Privacy Policy & Security

Account & Profile: Username, email address, phone number, first and last name, and the military details you provide (rank, branch, unit, MOS/AFSC)

Authentication & Security: Hashed passwords (never stored in plain text), 2FA codes sent by SMS, password-reset tokens, session cookies, and records of your legal-agreement acceptance (version, date/time, IP, device/browser)

Subscription & Billing: Plan tier, subscription status, and trial dates, plus billing identifiers from Stripe (payment cards are handled by Stripe; we never store full card numbers)

Content You Create: AI chat messages and history, and documents you generate or upload (memorandums, evaluations, award citations, operation orders/CONOPs, notes), plus training, lesson, quiz, and mission progress

Usage & Gamification: XP, streaks, tiers, achievements, leaderboard scores, and feature usage patterns

Device & Technical: IP address, browser type, operating system, app version, general device information, and diagnostic/performance data

Advertising Data (Mobile App): With your permission, Google AdMob may use your device's advertising identifier (e.g., Apple's IDFA on iOS) for personalized ads — see "Advertising & Tracking" below

Push Notifications (Mobile App): A device push token, if you enable notifications, used to send training reminders and alerts

SMS Consent Records: If you opt in to SMS, your phone number, consent language shown, message types/frequency, date/time, IP, and device/browser

Security & Anti-Abuse: When you register or submit certain forms, we use Google reCAPTCHA, which collects device and interaction signals to detect and prevent automated abuse

Calendar Integration (Optional): If you connect an external calendar (Google, Microsoft/Outlook, or Apple), we store the associated account email and the access/refresh tokens or app-specific calendar credentials needed to sync (encrypted), and read/write calendar events to publish your training plans

Voice & Audio: If you use voice input, we process your audio recording to transcribe it to text (via OpenAI Whisper); the transcript may be retained as part of your chat history

Uploaded Documents: PDFs and Office files you upload are processed to extract form fields or convert formats (via Adobe PDF Services) and may be stored in cloud object storage (Replit Object Storage, backed by Google Cloud Storage)

Important: Do not submit classified or controlled unclassified information (CUI) — it is not authorized, and we remove it if discovered. We do not track your real-time location, duty stations, or deployments.

The MilAssist Training mobile app shows ads through Google AdMob to support the free tier.

• App Tracking Transparency (iOS): Before any tracking for personalized ads, iOS asks for your permission. Decline and you still see ads, but non-personalized.
• Consent: We use Google's User Messaging Platform to gather any required advertising consent and remember your choice on your device.
• Your choices: Change or withdraw permission anytime in device settings (iOS: Settings > Privacy & Security > Tracking); you can also reset or limit your advertising identifier there.
• Ad-free option: Paid (PRO) subscribers do not see ads in the mobile app.

Encryption: Data is encrypted in transit using HTTPS/TLS and protected with industry-standard encryption

Local Download: Where available, you can download generated documents directly to your device

Access Controls: Authentication and role-based access limitations

Data Minimization: We collect only essential information required for service functionality

Security Reviews: We perform periodic security reviews and assessments

Classification Level: UNCLASSIFIED ONLY - This system is not authorized for classified or controlled unclassified information

OPSEC Compliance: Users are responsible for ensuring no operationally sensitive information is processed

Not a DoD System: MilAssist is a civilian-developed tool, is not an official DoD system, and is not designed to meet DoD security standards (e.g., FedRAMP, IL5); we apply industry-standard security practices for unclassified use

Branch Neutral: Not affiliated with or endorsed by any military branch or government entity

Audit Logging: We may log security-relevant activity for security and compliance purposes (anonymized where possible)

Account Data: Retained while your account is active, and removed within a reasonable period after account closure

Document Data: Retained while your account is active or until you delete it

Usage Analytics: Anonymized data may be retained to help improve the Service

Payment Records: Retained as required by tax, accounting, and legal obligations

User Control: Request deletion of your account and associated data at any time from your account settings or by emailing contact@milassist.ai. We remove or de-identify your data, except records we must retain for legal, tax, or fraud-prevention purposes.

Data Sharing: We never sell, rent, or share personal data with third parties for marketing purposes. AI processing is essential for service functionality.

For privacy-related questions, data requests, or security concerns:

Privacy Officer: contact@milassist.ai

Security Team: contact@milassist.ai

AI Processing Questions: contact@milassist.ai

General Support: contact@milassist.ai

Response time: We aim to respond to privacy requests within 30 days as required by applicable law, and to other inquiries as promptly as we can.