Privacy Policy

Dola is an AI copilot for Unreal Engine developers: a website for accounts and billing, a hosted API at dolaai.pro, a desktop (Electron) app, and an Unreal Editor plugin. Copyright on the desktop installer is “Dola AI”. The Microsoft Store publisher display name is DolaAI.

We are the data fiduciary (India) / controller (GDPR-style language) for the account, waitlist, product-update list, billing ledger, and device-session records we keep on our servers. Firebase, Google Analytics, OpenRouter, Dodo Payments, Resend, Railway, GitHub, and Cloudflare (Turnstile) process data on our behalf or as independent providers of their own services, as described below.

Account, waitlist, and sign-in

Creating an account (email/password or Google) goes through Firebase Authentication. We receive your Firebase user id, email, and display name. Passwords are stored by Firebase, not in our database. Google sign-in shares the Google profile Firebase is configured to receive (typically email and name).

Our backend then stores a user row: uid, email, display name, waitlist / rollout status (whether access is pending or active, and queue position), timestamps, a masked preview of a provisioned inference key, spend limits, purchased credit totals, and — if you pay — a Dodo customer id. Joining the waitlist creates this account record so we can tell you your place in line. Creating an account also asks you to pass a Cloudflare Turnstile check, which sends Cloudflare your IP address and browser signals to tell people from bots.

Firebase sends verification and password-reset emails. We send other emails about the service (for example, when your Dola access opens) through Resend, our email provider.

Product-update emails

The optional “Product updates” form, and the product-updates box on the sign-up form, add you to a mailing list separate from your account. You can untick the box before signing up. If you subscribe, we store your email address, the page you subscribed on, any campaign (UTM) tags from the link you followed, and the time. We use the list only to email news about Dola, sent through Resend. We do not sell the list.

Each product-update email includes an unsubscribe link. You can also email support@dolaai.pro and we will remove your address. When you unsubscribe, we take you off the list and keep only your email address on a do-not-email list, so we never email you again by mistake.

Tokens and device sessions

API calls to dolaai.pro send a Firebase ID token in the Authorization header. We verify the JWT; we do not keep a server-side login session store for customers. Signing in from the desktop app uses a short-lived browser handoff (state and one-time code, minutes) that briefly holds ID and refresh tokens in memory on the server until the app exchanges them.

When the desktop app registers a device we store a session id, a machine label, the app version, and last-seen time. You can remove a device from the dashboard.

Inference keys

After waitlist access is granted, we provision a per-user OpenRouter API key, encrypt it with a server key, and store the ciphertext plus a key hash. The full key is not shown in the dashboard (only a preview). The desktop app calls our inference proxy; it is not meant to hold that provider key.

Payments

Monthly plans and extra credit packs are sold through Dodo Payments, which is the payment processor and merchant of record. Checkout happens on Dodo’s hosted page. We send them your email/name (or an existing Dodo customer id) and metadata that ties the session to your Firebase uid and pack. We do not collect or store full card numbers, CVV, or bank account details.

Dodo notifies us via signed webhooks. We store webhook ids (for idempotency), checkout session ids, credit-ledger entries (amount, pack, payment id, reason), and we may pull payment history from Dodo to show on the dashboard. Failed or cancelled payments are acknowledged; they do not add credits.

Downloads and plugin binaries

Signed-in users can download desktop installers. Our server uses a GitHub token we hold (not your GitHub account) to list release assets and mint a download URL. We use User-Agent and optional OS/arch hints so the dashboard can recommend the right file. GitHub may see the download request; we do not give you our GitHub token.

Authenticated users with active access can also download Unreal plugin builds that we store on the server (Railway volume). Upload of those binaries is gated by a separate server secret used in CI, not by customer accounts.

Website and logs

The marketing site and tools catalog do not require an account. Waitlist status and the public tools list are fetched without identifying you. We use one Google Analytics 4 tag (gtag.js) to count page views. It loads only after you click “Allow cookies” on the cookie banner. If you choose “Necessary only” or make no choice, the Google Analytics script is not loaded and nothing is sent to Google Analytics. When it is on, Google receives your IP address, browser details, and the pages you visit. We do not use ad pixels or ad cookies. To change your choice at any time, use “Cookie settings” here or at the bottom of our pages: it withdraws the choice, deletes the Google Analytics cookies and the banner asks again. Firebase Auth in the browser uses Google’s storage (typically IndexedDB / local storage), not a first-party advertising cookie.

Cookie settings

Hosting (Railway) records operational logs: paths, status codes, and errors. We do not treat those logs as a prompt archive, but they can include request metadata and truncated error text. An operator admin console uses a separate httpOnly cookie; that is not part of the customer product.

When you use Dola-hosted models, the desktop app sends prompts and related context (code, Blueprint or project snippets, file extracts you attach or that tools pull in) to our servers at dolaai.pro. Our backend authenticates you and forwards the request body to OpenRouter, our model routing provider. OpenRouter routes it to the model provider you selected (or that we configured).

With your own API key (Settings → Model → Override provider), chat requests go from the app straight to the provider you chose and do not pass through dolaai.pro or our OpenRouter account; if the provider you choose is OpenRouter, they go to OpenRouter under your own account. One exception: web research in Dola's research browser uses Dola-hosted models whenever you are signed in, so its prompts and the pages it reads follow the path above. Embeddings, reranking, and project indexing run on your computer. The app also downloads OpenRouter's public model list to show available models; that request carries no prompts or account data.

Our users database is not a chat store. We do not save prompt or completion text into that database. We do receive usage totals from OpenRouter (spend in USD, remaining limit) so we can enforce included monthly credits and purchased extra credits.

That is not the same as “we never see or store prompts.” The proxy must handle the body in memory to forward it. Railway or process logs and exception traces might capture metadata or fragments if a request fails. OpenRouter and downstream model providers receive the full payload and may retain it under OpenRouter’s privacy policy and the provider’s policy. Assume anything you send in a Dola chat can leave your computer and be processed by those parties.

Chats, indexes, and editor state are designed to live on disk locally — not in our cloud account database.

• Desktop app: settings, cached account tokens, and crash dumps under the Electron user-data folder; chat history in a local SQLite/LibSQL file; vector indexes in LanceDB; optional DuckDB observability metrics. Windows crash reports are written locally and are not uploaded to us. The NSIS installer does not delete this app data on uninstall.
• Unreal plugin: Unreal Editor talks to the Dola desktop app through a local bridge on your machine; we do not host your .uproject.

You control local files: quit the apps and delete those folders (and Electron userData) if you want them gone. Uninstalling alone may not be enough.

• Google Analytics — page-view measurement, only after you click “Allow cookies”.
• Google Firebase — authentication, verification and reset emails.
• Google — if you choose “Log in / Join with Google”.
• OpenRouter and model providers — prompts and context for Dola-hosted model requests, usage accounting; key labels may include your email.
• Dodo Payments — checkout, cards, invoices, refunds, customer record; we keep ledger references, not PAN data.
• Resend — sends our emails: service emails to account holders and product-update emails to subscribers.
• Railway — hosts the website and API, including volumes for the users database and plugin binaries.
• GitHub — release assets for installers; our server token talks to GitHub on your behalf for authenticated downloads.

Legal bases we rely on where that framing applies: performing the contract (account, inference proxy, downloads), legitimate interests (security, waitlist fairness, billing reconciliation, abuse prevention), and legal obligations around payment records (primarily via Dodo). Google sign-in is optional.

Account and ledger rows are kept while the account exists and for a reasonable period afterward if we need them to reconcile payments or investigate abuse. Webhook ids are kept so the same payment is not credited twice. Handoff codes expire in minutes. Product-update addresses are kept until you unsubscribe or ask us to delete them; after you unsubscribe, only the address stays on our do-not-email list. OpenRouter and Dodo keep their own records on their schedules.

You can access and correct profile details by signing in (dashboard shows email, name, uid, usage, devices, and payment history we can load from Dodo). Signed-in users can delete their account from the dashboard after typing their email or DELETE.

If you cannot use the dashboard, email support@dolaai.pro from the address on the account. We will delete or de-identify the Firebase user and our user row, encrypted keys, device sessions, and ledger entries we control, except where we must keep a stub for billing integrity or law. Dodo may still hold payment records. Inference prompts already processed by OpenRouter cannot be pulled back by us.

Delete local chats and indexes yourself as described in section 4. Revoke Google access in your Google account if you used Google sign-in. Remove Store or desktop installs if you want the apps gone.

Depending on where you live you may also have rights to access, correction, erasure, restriction, portability, and to complain to a regulator (for example a Data Protection Board in India, or an EU/UK supervisory authority). We will respond to requests sent to support@dolaai.pro.

You must be 18 or older to create a Dola account or use Dola. Dola is for adults, and India’s Digital Personal Data Protection Act treats everyone under 18 as a child. When you sign up, you confirm that you are 18 or older. We do not ask for your date of birth.

If we learn that an account belongs to someone under 18, we delete it and the data we hold for it, except records the law requires us to keep. If you think a person under 18 has a Dola account, email support@dolaai.pro.

We operate Dola from India and provide it worldwide. Account data is processed on Railway and by Firebase, OpenRouter, Dodo, Resend, and GitHub, which may store or access information in the United States and other countries. Those transfers are required to run the hosted service you signed up for.

Under India’s Digital Personal Data Protection Act, 2023, you may request access, correction, and erasure of personal data we hold, and withdraw consent where processing was consent-based (for example Google sign-in), by emailing support@dolaai.pro. This policy is the notice for that processing. We do not sell personal data.

If we change how Dola handles personal data in a material way, we will update this page and the “Last updated” date. Continued use of the service after the update means the revised policy applies to that use.

Dola AI / DolaAI
Website: https://dolaai.pro
Email: support@dolaai.pro
X: https://x.com/dolaaipro