TokenMax — Privacy Policy

Effective date: May 6, 2026

Version: 1.1

TokenMax is built around a simple promise: your conversations stay on your device. This Privacy Policy explains exactly what that means, what data does and does not leave your phone, and what choices you have.

1. What we collect from you

Nothing.

Vellora AI does not operate a backend, does not host an account system, and does not receive any data about you, your conversations, your device, or how you use TokenMax. There is no telemetry SDK, no crash reporter, and no analytics product compiled into TokenMax.

You do not need to create an account, sign in, or provide any personal information to use TokenMax.

2. What stays on your device

Everything you do in TokenMax is stored locally:

Conversations (your prompts, model replies, attachments, and any tool results) are saved in your device's Application Support directory using SwiftData.
Models you download are stored as .gguf files inside the same Application Support directory.
Knowledge base sources you add (PDFs, text, DOCX, etc.) and the embeddings the app computes from them are stored alongside the conversations.
Settings (your sampling parameters, persona choices, voice, search provider, etc.) are stored as a JSON file in the same directory. Provider API keys are stored in the iOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, so they do not leak to iCloud backups.

If you uninstall TokenMax or wipe its data from iOS Settings, all of this data is permanently deleted. Vellora AI cannot recover it.

3. When TokenMax does talk to the network

TokenMax hits the network only in three situations, all of which you control:

Use	Triggered by	Hosts	What leaves the device
Model download	You tap Download in the Model Store.	The catalog publisher's host, currently Hugging Face (`huggingface.co`).	A standard `GET` for the requested file. No account, no telemetry.
Web search	The model decides to call the `web_search` tool, after you've asked a current-events question.	DuckDuckGo (`html.duckduckgo.com`) by default. If you configure Brave Search or a SearXNG instance under Settings → Advanced search, that endpoint instead.	Your search query, your IP address, and a user-agent string identifying TokenMax.
Web page fetch	Same as web search — happens during the same tool call to read the top results.	The result URLs themselves.	Your IP address and a user-agent string. The request itself reveals which page you opened. We use a non-persistent WebKit data store so no cookies, cache, or local storage survives the call.

You can disable any of these in Settings:

Settings → Data Controls → Allow web search disables both the web search and the page fetches.
Settings → Privacy & Data → Sealed mode disables every outbound network call, including model downloads.

4. Apple system services

TokenMax uses standard Apple frameworks for speech-to-text (Apple Speech), text-to-speech (AVSpeechSynthesizer), the iOS Keychain, and Metal-accelerated inference. These services run entirely on your device and are governed by Apple's privacy practices, not by Vellora AI. We do not transmit microphone audio anywhere.

5. Third-party model output

The models you run are open-weight third-party models (e.g. Falcon, Llama, Qwen, Moondream). Their output is generated locally on your device by the model file you downloaded. Once a model is on your device, generating a response does not require a network connection.

If you enable the web search tool, the model may quote portions of the third-party web pages it reads. Those pages remain governed by the privacy practices of the sites that host them.

6. Children

TokenMax does not collect any personal information, so it does not collect personal information from children under the age of 13 (or the equivalent minimum age in your jurisdiction). TokenMax's content can include adult themes generated by language models; if you are a parent or guardian of a minor user, you are responsible for supervising their use of TokenMax.

7. International users

TokenMax runs locally on your device. We do not transfer your data internationally because we do not collect or hold your data. If you live in a jurisdiction with data-protection laws that grant you rights to access, correct, delete, or port your personal data, those rights apply only to data that an entity holds about you. Because Vellora AI does not hold any data about you, there is nothing for us to disclose, correct, port, or erase.

8. Changes to this policy

We may update this Privacy Policy if TokenMax ever changes what it does with the network. We will note the new effective date and version, and the in-app first-launch acceptance flow will re-prompt you to acknowledge the new version before you continue using TokenMax.

9. Contact

Privacy questions: privacy@vellora.ai