Uxen
How we protect your messages
Uxen reads something very personal. So no big words here: what is protected and how, who can open your data and when — and where our protection ends.
What is encrypted
- The connection. Everything between you and Uxen is encrypted (TLS).
- Conversations with the assistant and what Uxen understood from your messages — memory, people, tasks, events — are stored encrypted. Each person has their own key (AES-256-GCM), and the master key is kept apart from the database.
- Sign-ins to your accounts — Telegram sessions, Google access, your mail and Nomotex passwords, the student account session — are stored encrypted.
- Backups leave the server only encrypted; their keys are not on the server.
What the server protects, not your own key
- WhatsApp sign-ins are kept by its bridge on the server.
- Copies of messages used for search are on the server’s disk.
- WhatsApp Business messages and support requests.
They are protected by access to the server, not by your own key.
Where the protection ends
To search your messages and answer, the server decrypts data. So this isn’t end-to-end encryption, and we don’t call it that.
Who can open your data, and when
To fix failures and answer your requests, authorized people at Uxen may look at the data related to a specific problem. Beyond that, data is opened only to investigate an attack or abuse, or under a binding order from an authority — as section 11 of the policy describes. Only those who need access for this work have it, and every access is recorded in our internal log. Gmail, Calendar and Contacts data is opened by people at Uxen only with your permission, to fix a problem you reported, for security, or when the law requires it.
Who receives data
- OpenAI (USA) — to search by meaning and to answer. Under its API terms, OpenAI doesn’t train on this data and keeps logs for up to 30 days to prevent abuse.
- Google and Apple — sign-in and the connections you chose.
- Resend — emails from Uxen: sign-in codes and notifications.
- YooKassa — card and SBP payments only; your messages never go there.
- Telegram — if you connected it as a source, use the Uxen bot, or pay with Telegram Stars.
- Aeza — hosting: the server is in the Netherlands.
- Anthropic (USA) — the team’s AI assistant when investigating failures; it sees only what relates to a specific problem.
Details are in the privacy policy.
Your sign-ins
- A sign-in from a new device notifies your other devices and, if your account has an email, sends an email with a “Wasn’t you?” link that ends that sign-in.
- For security, a sign-in less than a day old can’t end your other sign-ins (Telegram does the same).
- “Sign out everywhere and close access” — one tap: other devices are signed out, assistants lose access.
Cookies and browser storage
- The site has one cookie, and it keeps you signed in: a long-lived sign-in key for 90 days. Your browser sends it only to our server and only for signing in; the page’s own code can’t see it. Signing out erases it.
- Browser storage holds only your settings: theme, color, a collapsed sidebar, whether notifications are on and which events they have already shown. It also keeps a “signed in” marker, your account number and how you sign in — for the screen, none of it gives access to your account — and a copy of the site’s pages so it opens faster.
- There are no analytics, advertising or third-party cookies. That is why the site doesn’t ask for cookie consent: everything listed here is needed for the site itself to work.
Deletion
Erased data leaves the working system immediately and backups within 3 weeks. A deleted account is removed after 7 days, and the person’s key is destroyed with it: what it encrypted — assistant conversations, memory, sign-ins — becomes unreadable in backups within two days, and everything else leaves the backups as they rotate, within 3 weeks. You can export your data any time — Security → Download my data.
If Uxen shuts down, we’ll tell you in advance, let you export your data, and delete it. If Uxen passes to another company, we’ll tell you in advance, and your data will move to it only with your consent — before the transfer you can export and delete it.
Found a vulnerability?
Write to support@rrrfirstchat.com — we’ll answer. Contacts for researchers are in security.txt.