Privacy Policy

1. What we collect

Account information: your email address, your name, your profile picture if your Google or GitHub account provides one, how you sign in, whether two-factor authentication is on, and when you accepted these policies. If you join the waitlist, we keep your email address, your browser's language and the status of your invitation.

Your content: the messages in your thread and its background runs, your memory, outlines, files, assets, pages, the files in your cloud computer, and the browser sign-ins you save for the agent.

Credentials: the provider API keys, secrets and connector credentials you give the agent.

Usage and billing: which models you use, token counts, costs, wallet top-ups and charges, and an activity log of what the platform did for you.

Technical information: the IP address and browser of each signed-in session, the API keys you create and when they were last used, and a security log of sign-in events in which IP addresses and browsers are stored only as one-way hashes.

2. How we use it

We use this information to run the service for you: to sign you in and keep your account secure, to give the agent your thread and memory so it can work for you, to carry out the actions you ask for, to charge your wallet, to send you sign-in and waitlist emails, to fix problems, and to prevent abuse. We do not use your content for advertising.

3. How your content reaches AI models

To answer you, the agent sends the relevant parts of your thread, memory and files to the model you choose. If you use your own provider key, the request goes to that provider under your account and your agreement with it. If you use our platform key, it goes to that provider, or to OpenRouter for models we reach through it, under our account. If you use a subscription with a provider through its own software on your device, we never read that software's credentials.

We do not use your content to train models. What we send to a model provider or to any other service provider in this policy is handled under that company's own data policies; when you use your own key or subscription, the terms between you and that provider apply.

To make memory work, we process your memory and search queries with models we run on Cloudflare Workers AI and with TypeSafe, which we use to judge what to remember and recall. TypeSafe also helps choose models for background runs and decide when to speak in voice calls.

Voice audio is sent to the speech provider set up for you, OpenAI or ElevenLabs, to be transcribed or spoken, and is not stored by us. What you said becomes part of your thread as text.

4. How we protect your credentials and files

Your provider keys, secrets, connector credentials and saved browser sign-ins are encrypted with a public key that belongs to you before we store them. They are decrypted only in memory, for the time you have authorized, and your provider keys are only ever used to forward requests to the provider. Files in your file center are encrypted the same way, together with their names and details.

Your thread, memory, outlines and assets are stored so the service can read them, because the agent needs them to work. By default, our admin tools show only account details, counts and costs. Only when you ask us for help, when we investigate abuse or a security incident, or when the law requires it, do authorized staff access your account, which can include signing in as you to look into a problem.

5. Who we share it with

When you connect a service to the agent or publish a page, the information you choose to send or publish goes to that service or to the people who can see that page. We may also disclose information when the law requires it, to protect people or the service from harm, or as part of a merger or acquisition, in which case this policy continues to apply.

Beyond that, we share information only with service providers that help us run Anyknown, and only what each one needs:

• Cloudflare, which hosts the service, its databases, file storage, cloud computers and the browser the agent uses, and protects our forms with Turnstile;
• model providers, which receive the requests described in section 3: Anthropic, OpenAI, Google, xAI, Baseten, Fireworks, Cloudflare Workers AI (on our Cloudflare account, or on your own account and AI Gateway if you connect one), and OpenRouter for other models;
• TypeSafe, for memory and model selection;
• OpenAI and ElevenLabs, which receive your voice audio to transcribe and the text to speak when you use voice;
• Polar, which processes payments and receives your payment details directly;
• Resend, which delivers our emails;
• Sentry, which receives error reports; we remove request headers, cookies, request bodies and your identity from them, but an error message itself can contain fragments of content;
• Google, GitHub or your organization's single sign-on provider, if you sign in with them.

6. How long we keep it

We keep your account and your content while your account exists; the last paragraph of this section explains what happens when it is deleted. Memory is append-only: new entries add to or correct older ones instead of overwriting them, and periodic summaries keep the originals.

Some data has a shorter life. Activity log entries move from our live database to archive storage after 90 days. Records of when your provider keys were used are deleted after 90 days. Backups of your cloud computer's files expire after seven days. Sessions expire after seven days without use. Voice audio is not kept at all.

When your account is deleted, we delete your sign-in data: your account record, sessions, linked sign-in methods, two-factor settings and API keys. We do not currently guarantee that the content you stored is deleted with it. Memory is append-only by design, so its entries are not deleted, and your threads and archived activity log are kept as well. We keep wallet records as accounting rules and the law require, and the hashed security log to prevent fraud.

7. Your choices and rights

You can see your thread, memory, activity log and usage in the app, and you can remove provider keys, secrets, saved browser sign-ins and connected services at any time. You can change who can see a page you published. To correct your memory, tell the agent; it records the correction as a new entry.

There is not yet a way to delete your account from the app. To delete your account, or to ask for a copy of your data, email privacy@anyknown.com from the address on your account. We will confirm the request with you, then delete your account as described in section 6.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable form, and to complain to a data protection authority. Email us to use any of them.

8. Cookies and local storage

We use cookies only to keep you signed in and secure your account; we do not use advertising or cross-site tracking cookies. Your browser's local storage remembers your language. Our website may use Cloudflare Web Analytics, which counts visits without cookies.

9. Where your data is processed

Anyknown runs on Cloudflare's global network, and our service providers process data in the United States and other countries. Wherever your data is processed, we protect it as described in this policy.

10. Children

Anyknown is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

When we make a material change, we publish the new version with a new date, and you will be asked to accept it the next time you sign in.

12. Contact

privacy@anyknown.com