Privacy Policy
Last updated: 2026-10-10
Who we are
IotMentor ("we", "us") is operated by Mahdi Mansouri, based in Sweden. Contact: contact@iotmentor.dev.
Chat ("Try the mentor")
The message you type, and the conversation shown in your browser, are sent to our backend and forwarded to an AI model via OpenRouter, which routes it to a model provider to generate a reply.
Please don't type sensitive personal details into the chat — health information, ID numbers, financial details, or information about other people. You never need any of that to plan a build.
The chat is stateless on our side: nothing is written to a database automatically. Your browser resends the history each turn, and we keep nothing from it — unless you log in and choose to save it.
Rate limiting and usage counters
Per IP address we count messages in the last minute and total tokens used, to keep free chat fair. These counters live only in server memory, are never linked to what you said, and reset when the server restarts.
Where the chat is available
Our AI provider offers its service only in certain countries. To respect that, our backend reads the country code that Cloudflare adds to each chat request (worked out from your IP address); if the chat isn't offered in your country, it says so instead of answering. The country code is used only for this check and isn't stored.
Bot protection (Cloudflare Turnstile)
A small Cloudflare Turnstile widget blocks automated abuse of the chat, usually verifying you in the background. See Cloudflare's Turnstile Privacy Addendum and privacy policy for how they process it.
Visit statistics (Cloudflare Web Analytics)
We count visits with Cloudflare Web Analytics: which page was viewed, which site you came from, and your country and device type. It sets no cookies, doesn't follow you across other sites, and we only ever see totals — never an individual visitor.
Feedback (thumbs up / down)
Voting is optional. If you rate a reply, we log the vote together with that message and reply in our host's server logs (kept 7 days), so we can read it to improve the product. The vote itself — only up or down, and the page's language — is also filed as a private issue in our own GitHub repository. No message or reply text is sent to GitHub.
The vote is not linked to your account. It is also counted — as up or down, with the language, the date and where the chat began (a guide's button, a starter question, or typed), and nothing else — in the anonymous usage counts described next.
Anonymous usage counts
To see whether the product is useful, and what to improve, we keep simple counts in our database. When a chat begins or continues, a vote is given, or the free limit is reached, we save one row holding only this: the date (no time of day), the display language, where the chat began (a guide's "Ask IotMentor" button, a starter-question button, or typed), that guide's name if it began on one, and a topic label (such as "battery" or "cost") picked automatically from a few fixed words in your first question. A row holds no message text, no IP address, no account or user id, and nothing else that identifies you. Only the topic label is derived from what you wrote, and the words themselves are not kept. Only the owner can see the totals, on a private page.
Accounts and saved projects
Logging in is optional — chat never requires it — and works via a one-time link sent to your email (no password), handled by Supabase.
Creating an account means we store data about you. We say so at the login box itself, not only here. In a Supabase-hosted database (EU region) we store:
| What | Why |
|---|---|
| Your email address | It's how you log back in — there is no password |
| Any project you explicitly save (title and full conversation) | So you can resume it. Nothing saves automatically — only when you press "Save this project" |
| One row per logged-in chat turn: tokens used, and when | To understand real usage before any future pricing decision. No message content — just a number and a timestamp |
You stay in control: view, rename or delete any project under "My projects"; download everything via "Download my data"; or delete your whole account. Deleting the account immediately removes your login and every saved project. The per-turn usage rows are not deleted but are unlinked from you — a token count and a timestamp with no account attached, which can no longer be traced back to you.
Sharing a plan
The "Share plan" button creates a link that contains the conversation itself, compressed. The link is never sent to or stored on our servers (the part after "#" stays in the browser), and the page removes it from the address bar once it's opened. Anyone with the link can read that conversation, so share it only with people you choose.
Language preference
Your display language comes from which page you're on. Our servers keep it only as a label in the anonymous usage counts above and in the page totals under "Visit statistics" — neither can be traced to you.
What we don't do
| No advertising or analytics cookies | — |
| No selling or sharing data for marketing | — |
| No saved chat history unless you log in and explicitly save a project | An anonymous conversation is never written to a database |
Who else processes data on our behalf
| Processor | What for |
|---|---|
| OpenRouter + the model provider(s) it routes to | Chat messages, only when you use the chat |
| Cloudflare | Turnstile, DNS, hosting for this site, and cookie-free visit statistics |
| Render (United States) | Runs our backend and its operational logs |
| Zoho Mail | Hosts our contact inbox |
| Supabase (EU region) | Account email, saved project content, auth tokens — only if you log in — and the anonymous usage counts (for everyone) |
| GitHub (Microsoft, United States) | The vote and page language of any reply you rate, as a private issue — no message text, only if you vote |
Transfers outside the EU/EEA. Supabase holds account data in the EU. Our backend runs on Render in the US, so chat messages pass through there and its operational logs are kept there. OpenRouter, its model providers, and Cloudflare may also process data outside the EEA. These rely on each provider's standard contractual clauses or an equivalent safeguard.
Legal basis for processing (GDPR)
Chat replies: performance of the service you requested. Rate limiting and Turnstile: legitimate interest (keeping a free service usable and abuse-free). Visit statistics: legitimate interest (knowing whether the site is used, and which pages). Feedback votes: your consent, given by clicking a vote button. Your account and saved projects: performance of the service you requested. Checking where the chat is available: legitimate interest (following our AI provider's terms). Anonymous usage counts: legitimate interest (knowing whether the product is used and what to improve), with nothing that identifies you stored.
How long we keep data
| What | How long |
|---|---|
| Anonymous chat messages | Not stored at all |
| Rate-limit and token counters | Server memory only; gone on restart |
| Saved projects | Until you delete the project, or your account |
| Per-turn usage rows | 12 months, then deleted automatically |
| Anonymous usage counts (date, language, where the chat began, guide, topic label) | 12 months, then deleted automatically |
| Feedback votes as GitHub issues | Only the vote and page language, no text; kept while useful |
| Our host's operational logs (Render) | 7 days — Render's own window |
| Visit statistics (Cloudflare Web Analytics) | Totals only, kept by Cloudflare under its own policy |
The 12-month period is enforced by the software itself, daily — not by someone remembering to do it.
Your rights
If you're logged in, most rights are self-service and immediate: access and portability via "Download my data" (a JSON file of your saved projects and a usage summary); correction by renaming a project or saving an updated version; erasure by deleting a project or your whole account.
For anything not self-service, or to object to how we process your data, contact contact@iotmentor.dev. If you're not logged in, note that we don't retain anonymous conversations, so there is nothing stored to look up. You can also complain to Sweden's data protection authority, IMY.
Cookies
We set no advertising, analytics or tracking cookies, so there is no cookie banner. The only cookie involved is Cloudflare Turnstile's __cf_bm, set when the bot check runs; it is strictly necessary for security and exempt from consent.
If you log in, your session is kept in your browser's localStorage, not a cookie — managed by Supabase's auth library, stored on your device, and sent to our backend only as a bearer token to prove you're logged in.
Children
IotMentor is not directed at children under 16, and we don't knowingly collect data from users under that age.
Changes
We'll post material changes here with an updated date. If a change materially affects people with accounts, we'll email registered users before it takes effect.
The canonical policy lives in the private repository's PRIVACY.md.