This policy explains what data Physical AI Lab (www.oneai.host, “this site”) processes when you visit it, why, for how long, and how to contact us. The site is run by an individual and built with WordPress.
Last updated: October 6, 2026
In short
- You can read the site without an account. An optional account, created by signing in with Google or GitHub, unlocks the answers to self-check questions and the AI assistant; the site then receives your name and email address from that service. There are no comments, contact forms or newsletters.
- The site uses no analytics, advertising or tracking tools, and loads no third-party fonts, avatars or embedded content. Google or GitHub is contacted only when you choose to sign in with it.
- If you use the AI assistant, your messages are sent to Amazon Bedrock (AWS) to generate the answers and may be processed outside Japan. Questions about the shop’s products include details of the matching products, and questions about orders, when you are signed in, include a summary of your own orders without your address, contact or payment details. When you are signed in, your recent conversation is saved on the site with your account and deleted automatically after 30 days. When you press Listen, the text of the answer or post is sent to Amazon Polly (AWS) to be read aloud.
- If you send a text message to this site’s WeChat Official Account, 物理AI Lab, WeChat (Tencent) passes it to this site and it is likewise sent to Amazon Bedrock to generate the answer; the site keeps only the last few exchanges, briefly, to understand follow-up questions.
- The site sets a functional cookie that remembers the language you chose, and login cookies only if you sign in.
- The server keeps access logs, and the login system keeps a sign-in log, both including IP addresses; both are deleted automatically after 30 days.
- We do not sell personal data or use it for advertising or marketing.
Server logs
Like almost every website, the server automatically records each request your browser makes. A log entry contains:
- your IP address;
- the date and time;
- the requested URL, including the words you type into the site search;
- the response status and the amount of data sent;
- the referring page (Referer) and your browser identifier (User-Agent).
We use these logs only to run the site, fix problems and defend it against attacks, which is our legitimate interest. We do not use them to identify you or to analyse your browsing. The logs are stored in the Tokyo, Japan data centres of Amazon Web Services (AWS) and deleted automatically after 30 days.
The site is delivered through Amazon CloudFront (a content delivery network) and an AWS load balancer. They process the same technical data while passing requests on and may keep logs according to their configuration. CloudFront servers are located worldwide; your requests are usually handled by the one nearest to you.
Accounts and sign-in with Google or GitHub
Signing in is optional. It unlocks the answers and explanations of the self-check questions in the courses and the AI assistant; all other content is public. The site has no password registration: you sign in with an existing Google or GitHub account.
When you click “Continue with Google” or “Continue with GitHub”, your browser goes to that service, where you sign in and agree to share your profile. The service then sends this site:
- Google: your email address and name;
- GitHub: your verified primary email address, your GitHub username, and the name, website and bio of your public profile, if you have filled them in.
We use these data to create and recognise your account (a WordPress account with the “subscriber” role, which can read member content but not publish anything). Your account stores these data (a username is derived from your email address), the service you signed in with, and a random password that nobody knows; your Google or GitHub password never reaches this site. The access token the service issues is used once, during sign-in, to read the data above, and is not stored. We process these data to provide the account you asked for. We do not send you email, and we do not share your account data with anyone except our hosting provider AWS.
Google and GitHub process your sign-in under their own privacy policies (Google, GitHub). You can revoke this site’s access at any time in your Google account (Security, Third-party connections) or in GitHub (Settings, Applications); this does not delete your account here.
Your account is kept until you ask us to delete it. To do so, email admin@noteflowai.com from the address of your account; we delete the account and its data, normally within 15 working days. Copies in backups disappear when the backups expire after 7 days.
Sign-in log
To protect accounts against password guessing, the login system records each sign-in and each failed attempt: the username or email address entered, the account it belongs to, the IP address, the browser and operating system (from the User-Agent), the time and the result. After five failed attempts within 30 minutes further attempts are blocked for a while. This is in our legitimate interest in keeping the site secure. The entries are deleted automatically after 30 days.
AI assistant
Signed-in users can ask the AI assistant on every page about the topics of this site. The assistant is a large language model run by Amazon Bedrock, an AWS service. Answers are generated automatically and can be wrong, so check important facts in the linked articles. Please do not enter personal, confidential or sensitive information in the chat.
When you send a message, the site sends Amazon Bedrock:
- your message and the earlier messages of the current conversation (up to 12);
- the language of the page you are on;
- passages from the site’s public articles that match your question. To find them, your question is converted into a numerical representation (an embedding) with Amazon Titan Text Embeddings in the Tokyo region. Your question and these passages are then reranked by relevance with Cohere Rerank 3.5, through Amazon Bedrock in the Tokyo region.
Your name, email address, account and IP address are not sent to the model. The main model, OpenAI GPT-6 Luna, is called through a global cross-region inference profile, so AWS may process a request in any AWS commercial region worldwide, including outside Japan. If it is unavailable, the fallback model, Anthropic Claude Haiku 4.5, answers in Japan (Tokyo or Osaka). According to AWS, Amazon Bedrock does not store prompts and answers, does not use them to train models, and does not share them with the model providers (Amazon Bedrock security and privacy).
Your conversation is kept in your browser tab’s session storage, so it stays while you move between pages of the site, and is removed when you close the tab or press Clear chat. When you are signed in, it is also saved on the site with your account (the latest 30 messages), so you can continue it on a later visit or on another device. Each message is deleted automatically after 30 days; Clear chat also deletes the copy saved on the site, and so does deleting your account, while copies in backups disappear within 7 days. You can ask to see, export or delete these conversations as described under Your rights. The server logs described above record that a chat request was made, but not what it said. To prevent abuse, each account can send up to 5 messages a minute. The counter is keyed by a hash of your account and is deleted after one minute. The site also keeps daily totals of requests and tokens per model, without recording who asked. We process your messages to answer them, and keep the conversation so you can continue it, which is the service you asked for by using the assistant.
To answer from the site’s own articles, the text of published public articles, but never the content reserved for members, is stored with its embeddings in Amazon S3 Vectors in the Tokyo region. This index contains site content, not data about visitors.
Reading aloud (Amazon Polly)
Answers from the AI assistant and the site’s posts have a Listen button. Amazon Polly, a service of AWS, turns the text into speech in the Tokyo region:
- When you press Listen under an answer, the text of that answer is sent to Amazon Polly. Only answers the assistant has just given you can be read. The audio is played in your browser and is not kept on the site.
- When you press Listen to this post, only the published text of the post is sent to Amazon Polly (never members-only content), and nothing about you; it works without signing in. The audio is kept on the site for every reader and made again when the post changes.
To prevent abuse, each account (or IP address, when you are not signed in) can make up to 30 read-aloud requests a minute. The counter is keyed by a hash and is deleted after one minute. The site also keeps a daily total of the characters read, without recording who asked. Under the AWS Service Terms, AWS may store text sent to Amazon Polly to improve the service, and may store it outside the Tokyo region. So if an answer contains something you would rather not send, don’t have it read aloud.
The AI assistant in the shop
The shop on this site only presents products; it does not take orders or payments online at the moment. To answer questions about the shop, the assistant also uses the following:
- When you ask about products, details of the products that match your question are sent to Amazon Bedrock with it, such as their names, prices, stock, options and ratings, as the shop shows them publicly. This is product data, not data about you.
- When you are signed in and ask about orders or delivery, your own recent orders, if any, are sent to Amazon Bedrock: the order number, dates, status, items, total, shipping method and tracking number. Your address, email address, phone number and payment details are never sent, and other customers’ orders are never looked up or sent.
WeChat Official Account
If you follow this site’s WeChat Official Account, 物理AI Lab, you can ask questions in WeChat without an account on this site. Your text messages are passed to this site by WeChat, a service of Tencent, and WeChat’s handling of them is covered by the WeChat Privacy Policy. This site receives only the OpenID that WeChat assigns you for this account, not your WeChat ID, nickname or phone number.
This site sends your message, up to three earlier questions and answers of the conversation, and the passages of its public articles that relate to your question to Amazon Bedrock to generate the answer, with the same models, vector search and reranking described above. So that follow-up questions are understood, your last three questions and answers are kept on this site for 30 minutes, keyed by a hash of your OpenID; if an answer is not ready within the time WeChat waits, it is kept for 10 minutes so that you can send “1” to see it. To prevent abuse, each follower can send at most 20 messages an hour, counted under a hash of the OpenID that is deleted after an hour. Images, voice and other kinds of messages are neither processed nor kept.
WeChat mini game customer service
If you open the customer service chat in this site’s WeChat mini game, WeChat, a service of Tencent, passes to this site that you opened it, the part of the game you opened it from, the messages you send in it, and your answers to subscription message prompts. This site receives only the OpenID that WeChat assigns you for the game. Questions are answered by keyword with replies the site has written, sent back through WeChat; these messages are not sent to Amazon Bedrock or any AI service.
The site keeps only daily totals, such as how many players opened the chat, how often each part of the game led there, the kinds of messages and how many accepted a subscription prompt, for 90 days. Players are counted under a code made at random each day and discarded when the day ends, and no OpenID is kept; so that you are not welcomed twice, a code made from your OpenID is kept for 12 hours. If the site keeps a conversation log, your questions are stored there too, without your OpenID.
Cookies
| Name | Purpose | Expires |
|---|---|---|
pll_language | Remembers the language you chose (中文, English or 日本語); contains only the language code | 1 year |
wordpress_test_cookie | Set only on the login page, to check that the browser accepts cookies | When you close the browser |
fs_auth_state | Set when you start signing in with Google or GitHub; a random value that protects the sign-in against forgery | 15 minutes |
fs_intent_redirect | Set when you start signing in; remembers the page to return to afterwards | 1 hour |
aicfabPopupOpen (session storage in your browser, not a cookie) | Remembers whether the chat panel is open while you move between pages; contains only 1 or 0 and is never sent to the server | When you close the tab |
aicfabChat:… (session storage in your browser, not a cookie) | Keeps the current conversation so you can continue it after moving to another page of the site; set only when you are signed in and use the AI assistant | When you close the tab or press Clear chat |
wordpress_logged_in_…, wordpress_sec_… | Keep you signed in; set only after you sign in and removed when you log out | 14 days |
Visitors who do not sign in receive only the first cookie, and the session storage entry if they open the chat panel. You can delete or block these cookies in your browser at any time. The site still works; you then choose the language through the address or the menu, and you cannot stay signed in.
External links
Articles link to other websites such as GitHub, arXiv, Hugging Face and PyPI. Once you follow such a link you leave this site, and that website’s own privacy policy applies.
Hosting and where data is stored
The site is hosted on AWS. Its content, accounts (including saved conversations), read-aloud audio and logs are stored in Japan (Tokyo region), and messages to the AI assistant are processed as described above; the database and file storage have automatic backups kept for 7 days. AWS processes this data on our behalf as a service provider. If you visit from mainland China, Europe or elsewhere, your data is transferred to Japan and to the location of the CloudFront server that handles your request.
Your rights
You may ask to access, copy, correct or delete data about you, or object to its processing. If you have an account, write from its email address. For log entries, which contain only technical data such as IP addresses, please tell us your IP address and roughly when you visited so that we can find them. We reply as soon as we can, normally within 15 working days. You also have the right to complain to the data protection authority where you live.
Children
The site is written for technical readers, is not directed at children, and does not knowingly collect children’s personal data.
Changes
If the way the site handles data changes (for example, if comments or new sign-in options are added), we will update this page first and change the date at the start of this page. This policy is available in 中文, English and 日本語 with the same content.
Contact
For questions about this policy or your personal data, email admin@noteflowai.com.