Privacy Policy

Last updated: July 21, 2026

1. Overview

KillaAssistant (“the Service”) is a multi-user AI assistant that operates through Telegram. Users connect their own Google account, supply their own LLM provider API keys, and chat with the bot to delegate calendar and file management tasks.

2. Account information

When you create an account, we store your email address and a hashed password (managed by Supabase Auth). A profile row is created in our database with your user ID and email. No password is ever stored in plaintext.

3. Google account data

When you connect your Google account, KillaAssistant requests OAuth 2.0 authorization to access Google Calendar and Google Drive. Depending on your account tier, the requested scopes are either:

  • Light scopes: calendar.events and drive.file — limited to events and files created or opened by the assistant.
  • Restricted scopes: calendar and drive — full read/write access to your calendars and files. Granted only to accounts explicitly marked as VIP by the project owner.

Google OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and stored in our database. We never share these tokens with third parties.

4. LLM provider API keys

You supply your own NVIDIA NIM and Groq API keys. These are encrypted with AES-256-GCM at rest and are used solely to make inference requests on your behalf. We never read, log, or reuse your API keys for any other purpose.

5. Messages and content

The text, voice, photos, and documents you send to the bot are processed to fulfill your requests: transcribed (via Groq), passed to the LLM (via NVIDIA), and used to call the appropriate Google APIs on your behalf. Metadata about each interaction (tool name, success status, timestamp) is logged for debugging and auditing. Message contents are not retained beyond the active processing window.

6. Data retention and deletion

You can disconnect your Google account at any time from the Connections panel; this deletes your stored OAuth tokens immediately. You can delete your KillaAssistant account by contacting lucasromero@uninorte.edu.co; deletion cascades to all associated records (profile, bot configuration, API keys, Google credentials, messaging connections, and activity logs) within 30 days.

7. Third-party services

The Service integrates with the following third parties, each governed by their own privacy policy:

  • Supabase (PostgreSQL hosting and authentication)
  • Vercel (frontend hosting)
  • DigitalOcean (backend hosting)
  • NVIDIA NIM (LLM inference — your API key, your requests)
  • Groq (voice transcription — your API key, your requests)
  • Google Calendar and Google Drive (your OAuth authorization)
  • Telegram Bot API (chat delivery)

8. Security

All sensitive data at rest (API keys, Google OAuth tokens) is encrypted with AES-256-GCM. Database access is protected by Supabase Row-Level Security: users can only access their own rows. All backend endpoints require JWT authentication. Rate limiting is enforced on every endpoint. Prompt injection attempts are filtered before reaching the LLM.

9. Contact

For any privacy-related questions or data deletion requests, contact lucasromero@uninorte.edu.co.