Privacy and data handling

Scope and contact

You may hatch and try CrowBot without creating an account. The visitor introduction uses a browser session and a server-side usage record for its free staged allowance. Your guest crow, memories, media and sensor choices are stored separately on this device; guest brain records are not synchronized to an account. If you choose to create a new account, CrowBot copies that guest crow into the new account and carries over used introduction time. Signing into an existing account does not automatically overwrite its crow with the guest crow.

This notice covers the existing CrowBot website and web app. Independently owned copies use their own installation, infrastructure and provider accounts. This notice does not replace the separate privacy terms of Stripe, Cloudflare, OpenRouter, Groq, Fish Audio, an installation's configured AI service, your browser, operating system, internet provider, or a local/private model service.

Information kept in your browser

The Doctor records a local diagnostic timeline of app actions, state changes, request outcomes and errors, without field values, private messages, credentials, recordings or photos. It retains up to 2,000 events for 48 hours in this browser, subject to a storage limit. It does not send this log to a telemetry service. In Settings, open Doctor & diagnostics to inspect, export, clear or pause it. Exports are separate downloaded copies. The report identifies storage failures, dropped events and events the browser cannot observe.

CrowBot can keep the following in the browser profile you use:

• an opaque account namespace and that account’s creature identity, name, owner name, wants, rules, facts, mood, dreams, conversations, diary, body settings, and interface state in local storage and IndexedDB;
• the life clock, Crow-age calculation, Sleep schedule and progress, and versioned local permission for foreground autonomy;
• selected historical photo bytes and their context in Origin Private File System storage;
• an optional user-selected readable brain folder and JSON or Markdown files you export;
• provider/model settings and, only if you explicitly choose “remember”, provider credentials in local storage rather than session storage;
• a non-extractable device key, signed offline authorization, and clock high-water record in the local entitlement database; and
• same-origin application files in Cache Storage for supported offline loading.

Ordinary brain capture and account sync exclude provider keys and tokens, raw microphone audio, embedded image/photo data, complete provider payloads, body pairing secrets, and continuous sensor telemetry. Normal brain exports exclude photo bytes and provider credentials. Files you export or mirror are under your control.

CrowBot accounts use your own email address and a password you choose; native passkeys are optional. CrowBot never keeps your password itself: the Worker stores a salted verifier, receives no authenticator private key, and keeps neither in browser storage. Account switching saves and syncs, clears live account credentials, changes namespace, and reloads.

Private Gallery

Private Gallery encrypts its media and captions in this browser. Unlocking requires online verification of your signed-in account's current password and the account's configured multi-factor protection. A separate random encryption key is kept with your account on CrowBot's server; private media bytes are not uploaded by this feature. Password resets do not replace that key.

Closing Gallery, hiding the page, signing out or leaving Private idle locks it and clears the unlocked key from page memory. Private items do not appear in ordinary Gallery, photo recall or Brain Archive. Use Private Gallery's separate encrypted export and restore with the same account; keep that export before clearing site data. Removing the account or its server key can make encrypted copies unreadable.

Moving an item to Private cannot erase earlier downloads, backups, conversations or copies already sent to a selected AI provider. It protects the item's future use in this Gallery; it does not undo that earlier use.

Clearing the activity log clears only that extra log. It does not erase the durable local brain, saved photos, exported files, provider-held data, payment/access records, or the paid-offline key. Browser “clear site data” controls are the current whole-origin local deletion route, but using them can also remove your local brain, recovery state, and offline access.

Information processed by CrowBot’s Worker and database

D1 does not contain payment-card details; Stripe handles payment details. D1 stores your account email address for sign-in, verification and password recovery, and keeps only keyed hashes in email-delivery records. Account sync stores sanitized creature/person names and text memories, but not provider credentials, OAuth/session tokens, raw media, sensor streams, pairing secrets, or complete provider payloads. Private Gallery's separate random account-held encryption key is server-side; its media and captions remain encrypted locally. This key and the installation's encrypted server provider keys are separate from brain records and ordinary brain exports.

AI, speech, image, and search providers

Only use content you are comfortable sending to the active route. The exact recipient depends on the feature, access, saved choices and installation configuration. Hosted customers use the installation's configured AI; independently owned installations control their own compatible providers. Ordinary recognition and speech use the native browser/device route. Recorded cloud audio requires its selected feature and consent; it is not a silent fallback.

OpenRouter’s current public documentation says its own prompt/output logging and product-improvement use are off by default unless enabled, while request metadata is stored and underlying model-provider practices vary. CrowBot does not convert that general statement into an account-specific guarantee. Review OpenRouter’s data-collection documentation and the current policy for the exact model endpoint before sending private or confidential content.

Camera, microphone, movement, and location

• Microphone audio is held in memory for the active transcription operation, bounded by request limits, and released when the operation ends. Recorded-audio transcription sends that recording to the selected route.
• Live camera frames are processed in memory. Local brightness, frame-difference, and optional face-presence calculations do not themselves upload a frame. Vision sends a fresh or deliberately selected image to the active model route.
• Motion and orientation values are held in bounded runtime buffers and can be summarized for the active model path.
• The Initial Release does not intentionally request browser geolocation or GPS.

Browser or operating-system permission controls can refuse or revoke camera, microphone, motion, or speech access.

Foreground autonomy is a local opt-in and is off by default. The accepted daytime Lab can display foreground-only local brain capture/consolidation and never calls a model. Hiding the web page stops sensor/model autonomy: CrowBot does not listen, watch, speak, or call a model while hidden. Age and schedules recalculate when reopened. Any future background mode needs separate permission and disclosure.

Why information is used and disclosed

CrowBot uses the information above to run the local creature, enforce the trial and paid access, fulfil and recover purchases, operate chosen AI/speech/image features, prevent abuse, investigate failures, protect security, process refunds and disputes, and meet legal obligations. It is disclosed only as required for those functions, to the service selected for a request, or where disclosure is required by law.

Cloudflare, Stripe, OpenRouter, Groq, Fish Audio, browser/OS services, and other selected providers can process data outside Australia. Exact countries and subprocessors depend on the provider, route, and current account configuration. CrowBot does not promise Australian-only processing.

Retention and deletion

Browser data remains until overwritten, cleared, evicted, or exported files are removed. The synchronized soul/text brain remains in D1 while the account is active or until verified deletion, subject to backup and required-record limits. Provider retention follows provider settings.

CrowBot’s bounded scheduled cleanup is designed to remove short-lived application metadata on these maximum inactivity or age windows:

• session-creation rate windows: 2 hours;
• offline-authorization issuance windows: 2 days;
• unlock-attempt windows: 1 day;
• aggregate provider-usage days: 90 days;
• failed or expired checkout attempts: 90 days;
• unreferenced anonymous sessions: 7 days after inactivity;
• visitor trial bindings: 365 days after inactivity; and
• completed or revoked premium activation records: 365 days.

Hourly bounded cleanup removes expired/used passkey challenges, account attempt windows after 2 days, expired/revoked sessions after 30 inactive days, and sync-replay rows after 365 days. Replay history is also capped at 512 rows per account. Active account, licence, passkey, recovery, and brain data remains while needed.

Support tickets and messages are deleted by bounded scheduled cleanup 2 years after the ticket’s last activity. There is no separate legal-hold exception in the Initial Release. Successful purchase, licence, installation-slot, refund, dispute, recovery-audit, fraud-prevention, and accounting records can be retained longer while reasonably needed to provide access, resolve claims, prevent abuse, keep financial records, or meet legal obligations. Cloudflare logs and backups, Stripe records, and provider records have separate retention.

Active membership, gift, source-package, Community and installation-configuration records are separate from the short-lived metadata listed above. Clearing a local log, deleting a brain record or disconnecting a community does not delete those server records, backups or third-party copies. Use the private support route for verified access, correction or deletion requests; a submitted request or local Clear action is not confirmation of account-wide deletion.

Your choices and requests

• Use browser speech/voice or a local/private model where supported instead of a hosted media route.
• Do not enable “remember credentials” on a shared browser. Clear a saved key from CrowBot and rotate it at the provider if exposure is suspected.
• Read or export the local brain before clearing site data. Delete exported or mirrored files separately.
• Add a second passkey and save the one-use recovery codes. CrowBot stores keyed hashes only and has no owner recovery backdoor.
• Use the account panel to revoke browsers, attach a licence, refresh recovery codes after passkey verification, or switch accounts.
• Use the licence panel to remove an old browser/device installation and to save or rotate the recovery code.
• Use the private support route to request access to, correction of, or deletion of CrowBot-held personal information, or to make a privacy complaint. Identity and purchase ownership may need to be verified before account-linked information is changed or disclosed.

Information about Australian privacy policies, access, correction, and complaints is available from the Office of the Australian Information Commissioner.

Security and changes

Controls include HTTPS, exact account origins, verified passkeys, one-use challenges/codes, hashed sessions, account-scoped storage, bounded revisioned sync, restrictive headers, signed account/licence/device offline authorization, size limits, allowlists, rate limits, and fail-closed payment checks. No system is risk-free. See Security.

Do not send another person’s personal or sensitive information without authority.

This notice will be updated when a material data path, provider, support process, or retention period changes. The effective date at the top identifies this version.