← Entitees AI Entities · Pricing · Integrations

Privacy

Last updated 9 October 2026

The short version. You bring your own AI key. Your key and your conversations stay in your browser and go straight to Anthropic or OpenAI — they never pass through us and we could not read them if we wanted to. We have no accounts and no logins. The exceptions are listed below, and the biggest one is the $19 Business embed, where messages do pass through our server.

What never reaches us

On the entity pages, everything happens in your browser:

Your API key. Saved in your browser's local storage and sent only to the AI provider it belongs to. There is no copy on our servers.
Your conversations. Messages go directly from your browser to Anthropic or OpenAI. We are not in the path.
Anything you attach. A dropped file or pasted screenshot goes to your AI provider on your key, the same way.
Screen watching. When CLUTCH, NYX or Dr. Eva 2.0 watch your screen, frames go to your AI provider and nowhere else. Nothing is recorded or stored.

We also self-host our fonts, so loading a page does not tell Google you were here.

What stays in your browser

Local storage, on your device only, readable by nobody but you:

Your API key, and your ElevenLabs key if you add one
Which voice each entity should use, and whether voice is on
Your webhook URL, if you set one
How often the watchers should comment
A cached yes/no for a licence, so we do not re-check it on every page

Clearing your browser data removes all of it. On the entity pages, “forget key” removes your key immediately.

What we do store

Subscriptions. If you buy something, Stripe handles the payment and holds your email and billing details. We store a licence key and, for Business licences, the domain it is activated for. We never see your card number.
Rate limits. A one-way hash of your IP address, so one visitor cannot flood a shared endpoint. The hash cannot be reversed to an IP, and it expires.
Download counts. One record per Companion download, whose entire value is the number 1. Nothing identifies who downloaded.
Spend metering, Business only. Token and cost totals per licence, so the monthly cap works. Totals, not content.
What you send us deliberately. If you fill in the request form, we get the email address and message you typed.

The Business embed is different

If you are a visitor on someone else's website talking to an embedded entity, your messages do pass through our server, because the site owner is paying for the conversation with their own AI key. We relay the message to the AI provider and hand back the reply. We do not store the content, but we are in the path — which is the honest difference from using an entity on this site.

If you run an embed: your provider key is stored encrypted with us so your visitors never need one of their own. File attachments and webhooks are switched off in embeds entirely.

The Companion download

The $4.99 Companion runs on your own computer and makes no outbound network requests at all. It reads the session logs Claude Code and Codex already keep on your machine — timestamps, token counts, model and tool names, project folder names — and never the text of your prompts or replies. Its dashboard is served to 127.0.0.1, so nothing outside your machine can reach it. Deleting the folder removes it completely.

Each download is stamped with a one-way hash of the subscription it was issued to, so a copy posted publicly can be traced back. The hash is not your name, your email or your key, and the Companion never reads or checks it.

Advertising and cookies

Most pages on this site load Google's advertising tag (AW-969457450) so we can tell whether an ad led to a subscription. It sets cookies and shares a page view with Google, which is the one place a third party learns you visited. It is on the marketing pages, not inside the entity chat.

We use no other analytics, no session recording and no cross-site profiling. You can block it with any content blocker and the site works exactly the same.

Who else is involved

Netlify — hosting and our serverless functions. Standard server logs.
Stripe — payments and subscriptions.
Google — the advertising tag described above.
Anthropic / OpenAI — whichever your key belongs to. Their privacy terms apply to your conversations, not ours.
ElevenLabs — only if you add a key for voices.
Slack, Discord, Teams, Zapier, Make, IFTTT — only the specific reply you choose to send, only when you click send.

Children

This is not a service for children, and it needs an API key from a paid developer account to do anything. We do not knowingly collect anything from anyone under 13.

Your choices

Clear your browser data to remove everything held locally.
Block the advertising tag; nothing breaks.
Cancel a subscription any time from the Stripe billing portal.
Ask us to delete anything you have sent us, via the request form.

Changes

If this policy changes in a way that matters, the date at the top changes with it. Questions, or a deletion request, go through the request form — a person reads it.