenticated first-party endpoint. These events are linked to your account identifier so we can measure product usage. The event payload does not include screen text, prompts, files, raw navigation URLs, or advertising identifiers.

Operational request and performance records can also be linked to your account. These records help us operate and troubleshoot the service. This mobile screen-analytics flow does not forward events to advertising networks or the general website analytics SDKs. Website analytics choices and third-party AI processing are separate from this flow.

Sources of information

We receive information from you, your browser or device, people collaborating with you, and services you choose to connect. Sign-in providers, payment services, and infrastructure or security providers may return the information needed to complete authentication, a transaction, or a security check.

Recipients and disclosures

Information is disclosed as needed for the functions described in this notice. The providers involved depend on the route, account, model, and feature you use; a logo on the website is not a statement that we send your information to that company.

Categories of recipients include hosting and storage providers; security and anti-abuse providers such as Cloudflare when enabled; email and support providers; payment processors such as Stripe; authentication providers you choose; PostHog for optional website analytics; AI inference, embedding, and media providers used to fulfill your requests; and external tools you authorize. Project collaborators or people with access to a shared link may see the content you share.

We may disclose information when required by law, to investigate abuse or protect legal rights, or in connection with a business transaction subject to applicable protections. We remain responsible for obligations that apply to us when using service providers. You can request information about recipients of your data, including specific third parties where applicable law provides that right.

AI models, agents, and connected services

Our AI gateway routes requests to OpenAI directly, to OpenRouter, or to models hosted on our own infrastructure. OpenRouter forwards requests to model hosting providers. Automatic routing and fallback behavior can change the model or hosting provider, so a model's developer name does not necessarily identify every company processing a request.

In mobile versions with the AI data-sharing control, we ask for permission before enabling AI features on that device, including paired-watch requests. You can review or withdraw the permission in Settings under AI data sharing. Account settings and deletion remain accessible without granting it. Withdrawal stops new requests from that device; it does not undo information already sent, cancel processing already underway, or change permissions on your other devices.

Using AI features can transmit prompts, relevant conversation context, selected files, and tool results to the providers necessary to carry out your request. Agent actions may send information to connected services or modify resources within the permissions you grant. Review the selected model, requested permissions, and any approval before authorizing an action.

Provider retention and processing terms can vary by model, contract, and feature. Do not assume that every model has zero retention or identical training restrictions. General website cookie consent does not authorize training on your content. Where an optional use needs separate consent, that consent must be requested in the relevant product flow.

Disconnecting a service stops access through that connection but does not automatically delete information already transmitted to it. A privacy or deletion request may need to cover the relevant project, account, provider, or organization.

Retention and deletion

We retain information for the purpose for which it was collected, considering whether an account or project is active, whether a support request remains unresolved, applicable accounting or legal requirements, security needs, and any legal hold. We do not use a single retention period for every category of information.

Contact records support correspondence and follow-up; subscription and suppression records allow us to deliver requested emails and respect unsubscribe requests; account and project information supports the service; transaction records support accounting and disputes; and technical records support security and operations. You can request deletion of information that is no longer needed, subject to applicable exceptions.

A deletion request may involve active systems, service providers, and backups. If information must be retained or deletion is delayed under an applicable exception, we explain the basis in our response. The marketing sites remember cookie choices for up to one year; theme settings remain until changed or cleared; the hero’s first-visit animation marker lasts for the tab session.

U.S. state privacy rights

This section applies to U.S. residents, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Rights depend on your state, the activity, statutory coverage, and exceptions. Residents of other states may also contact us with privacy requests.

Depending on applicable law, you may request confirmation of processing, access or a portable copy, correction, deletion, information about recipients, and an opt-out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling with legal or similarly significant effects. California residents may also have rights to know the categories, sources, purposes, and disclosures of information, and to limit certain uses of sensitive personal information. Minnesota residents may have additional rights to question and understand covered profiling decisions.

We do not configure optional website analytics for advertising, and it remains off without permission. You can immediately stop optional website analytics through Cookie settings or Your privacy choices. You can also submit a do-not-sell-or-share, targeted-advertising, profiling, or sensitive-information request through the contact methods below. These browser controls apply to this website origin; account-wide requests and requests covering other devices should also be sent to us.

We honor Global Privacy Control on these marketing websites by blocking optional analytics even if a previous browser choice allowed it. We also treat the older Do Not Track signal as a request to block optional website analytics. A browser opt-out does not require you to create an account or submit identification.

Requests, verification, and appeals

Email [email protected] with the subject “Privacy request,” or use the contact form linked from this site. Identify the right you want to exercise and the email or account involved. Your state helps us apply the correct rules. Please do not include a password, full payment number, or identity document in an initial request.

For access, correction, or deletion, we may need proportionate information to verify that a request concerns you. Authorized agents may submit requests; we may ask for proof of authority and any verification permitted by law. We use verification information for handling the request and related legal obligations.

We respond within the applicable legal deadline. Our operational target is a substantive response within 30 days. For covered California requests to know, correct, or delete, we acknowledge receipt within 10 business days and generally respond within 45 calendar days; a permitted extension requires notice and an explanation. Applicable opt-out requests are handled as soon as feasible, within the relevant statutory deadline. We will not discriminate against you for exercising a protected right.

If we decline your request, we explain why. You may appeal by emailing [email protected] with “Privacy appeal” and the original request reference. We review the appeal within the deadline applicable to your state and explain the outcome. You may also complain to your state attorney general or privacy regulator; our response to a denied appeal will identify the appropriate complaint channel.

Sensitive information and children

Do not submit Social Security numbers, full financial account credentials, precise location, biometric identifiers, medical records, or similarly sensitive information unless a feature expressly supports that use and provides the required protections and notices. Sensitive information may require separate consent or be subject to restrictions that general consent cannot override.

Elyxir and Alvin services are intended for adults 18 and older. They are not intended for children under 13. If you believe a child provided personal information, contact [email protected] so we can investigate and take appropriate action, including deletion where required. An age statement alone does not replace protections required by applicable children’s privacy laws.

Security and international processing

We use safeguards appropriate to the information and service, but no online service can promise absolute security. Report a suspected privacy or security issue to [email protected] without including passwords or secrets.

Elyxir is based in the United States, and information may be processed in countries where our providers operate. Applicable international privacy and transfer requirements may impose additional rights and safeguards. Contact us for information relevant to your service and location; this notice does not establish a transfer mechanism or replace a data-processing agreement.

Changes and contact

We update this notice as our services and legal obligations change. The date above identifies this version. Where required, material changes receive additional notice or a new consent request before the new processing begins. Continued browsing does not override an existing opt-out or provide new consent.

Questions and requests can be sent to [email protected] or the mailing address below. Cookie settings and Your privacy choices remain available in the footer.