Your PDFs stay on your device.

What stays on your device

PDF files, figure captures, attached images, and preferences remain in your browser or desktop app. If you choose account backup, Legunt copies document names, reading positions, highlights, and discussion text only after you confirm.

What leaves your device when you ask AI

An AI request can include your question, document title, selected or retrieved book passages, page or figure images, attached images, notes you include, and messages from the discussion. For AI help with exercises or worksheets, it can also include the question, your work and the references needed for that request. Do not send sensitive material or anything you do not have permission to share.

Suggestions from the pages on screen

When AI is set up, Discussions is open and no discussion is showing, Legunt sends the text of the two pages on screen — the page most in view and the next one — to the AI provider, without you asking, to write a one-line summary and three suggested questions. It also sends the book’s title and page count, its chapter titles when the PDF has them, and up to the last 30 questions you have asked about that book, so suggestions don’t repeat them. Questions from chats about your own notes are not included. A scanned page is sent as an image when the AI model reads images. Each pair of pages is sent at most once per AI model in a session, and again only if a request fails. Your other books and notes are never sent.

With Legunt-managed AI, these requests go through OpenRouter as described below and, when usage accounting is enabled, are recorded and limited like your discussions. With your own API key in the desktop app, they go to that provider, usually to a smaller, cheaper model from the same provider, and your provider bills that usage.

To stop this, turn off Settings → Reading & appearance → Suggestions from the open pages, or choose Hide in Discussions for one book. You can still ask about the pages yourself: when you do, the text of those pages (or, for a scan, the page image) and your question are sent, as with any question.

OpenRouter and model hosting providers

When Legunt-managed AI uses OpenRouter, OpenRouter, Inc. processes the AI content on Legunt’s behalf and routes it to a model hosting provider to produce a response. The hosting provider can vary with the selected model and eligible inference endpoints. Review OpenRouter’s privacy documents and the hosting providers’ data policies below.

OpenRouter privacy policy · OpenRouter data processing agreement · Model hosting providers and their policies

Training and retention controls

For requests through OpenRouter on Legunt’s live service, Legunt requires inference endpoints that do not use your inputs or outputs for training and are marked zero data retention (ZDR). These are separate controls. ZDR still allows temporary processing; operational metadata and legally required records may be retained.

Before activating this route on Legunt’s live service, we also require OpenRouter’s optional input/output logging and use of inputs/outputs settings to be off. These settings are separate from the endpoint routing controls.

Where AI content is processed

This integration uses OpenRouter’s global API, not its EU regional service. OpenRouter and the model hosting provider may process content in the United States or other countries outside the European Economic Area and the United Kingdom. ZDR is a retention control, not a guarantee that processing stays in Europe.

Your own API keys on desktop

If you explicitly choose your own API key in the desktop app, that request goes directly to your chosen AI provider instead of Legunt’s managed OpenRouter route. Your provider’s terms and data policies apply. The web app uses your Legunt account’s managed AI access; it does not use your desktop keys.

Records for Legunt-managed AI usage

When usage accounting for this route is enabled, Legunt records your account ID, request times, model, AI feature and paid or complimentary access. It also records the credential’s version, generation identifiers, request status, and any token counts and cost reported by OpenRouter. Desktop requests using your own key are not counted. This usage record does not contain your question, page images or the answer.

To link source-reading steps to one answer, we also keep a fingerprint derived from the original request with a new random value for each answer. It is account-linked data, not anonymous data. The fingerprint is not the original text, but someone with database access could try to guess short or predictable requests.

Under the proposed policy, ordinary account-linked usage records become eligible for scheduled cleanup 90 days after creation. Records assigned to an AI allowance period, and the period itself, become eligible for cleanup 90 days after that period ends. Records needed to settle unresolved costs can remain longer, until settlement.

For closed requests older than 90 days, cleanup removes the content-derived request fingerprint even if financial records remain. A request still running or awaiting further source-reading steps keeps its fingerprint until it is closed.

Deleting your account also removes its usage records, allowance periods, pending-answer records, account-specific limits and account-linked audit records. Daily totals without account IDs can remain after cleanup or account deletion.

The notice and retention policy must be approved, and scheduled cleanup must be operating, before usage accounting or monthly AI limits are enabled. This notice does not mean either feature is already active.

When staff access auditing is enabled, we record your account ID, the staff member’s verified identifier, the action and its time when authorized staff look up or open account details, export usage, or change complimentary AI access. This access log does not store your email, search terms, questions or answers. Its proposed retention is 90 days, with account deletion also removing these records. Before this feature is enabled, the notice and retention policy must be approved and scheduled cleanup must be operating. This notice does not mean staff access auditing is already active.

When authorized staff manage monthly AI limits, a separate change log records their changes to global and account limits: the staff member’s verified identifier, time, reason, and settings before and after the change. This also applies while limits are off. Account changes also include your account ID. A reason can contain personal information.

The proposed retention for both types of limit-change records is 90 days from creation. Current settings keep the last staff identifier and reason until replaced. The notice and retention policy must be approved, and scheduled cleanup must be operating, before staff can manage these settings.

Website download counts

When enabled, Legunt counts selections of website installer links by UTC day, release, platform and link position. The collector does not store IP addresses, accounts, cookies or browsing history. A random receipt prevents duplicate counts for 24 hours; daily totals are kept for 90 days. Cleanup runs while collection is active. Counts do not show completed downloads or installations. We respect your browser’s Do Not Track and Global Privacy Control signals.

How to remove local data

You can remove a reading and its discussions from inside Legunt. Clearing the site or app storage removes all locally saved data. Uninstalling the desktop app may leave its saved data behind.

Questions

Contact [email protected] with privacy or deletion questions.