COSMOS AI Privacy Policy

This Privacy Policy explains how COSMOS AI handles information when you visit the website, create or use an account, save discoveries, use Mission Control, or ask COSMOS AI a question. It applies to the COSMOS AI website and the features made available through it.

The information handled by COSMOS AI depends on the features you choose to use.

• Account and authentication information, such as your email address, name, profile image, account identifier, and authentication or session information. If you use Google sign-in, Google and Supabase participate in that authentication flow.
• Profile and preference information, including your explanation level, selected topics, briefing-email preference, and public-profile preference.
• Saved activity, including saved discoveries and your Mission Control layout when you use account-based saving features.
• Questions, recent conversation messages, selected page context, and generated responses when you use Ask COSMOS. Recent assistant history may also be stored in your browser so you can continue a conversation.
• Browser-saved exploration activity, such as saved APOD items, locally saved discoveries, recent exploration paths, achievements, and an Earth dashboard view preference.
• Technical and usage information made available through analytics and security tooling, such as page paths, whether a URL contained a query, coarse interaction data, device or browser information, approximate location derived by analytics providers, timestamps, performance measurements, request identifiers, and rate-limit or security events.

COSMOS AI uses information to operate and protect the product.

• Create and authenticate accounts, maintain sessions, and support password-reset and Google sign-in flows.
• Provide AI-assisted answers, retrieve relevant space and research data, and display source-grounded results.
• Save the discoveries, preferences, and layouts you ask the product to remember.
• Maintain continuity on your device, including recent assistant history and exploration activity.
• Measure feature usage and performance, diagnose failures, enforce usage limits, and protect the service from abuse.
• Respond to privacy, account, support, and data requests sent to the contact listed below.

When you use Ask COSMOS, your question, recent conversation messages, selected page context, and retrieved source context may be processed by the configured AI provider, currently OpenAI or Groq. Do not include information in a prompt that you do not want processed for the purpose of producing an answer.

To answer questions and power exploration features, COSMOS AI may send search terms or request parameters to public-data and research services such as NASA, OpenAlex, CORE, arXiv, Wikipedia, Open-Meteo, USGS, World Bank, and other sources identified in the product. Those providers handle requests under their own terms and privacy practices.

COSMOS AI uses authentication cookies to keep you signed in and a short-lived verification cookie during supported OAuth sign-in flows.

The product uses local storage for features such as recent assistant history, saved exploration items, progress, preferences, and achievements. A prompt handed from another COSMOS AI page to Ask COSMOS uses one-time session storage, expires after five minutes, and is removed when consumed.

Google Analytics and Vercel Analytics or Speed Insights are configured to measure site usage and performance. These services may use cookies or similar technologies and receive technical information under their own settings and privacy practices. Browser controls, extensions, and provider opt-out tools may limit some of this collection.

Account information, profile data, preferences, saved discoveries, and saved layouts remain in Supabase while the account or the relevant saved data remains active, unless the information is removed through a product control or a supported request.

Information saved in local storage remains on the device until the product or the user clears it. The one-time Ask COSMOS handoff expires after five minutes and is removed after it is read.

Eligible AI answers may be held in a limited in-memory server cache for up to six hours to serve repeat requests efficiently. Operational logs use privacy-reduced metadata rather than raw prompts or answer previews in the logging paths covered by COSMOS AI's security controls. Other retention periods can depend on hosting, authentication, analytics, and AI-provider settings.

COSMOS AI uses service providers to host the application, authenticate users, store account data, process AI requests, retrieve public information, measure performance, and protect the service. Information is disclosed to those providers when their services are used to perform those functions.

Information may also be disclosed when reasonably necessary to comply with a valid legal request, protect users or the service, investigate abuse, or enforce applicable agreements.

Depending on the feature, you can update account preferences, remove saved discoveries, clear assistant history, or clear COSMOS AI data through your browser settings.

For questions or requests concerning access, correction, account deletion, or deletion of personal information, contact the Privacy & Grievance Contact below. COSMOS AI will review the request and may need to verify that it came from the account holder before acting on it.

COSMOS AI uses technical and organizational safeguards designed to reduce risk, including protected authentication cookies, server-side authorization, row-level access controls for account data, request validation, rate limiting, security headers, restricted provider access, and privacy-reduced logging. No internet service can eliminate every security risk.

COSMOS AI includes educational and scientific content. If you believe a child has provided personal information through COSMOS AI without appropriate authorization, contact the Privacy & Grievance Contact so the situation can be reviewed.

This policy may be updated when COSMOS AI's features, providers, or information practices change. The date at the top of this page identifies the current published version.

Use the contact below for privacy questions, grievances, account concerns, and personal-information requests. Please do not send passwords, authentication tokens, or other secrets by email.