Pricing Book a Demo Get Infinite
privacy-policy.md

Privacy Policy

Last updated: 7 October 2026.

This Privacy Policy explains how Ultima AI, Inc., a Delaware corporation (United States) ("Ultima," "we," "us"), handles information in connection with Infinite Growth OS, the Infinite desktop application, infinite.fast, and related hosted services (together, "Infinite" or the "Service"). Infinite is local-first, but some features use Infinite-hosted cloud infrastructure. This policy identifies those boundaries instead of treating every workflow as device-only.

1. Who we are

Ultima AI, Inc., a Delaware corporation (United States).
Contact: support@ultima.inc

2. Local and hosted processing

The Infinite desktop application performs substantial work on your device and can keep local project and execution data there. Account, workspace, collaboration, connector, analytics, and other hosted features may also send data to or store data in Infinite's cloud services when you enable or use them. The product surface should identify whether a feature is local or hosted before you connect data or run an action.

  • Local data remains under your device and operating-system controls.
  • Hosted workspace data is processed to provide the features you request, enforce workspace access, synchronize supported providers, and operate the Service.
  • Credentials and tokens are limited to the connection and feature you authorize and are protected in transit and at rest. Bring-your-own credentials may remain local where the product explicitly says so; hosted connections necessarily send credentials or delegated tokens to the hosted execution boundary.
  • We do not sell connected-source or website analytics data.

3. Google user data

This section describes how Infinite accesses, uses, stores, shares, and protects Google user data obtained through Google OAuth. Infinite requests only the scopes needed for the Google features you choose to connect, and uses the data solely to provide those features to you:

  • Google Analytics (analytics.readonly, analytics.edit): read your authorized Analytics metrics to produce the reports, summaries, and insights you request, and — only when you explicitly initiate it — provision your declared conversion events as GA4 key events.
  • Google Search Console (webmasters.readonly): read your verified sites and search-performance data to generate SEO reporting and recommendations.
  • YouTube (youtube.readonly, youtube.upload, youtube.force-ssl): identify your connected channel and, when you approve it, upload and manage the videos, captions, and comments you publish through Infinite.
  • Google Ads (adwords): read advertising performance and manage the campaigns of the Google Ads account you connect.
  • Google sign-in (identity): authenticate you and associate your Infinite account and workspace.

Infinite does not use Google user data for advertising, does not sell it, and does not transfer it to others except as needed to provide the features you request (see storage, sharing, and sub-processors below). Infinite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is safeguarded using the data-protection mechanisms described in section 8 (Security).

Google Analytics 4

If you connect Google Analytics, Infinite uses the Google authorization mode shown in the product. A device-only connection reads authorized data to your device. A hosted connector processes the authorized metrics and credentials in Infinite's cloud so it can synchronize the workspace and provide the hosted feature you requested.

  • Scopes requested: the hosted Google Analytics connection requests read access (analytics.readonly) and edit access (analytics.edit) during connection. Infinite uses read access for reports and edit access to provision the workspace's declared conversion events as GA4 key events.
  • How it is used: to read authorized Google Analytics metrics, compute the summaries and insights you request, synchronize a hosted workspace when enabled, and perform setup changes you explicitly initiate. We do not use Google user data for advertising, and we do not sell it.

Connection modes

You may use your own Google app or Infinite's Google app where those choices are offered. The product must identify whether token exchange and subsequent API calls are device-only or hosted. Hosted credentials are encrypted and access-controlled; local credentials remain under your device controls.

  1. Use your own Google app. API usage is associated with your Google Cloud project. Storage and execution follow the local or hosted mode shown when you connect it.
  2. Use Infinite's Google app. Google's consent screen identifies Infinite and API usage may use Infinite's shared quota. The authorized scope is still limited to the connection and features you request.
  • Where it is stored: in the local store for device-only connections and in the protected hosted workspace store for hosted connections, according to the mode you enable.
  • Sharing: hosted connections use service providers to store and process authorized data on our behalf. When you request AI assistance using connected data, relevant context may be sent to your selected model provider, as described in section 6. We do not sell Google user data or use Google Analytics data for advertising.
  • Limited Use: Infinite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: you can disconnect Google Analytics at any time inside Infinite, and you can revoke access directly at https://myaccount.google.com/permissions.

Other Google connections

Google sign-in and each optional integration serve different purposes. Connecting one service does not automatically connect the others.

  • Google sign-in: account identity information is used to authenticate you and associate your Infinite account and workspace.
  • Google Search Console: read-only access (webmasters.readonly) reads your authorized sites and search performance for SEO reporting and recommendations.
  • YouTube: youtube.readonly identifies your connected channel; youtube.upload uploads videos you approve; youtube.force-ssl supports adding captions and comments as part of publishing. These permissions are requested when you connect YouTube.
  • Google Ads: adwords supports reading advertising performance and managing campaigns through the connected account. It is requested when you connect Google Ads.

Storage and protection: hosted integrations store connection identifiers, encrypted OAuth credentials, and the data and results needed to provide your connected workspace features. Access is restricted to authorized workspace and service operations. Local workflows use the local storage boundary described above.

Retention and deletion: connected data is retained while needed to provide your workspace, subject to the retention and backup limits in section 7. Revoke future Google access at Google Account permissions. Revoking access does not by itself erase previously stored records; contact support@ultima.inc to request deletion of Google connection data and credentials held by Infinite.

4. Other connected sources

For PostHog, Stripe, Shopify, Meta, X, and other sources, the product identifies the requested scopes and whether execution is local or hosted. Connected data is used to provide the analysis or action you request. Hosted credentials and data are workspace-scoped and access-controlled; device-only credentials remain under your device controls.

5. Website visitor analytics

On infinite.fast, Infinite first-party analytics, Google Analytics 4, and PostHog measure website use by default. We may also use advertising pixels from X, Meta, and Reddit.

  • What we collect: the pages you view, the links and buttons you click (including downloads), recordings of how you use our pages (through PostHog), basic information about your browser and device (including your IP address), and how you arrived, such as the website, campaign, or ad that brought you here.
  • Cookies and similar storage: we use cookies and similar browser storage to remember your analytics choice, recognize return visits, measure visits, remember which campaign brought you here, keep you on the same version of a page while we test changes, and complete sign-in. PostHog, Google Analytics, and the X, Meta, and Reddit pixels may use their own cookies or storage under their published terms. You can clear or block cookies in your browser.
  • Your choices: when your browser sends Do Not Track or Global Privacy Control, our first-party browser analytics, Google Analytics, PostHog, and the X, Meta, and Reddit pixels stay off unless you grant analytics through the on-site prompt. A saved denial keeps all of them off. Browser settings or extensions can also block them. These choices control the analytics and advertising tools that run in your browser. They do not stop us from keeping the sign-up and audit-request details described below, the campaign details from a link you followed, or our server logs, and they do not stop the sign-up and audit-request measurement we send to our advertising partners.
  • Signing up: when you request an email code or sign in with Google on /get-started, we keep your email address (and, for Google sign-in, basic account identity), how and when you arrived, basic browser information, and whether any sign-up step failed, so we can verify you, create, secure, and support your account, sign you in to the desktop app, and measure our marketing. We may also connect your sign-up to your earlier visits to this website, including which version of a page you saw.
  • Audit requests: when you ask for a free audit, we keep your email address, the website you give us, and how you arrived, so we can send your audit, follow up with you, and measure our marketing.
  • Advertising measurement: we share limited information with our advertising partners, currently Meta, Google, and Reddit, to measure how our advertising performs.
  • Server logs: our hosting provider records the requests your browser makes to our site, such as loading pages, downloading the app, or sending automatic security reports. We use these logs to run and secure the site and to count visits and downloads. Browser settings do not control them, because our servers must receive a request in order to respond to it.
  • Why we use it: to run and secure the site, understand how visitors use it, test improvements to the site, and measure which marketing brings people to Infinite.

Website data is received by Vercel (hosting), our cloud, database, email-delivery, and scheduling providers, PostHog, and Google Analytics. X, Meta, and Reddit receive data through their advertising pixels when we use them, and Meta, Google, and Reddit receive the advertising-measurement information described above.

You can review or change a saved analytics decision for this website at any time:

6. Hosted features and AI sub-processors

Account information, hosted workspace context, requested action inputs, and saved results may reach our servers when you use hosted features. When you run a hosted AI action, the data needed for that action may be processed by model providers acting as our sub-processors — currently Anthropic and/or OpenAI — under the applicable business/API terms and configured data controls. When you bring your own model or key, your data goes to the endpoint you configure, under that provider's terms.

7. Data retention and deletion

We keep the personal information we hold only as long as we need it for the purposes in this policy, including providing your account and workspace, security, fraud prevention, and legal obligations, and then delete or de-identify it.

  • Local data: controlled entirely by you; delete it by removing the local store or disconnecting sources.
  • Hosted workspace data: retained while needed to provide the workspace or until you delete it, subject to legal, security, backup, and fraud-prevention obligations.
  • Provider data: use Google Analytics, PostHog, X, Meta, or Reddit controls to manage data those processors hold, and contact us for records under our control.
  • Requests: to exercise access, correction, or deletion rights, contact support@ultima.inc.

8. Security

We use administrative, technical, and organizational measures designed to protect sensitive data — including Google user data — against unauthorized access, disclosure, alteration, and loss. These measures include:

  • Encryption in transit: data exchanged between the Infinite app, our hosted services, and third-party providers (including Google APIs) is transmitted over encrypted HTTPS/TLS connections.
  • Encryption at rest: sensitive hosted data, including connector credentials and OAuth tokens, is encrypted at rest.
  • Access controls: hosted data is workspace-scoped, and access is limited to authorized users and to the service operations needed to provide the features you request.
  • Scope minimization: Infinite requests only the OAuth scopes required for the features you connect, and processes Google user data only to provide those features.

No method of storage or transmission is 100% secure, but we protect your data using industry-standard safeguards.

9. Children's privacy

Infinite is a business tool not directed to children under 16, and we do not knowingly collect their personal data.

10. International users

If you use the Service outside the United States, you understand that any data sent to our hosted features may be processed in the United States, where Ultima AI, Inc. is incorporated (Delaware).

11. Changes to this policy

We may update this policy; we will post the updated version and, for material changes, provide reasonable notice.

12. Contact

Questions or requests: support@ultima.inc (Ultima AI, Inc.).