This is a translation of the English policy. If the two differ, the English version prevails.
Geode (“the app”) runs a large AI language model entirely on your Android device. It is a personal project of the developer of tifu.xyz. This policy describes what data the app and its website handle.
The model’s files are stored on your device and the app computes every answer on the device’s own processor, graphics chip and, where the phone has one Geode can use, its NPU (AI accelerator). Text you type, photos you attach and the answers the model writes stay in the app’s private storage. The developer has no server that receives them.
Every chat is handled by a built-in agent: the model can search the web, open web pages, and run commands in a small Linux environment that belongs to the app and to that chat (a sandbox inside the app’s private storage; it cannot read your other apps or your files unless you hand a file to it).
The app lists and downloads model files from Hugging Face (huggingface.co): it reads the list of recommended models when you open the Models screen, and downloads a model only when you start that yourself. Like any web request, this reveals your IP address and standard request data to Hugging Face; their handling is governed by the Hugging Face Privacy Policy. No conversation content, image or personal information is included in these requests.
When answering a question needs current information, the agent searches the web and opens pages directly from your phone. The search query — words the model writes from your question — goes to public search engines (DuckDuckGo, Brave, Mojeek and Wikipedia; for technical questions also GitHub, Stack Exchange, arXiv or PyPI), and the pages it opens are downloaded from their websites. These services see your IP address, the query or the page address and standard request data, under their own privacy policies; the developer receives none of it. Nothing else from your conversation is sent. Recent search results are kept on your device for a short time so the same search is not repeated.
Commands the agent runs in its Linux environment can use the internet when the task needs it (for example to install a software package or download a file you asked for). If you add an MCP server (an external tool service) in the app, the agent sends that server the requests its tools need; what that server does with them is governed by its operator. The app adds no MCP server by itself.
If you turn on the local server on the Server screen, other devices on your local network (for example your laptop) can use the model through an OpenAI- and Anthropic-compatible API or a web chat in the browser, protected by a key or password. Their requests and the answers travel only within your network, between your devices; nothing goes to us. A notification shows the server while it is on and turns it off.
Every answer has a Report action. If you use it, the app sends to our server (geode.tifu.xyz) the reason you choose, the note you write, the names of the model and the app version, the app’s language and — only if you leave the box ticked — the reported answer and the question it answered. A report contains nothing that identifies you or your device; we use reports only to find and reduce harmful answers, and keep them no longer than needed for that (at most 12 months). If there is no connection, the report waits on your device and is sent the next time the app starts.
The Benchmark screen runs tests of your phone when you tap Run all tests. If the box “Data will be collected to improve the app on your device” is ticked (it is by default, and you can untick it before running), the results are sent to our server as a device report. It contains the phone’s manufacturer and model, its processor, graphics chip and NPU with their drivers’ versions and features, the Android version and firmware build, the amount of memory and free storage, whether power saving is on, the phone’s temperature status and battery level, the app’s settings that affect speed, the app version, the results of the benchmarks and of the graphics-chip and NPU checks, the phone’s and the app’s languages, and a random report number shown to you on the screen. With it our server stores the IP address it came from (the same phone model differs between regions; it also helps us stop abuse). It contains no account, no phone number or device identifier, and none of your chats or files. We use device reports only to make the app work and run faster on more phones, and keep them no longer than needed for that (at most 12 months). To have a report deleted, give its number on the deletion page.
The following is kept only on your device, in the app’s private storage, and is removed when you uninstall the app:
| Data | Purpose |
|---|---|
| Conversations and their history (including copies of the images you attach) | Show and continue your chats; you can delete any chat in the app |
| Saved conversation states and an image analysis cache | Continue a long chat at once instead of reading it again, and avoid re-reading an attached image |
| Each chat’s agent folder (the files the agent creates or you give it) and the agent’s Linux environment | Let the agent work on your task; deleted with the chat |
| Recent web search results | Avoid repeating the same search |
| Downloaded or imported model files, and a usage profile of which model parts are used most | Run the model and load it faster next time |
| Settings (language, theme, memory limit, generation settings, skills and MCP servers you added, the local server’s key and password) and the memory-test result | Remember your preferences and how much memory the app may use |
Files you import (for example a model folder) are read only from the location you pick in the system file picker.
The app does not access your location, contacts, microphone or call log. Photos are attached only through the system photo picker, one at a time, by you.
geode.tifu.xyz does not ask for your email address: you join the test through the testers’ Google Group and Google Play, which are governed by Google’s Privacy Policy. The Google account emails sent through the site’s earlier sign-up form (with the page language and the time) are used only to run the closed test and, rarely, to contact you about it; they are not sold or shared with anyone and are deleted after the beta ends, or earlier on request. If you choose a language on the site, your browser remembers the choice in its local storage. The site is served through Cloudflare, which processes your IP address to protect the site from abuse and counts page visits with Cloudflare Web Analytics (no cookies, no cross-site tracking); geode.tifu.xyz itself keeps no access logs.
Geode is not directed at children under 13. We do not knowingly collect personal information from children.
Material changes will be posted at the same URL with an updated “Last updated” date.
To have your data deleted, use the deletion page. For questions about this policy, contact [email protected].