Legal

Privacy Policy

Политика конфиденциальности

Last updated: May 23, 2026

This Privacy Policy explains how AI Exploits Hub ("we", "our", "the project") handles information when you use the desktop application, the website, and the optional community account service.

Plain summary. The desktop app is fully local and does not transmit your personal data anywhere. The website does not use third-party analytics or advertising. Creating a community account is optional and requires only a username and password.

1. Who we are

AI Exploits Hub is an open-source project distributed under the MIT License. The website is operated as a non-commercial project. There is no central organization collecting user data for sale.

2. Data we do not collect

  • We do not run third-party trackers, analytics scripts, or advertising on the website.
  • The desktop app does not send telemetry, crash reports, or usage data to our servers.
  • You can use 100% of the desktop app without creating an account or providing any personal information.

3. Data we collect when you create a community account

If you choose to register an account on the website to publish BIN posts or sync content, we store:

  • Username — required, public, used as your handle.
  • Password — required, stored as a bcrypt hash. We never see or store your plaintext password.
  • Email — optional. If you provide it, we use it solely for password recovery (when implemented). It is never shared.
  • Posts and tags — content you choose to publish through the dashboard.
  • Account timestamps — when your account was created and last updated.

4. Data automatically logged

Like most web services, our server records standard HTTP request logs that may contain:

  • IP address (used for rate limiting and abuse prevention)
  • User-Agent string
  • Request path and timestamp

These logs are kept for up to 30 days and used only for security, debugging, and rate limiting.

5. Cookies and local storage

The website does not set tracking cookies. Your browser stores the following items in localStorage only when you log in:

  • aeh_token — your JWT session token
  • aeh_user — your basic profile (username, email, id)
  • aeh_lang — your language preference (EN or RU)

You can clear these at any time using your browser's developer tools or the "Sign out" button.

6. Public RSS, API, and feed sources used by the desktop app

When the desktop app fetches content from public sources (HackerNews, arXiv, GitHub, NVD, Hugging Face, OpenAI, Anthropic, etc.), those services may log the request as part of their normal operation. We do not control or have access to those logs. Refer to each provider's privacy policy.

7. Data sharing

We do not sell, rent, or trade your data. We do not share your data with third parties except:

  • When required by law or valid legal process.
  • To prevent fraud, abuse, or security threats.

8. Data retention and deletion

Your account data is kept until you delete it. Deleting a BIN post is a soft-delete. To permanently remove your account and all associated data, contact us through the project repository.

9. Children

The community service is not intended for users under 16. Do not register an account if you are under 16.

10. Security

Passwords are hashed with bcrypt. JWT tokens expire after 7 days. Communication with the server is encrypted via HTTPS. No method is 100% secure — please use a unique password.

11. Your rights

You have the right to access, correct, or delete your account data. Use the dashboard to manage your content, or contact us via the project repository for additional requests.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.

13. Contact

For privacy questions, open an issue on the project's GitHub repository.