Privacy Policy

Dola is an AI copilot for Unreal Engine developers: a website for accounts and billing, a hosted API at dolaai.pro, a desktop (Electron) app, a VS Code extension published as dolaai, and an Unreal Editor plugin. Copyright on the desktop installer is “Dola AI”. The Microsoft Store publisher display name is DolaAI.

We are the data fiduciary (India) / controller (GDPR-style language) for the account, waitlist, billing ledger, and device-session records we keep on our servers. Firebase, OpenRouter, Dodo Payments, Railway, and GitHub process data on our behalf or as independent providers of their own services, as described below.

Account, waitlist, and sign-in

Creating an account (email/password or Google) goes through Firebase Authentication. We receive your Firebase user id, email, and display name. Passwords are stored by Firebase, not in our database. Google sign-in shares the Google profile Firebase is configured to receive (typically email and name).

Our backend then stores a user row: uid, email, display name, waitlist / rollout status (whether access is pending or active, and queue position), timestamps, a masked preview of a provisioned inference key, spend limits, purchased credit totals, and — if you pay — a Dodo customer id. Sign-ups can be capped; joining while the waitlist is open still creates this account record so we can tell you your place in line.

Firebase sends verification and password-reset emails. We do not run a separate marketing mailing list in this product.

Tokens and device sessions

API calls to dolaai.pro send a Firebase ID token in the Authorization header. We verify the JWT; we do not keep a server-side login session store for customers. Signing in from VS Code or the desktop app uses a short-lived browser handoff (state and one-time code, minutes) that briefly holds ID and refresh tokens in memory on the server until the app exchanges them.

When the VS Code extension registers a device we store a session id, a machine label, the extension version, and last-seen time. You can remove a device from the dashboard.

Inference keys

After waitlist access is granted, we provision a per-user OpenRouter API key, encrypt it with a server key, and store the ciphertext plus a key hash. The full key is not shown in the dashboard (only a preview). The extension and desktop app call our inference proxy; they are not meant to hold that provider key.

Payments

Credit packs are sold through Dodo Payments, which is the payment processor and merchant of record. Checkout happens on Dodo’s hosted page. We send them your email/name (or an existing Dodo customer id) and metadata that ties the session to your Firebase uid and pack. We do not collect or store full card numbers, CVV, or bank account details.

Dodo notifies us via signed webhooks. We store webhook ids (for idempotency), checkout session ids, credit-ledger entries (amount, pack, payment id, reason), and we may pull payment history from Dodo to show on the dashboard. Failed or cancelled payments are acknowledged; they do not add credits.

Downloads and plugin binaries

Signed-in users can download desktop installers. Our server uses a GitHub token we hold (not your GitHub account) to list release assets and mint a download URL. We use User-Agent and optional OS/arch hints so the dashboard can recommend the right file. GitHub may see the download request; we do not give you our GitHub token.

Authenticated users with active access can also download Unreal plugin builds that we store on the server (Railway volume). Upload of those binaries is gated by a separate server secret used in CI, not by customer accounts.

Website and logs

The marketing site and tools catalog do not require an account. Waitlist status and the public tools list are fetched without identifying you. We load one Google Analytics 4 tag (gtag.js) for page measurement. Analytics storage starts denied until you choose “Allow attribution” on the cookie banner; we do not load a second tag or an ad pixel. Firebase Auth in the browser uses Google’s storage (typically IndexedDB / local storage), not a first-party advertising cookie.

Hosting (Railway) records operational logs: paths, status codes, and errors. We do not treat those logs as a prompt archive, but they can include request metadata and truncated error text. An operator admin console uses a separate httpOnly cookie; that is not part of the customer product.

When you chat, embed, rerank, or index through Dola, the desktop app or VS Code extension sends prompts and related context (code, Blueprint or project snippets, file extracts you attach or that tools pull in) to https://dolaai.pro/api/inference/v1. Our backend authenticates you and forwards the request body to OpenRouter. OpenRouter routes it to the model provider you selected (or that we configured).

Our users database is not a chat store. We do not save prompt or completion text into that SQLite database. We do receive usage totals from OpenRouter (spend in USD, remaining limit) so we can enforce included monthly credits and purchased extra credits.

That is not the same as “we never see or store prompts.” The proxy must handle the body in memory to forward it. Railway or process logs and exception traces might capture metadata or fragments if a request fails. OpenRouter and downstream model providers receive the full payload and may retain it under OpenRouter’s privacy policy and the provider’s policy. Assume anything you send in a Dola chat can leave your computer and be processed by those parties.

Chats, indexes, and editor state are designed to live on disk locally — not in our cloud account database.

• Desktop app: settings, cached account tokens, and crash dumps under the Electron user-data folder; chat history in a local SQLite/LibSQL file; vector indexes in LanceDB; optional DuckDB observability metrics. Windows crash reports are written locally and are not uploaded to us. The NSIS installer does not delete this app data on uninstall.
• VS Code extension and Unreal plugin: on Windows, Documents\.Dola; on macOS/Linux, ~/.Dola — including bridge files, project knowledge indexes, and extension settings. Unreal Editor talks to Dola through that local bridge; we do not host your .uproject.

Product analytics that shipped in the upstream Cline engine (PostHog) are disabled in the Dola build (empty API keys). We are not currently collecting extension telemetry into a Dola-owned analytics backend.

You control local files: quit the apps and delete those folders (and Electron userData) if you want them gone. Uninstalling alone may not be enough.

• Google Analytics — page measurement via one gtag.js stream when attribution is allowed.
• Google Firebase — authentication, verification and reset emails.
• Google — if you choose “Log in / Join with Google”.
• OpenRouter and model providers — inference, embeddings, usage accounting; key labels may include your email.
• Dodo Payments — checkout, cards, invoices, refunds, customer record; we keep ledger references, not PAN data.
• Railway — hosts the website and API, including volumes for the users database and plugin binaries.
• GitHub — release assets for installers; our server token talks to GitHub on your behalf for authenticated downloads.

Legal bases we rely on where that framing applies: performing the contract (account, inference proxy, downloads), legitimate interests (security, waitlist fairness, billing reconciliation, abuse prevention), and legal obligations around payment records (primarily via Dodo). Google sign-in is optional.

Account and ledger rows are kept while the account exists and for a reasonable period afterward if we need them to reconcile payments or investigate abuse. Webhook ids are kept so the same payment is not credited twice. Handoff codes expire in minutes. OpenRouter and Dodo keep their own records on their schedules.

You can access and correct profile details by signing in (dashboard shows email, name, uid, usage, devices, and payment history we can load from Dodo). Signed-in users can delete their account from the dashboard after typing their email or DELETE.

If you cannot use the dashboard, email support@dolaai.pro from the address on the account. We will delete or de-identify the Firebase user and our user row, encrypted keys, device sessions, and ledger entries we control, except where we must keep a stub for billing integrity or law. Dodo may still hold payment records. Inference prompts already processed by OpenRouter cannot be pulled back by us.

Delete local chats and indexes yourself as described in section 4. Revoke Google access in your Google account if you used Google sign-in. Remove VS Code / Store / desktop installs if you want the apps gone.

Depending on where you live you may also have rights to access, correction, erasure, restriction, portability, and to complain to a regulator (for example a Data Protection Board in India, or an EU/UK supervisory authority). We will respond to requests sent to support@dolaai.pro.

Dola does not age-gate sign-up, waitlist access, or use of the product. We do not ban, reject, or close accounts for being under 18. Teens and students may create an account and use the tool.

Dola is a professional developer tool and is not directed at children under 13 (COPPA). We do not collect date of birth. Checkout is handled by Dodo Payments; if they decline a charge, that is their decision and it does not ban or close your Dola account. Contact support@dolaai.pro.

We operate Dola from India and provide it worldwide. Account data is processed on Railway and by Firebase, OpenRouter, Dodo, and GitHub, which may store or access information in the United States and other countries. Those transfers are required to run the hosted service you signed up for.

Under India’s Digital Personal Data Protection Act, 2023, you may request access, correction, and erasure of personal data we hold, and withdraw consent where processing was consent-based (for example Google sign-in), by emailing support@dolaai.pro. This policy is the notice for that processing. We do not sell personal data.

If we change how Dola handles personal data in a material way, we will update this page and the “Last updated” date. Continued use of the service after the update means the revised policy applies to that use.

Dola AI / DolaAI
Website: https://dolaai.pro
Email: support@dolaai.pro