Last updated 9 October 2026
The short version. You bring your own AI key. Your key and your conversations stay in your browser and go straight to Anthropic or OpenAI — they never pass through us and we could not read them if we wanted to. We have no accounts and no logins. The exceptions are listed below, and the biggest one is the $19 Business embed, where messages do pass through our server.
On the entity pages, everything happens in your browser:
We also self-host our fonts, so loading a page does not tell Google you were here.
Local storage, on your device only, readable by nobody but you:
Clearing your browser data removes all of it. On the entity pages, “forget key” removes your key immediately.
If you are a visitor on someone else's website talking to an embedded entity, your messages do pass through our server, because the site owner is paying for the conversation with their own AI key. We relay the message to the AI provider and hand back the reply. We do not store the content, but we are in the path — which is the honest difference from using an entity on this site.
If you run an embed: your provider key is stored encrypted with us so your visitors never need one of their own. File attachments and webhooks are switched off in embeds entirely.
The $4.99 Companion runs on your own computer and makes no outbound network requests
at all. It reads the session logs Claude Code and Codex already keep on your machine —
timestamps, token counts, model and tool names, project folder names — and never the text
of your prompts or replies. Its dashboard is served to 127.0.0.1, so nothing
outside your machine can reach it. Deleting the folder removes it completely.
Each download is stamped with a one-way hash of the subscription it was issued to, so a copy posted publicly can be traced back. The hash is not your name, your email or your key, and the Companion never reads or checks it.
Pages on this site load Google's advertising tag (AW-969457450) so we can
tell whether an ad led to a subscription. It sets cookies and shares a page view with
Google, which is the one place a third party learns you visited.
Alongside page views we count a few steps, so we can see where people give up: opening an entity, saving a key, sending a first message, viewing a product or pricing page, and clicking through to checkout. Each records only that the step happened — which entity or which product, never a word of your messages, never your key or any part of it, never your email.
None of this runs inside an embedded entity. If you are talking to a companion on someone else's website, nothing is reported to us about you — that widget belongs to the site owner, and their visitors are not our users.
We use no other analytics, no session recording and no cross-site profiling. You can block it with any content blocker and the site works exactly the same.
This is not a service for children, and it needs an API key from a paid developer account to do anything. We do not knowingly collect anything from anyone under 13.
If this policy changes in a way that matters, the date at the top changes with it. Questions, or a deletion request, go through the request form — a person reads it.