MrGPTs

Privacy Policy

Effective date: September 30, 2026

MrGPTs (“MrGPTs”, “we”, “us”) is operated by Muhammad Talha, an individual based in Pakistan. This policy explains what information we handle when you use mrgpts.com, why, who we share it with, and the choices you have. For any privacy question or request, email support@mrgpts.com.

Information we collect

• Account information. If you create an account: your email address, an optional display name, and a password verifier. Passwords are stored only as salted PBKDF2-SHA-256 hashes, never in readable form. If you sign in with an email link, no password is stored.
• Guest identifier. If you chat without an account, we set a random guest identifier in a secure, HTTP-only cookie so your conversations and daily allowance stay with your browser.
• Conversations and files. Messages you send, the assistant’s replies, conversation titles and summaries, feedback you give on replies, reports you submit, and images or text files you attach.
• GPTs you create. If you build a GPT: its name, description, instructions, conversation starters, icon, and any knowledge files you upload.
• Usage and security data. Request metadata such as timestamps, the assistant used, token counts, error states, and a one-way hash of your IP address used for rate limiting and abuse prevention. We do not store raw IP addresses in our database.

How we use information

• To provide the service: run chats, keep your conversation history and library, enforce plan allowances, and deliver sign-in, verification, and password-reset emails.
• To keep the service safe: prevent abuse and fraud, rate-limit automated traffic, investigate reported content, and secure accounts.
• To maintain and improve reliability, using aggregated operational metrics.

We do not sell your personal information, use it for third-party advertising, or use your conversations to train AI models.

Service providers

We share information only with providers that process it on our behalf to run MrGPTs:

• OpenAI generates chat replies and images. Your messages, the assistant’s instructions, recent conversation context, and any attachments needed for a request are sent to OpenAI’s API. OpenAI’s API data policies apply to the data it receives.
• Cloudflare hosts the application (Workers) and stores data (D1 database and R2 file storage).
• Zoho ZeptoMail delivers transactional emails such as sign-in links and password resets.
• Stripe processes payments for paid plans. Stripe collects your payment details directly; we receive only your Stripe customer and subscription identifiers, your plan, and its billing status and renewal date, and we do not store your card number.

We may also disclose information if required by law, or to protect the rights, safety, or security of our users, the public, or MrGPTs. These providers may process data outside Pakistan, including in the United States.

Cookies

We use only cookies that are necessary for the service: a session cookie that keeps you signed in (expires after 30 days) and a guest cookie that identifies a signed-out browser (expires after one year). Both are secure and HTTP-only. We do not use advertising or cross-site tracking cookies. Your browser may also keep small preferences, such as your theme, in local storage.

Retention

We keep account data, conversations, attachments, and GPTs you create for as long as your account is active, or for guest data, as long as the guest cookie is in use. When you ask us to delete your account or specific data, we delete it from our active systems within 30 days, except where we must keep limited records to comply with law, resolve disputes, or prevent abuse. Security and rate-limit records are kept only as long as needed for those purposes.

Your choices and rights

You can ask us to access, correct, export, or delete your personal information, or to close your account, by emailing support@mrgpts.com from the address on your account. We may need to verify your identity before acting, and we will respond within 30 days. Archiving a conversation or signing out does not delete data.

Security

We use encrypted connections, hashed passwords and session tokens, identity-scoped access checks on every conversation and file, and private file storage. No online service can guarantee absolute security, so please do not submit passwords, financial details, or other information you are not comfortable sharing with an AI service.

Children

MrGPTs is not directed to children. You must be at least 13 years old to use it, and if you are under 18 you need permission from a parent or guardian. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Changes to this policy

We will update the effective date above when this policy changes. For material changes, we will also post a notice on the site or email account holders before the change takes effect.

Contact

Muhammad Talha, operator of MrGPTs, Pakistan. Email: support@mrgpts.com.