Privacy policy

This policy explains what Llamabyt (“Llamabyt”, “we”, “us”) collects when you use the website at llamabyt.ai, the app at app.llamabyt.ai and the Llamabyt Mac app, why, who else handles it, how long we keep it, and what you can do about it. Llamabyt is run from El Salvador. For anything about your data, write to hello@llamabyt.com.

In short: we collect what we need to run Llamabyt for you. We don’t sell your data, we don’t show ads, and we don’t use your content to train AI models. When a llama works, the content it needs goes to the AI provider you chose. The app and the website don’t use analytics or advertising cookies.

1. What we collect, and why

Your account

• Your name, email address and time zone; a password, stored only as a scrypt hash; and, if you sign in with Google, your Google account’s ID, name and email.
• Your sign-ins: each session, with the browser or app it’s on (its user agent), and when you last used Llamabyt. We use these to keep you signed in, to show you and us where your account is open, and to keep it safe.

Where you came from. When you sign up, we keep the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign), the name of the site that sent you (like google.com, never the full address), the first page you opened, and whether you used an invite or an access code. This tells us which ways of finding Llamabyt work.

What you and your team put in Llamabyt, in the workspaces you belong to: messages and threads, projects and tasks, files you share or keep in cloud copies, Canvas items, the Brain’s pages and journal, your llamas’ missions and notebooks, and each llama run (the steps it took, what it made, and, for cloud runs, what it cost). This is content your workspace owns, and we handle it to run Llamabyt for you (see section 5).

Your Macs. Each Mac you connect: its name, the Mac app’s version, which AI tools are installed (like Claude Code or Codex), when it was last online, and the folders you share: their names, paths and settings. Files leave your Mac only if you turn on a cloud copy.

API keys you or your company add: encrypted with AES-256-GCM before they’re stored, never shown again, and used only to run your llamas.

Billing. Your plan, seats, billing interval and dates, the access codes you used, and the ID Paddle gives you as a customer and your subscription. Paddle, our reseller, handles your payment details; we never see your card number.

Yarvi, the guide llama

• To answer a question, we send it, with the conversation so far and a note of who’s asking (your name, your plan, your role in the workspace and the page you’re on), to the AI provider that answers for Yarvi. We don’t store the conversation: it stays in your browser tab while it’s open.
• We count your questions and your minutes of voice each day and month, with what they cost us, to apply your plan’s allowance.
• Voice calls go to ElevenLabs, which turns your voice into text and Yarvi’s answers into speech, and keeps a record of the call under its own retention settings. We keep the call’s ID and length.

Notifications. If you turn on notifications on a device, we keep the address your browser’s push service gives it and the keys that encrypt what we send, with a description of the device.

Email. We send emails to confirm your address, reset your password, invite people and warn about AI budgets. Our email provider handles your address and those messages.

When you write to us, we keep what you send so we can help.

Technical data. Your IP address is used while a request is handled, to protect sign-in and other forms from abuse; we don’t store it with your account. Our hosting provider keeps server logs, including errors, for a limited time.

2. How we use it

• To run Llamabyt: your account, your workspaces, your llamas, your Macs, billing and support.
• To keep it safe: stopping abuse and fraud, and suspending accounts that break our acceptable use policy.
• To improve it, from counts rather than content: for example how many people signed up, which plans they use and where they came from.
• To tell you about your account and changes to Llamabyt or these policies.

We don’t sell your data, we don’t use it for advertising, and we don’t use your content to train AI models.

Where the law asks for a legal basis (for example in the EU or UK), ours are: the contract with you, to provide Llamabyt; our legitimate interests, to keep it safe and to improve it; your consent, for notifications and the microphone, which you can withdraw any time; and legal obligations.

3. AI and your content

• Your llamas. When a llama works, the content it needs (the conversation, the task and project, relevant Brain notes, and files from folders you shared) goes to the AI provider you chose: to Anthropic through an API key in the cloud, or to Claude Code or Codex on your Mac, under your own account with Anthropic or OpenAI. Under an organization’s company-key rule, llamas on Macs reach Anthropic through Llamabyt, with the company’s key; we pass the requests on without keeping them and record what they cost. The provider’s own terms and privacy policy apply to what it receives.
• Yarvi answers with xAI (Grok), or with Anthropic (Claude) if we switch, and speaks through ElevenLabs.
• Connected apps. Llamas on your Mac can use the connectors you set up in Claude Code or Codex. Anything that would send, change or delete waits for your Allow in the chat, and that request is kept in the conversation.

4. Who else handles your data

We use these service providers to run Llamabyt. Each handles data only to provide its service to us.

Your data is also seen by the people you work with in Llamabyt, as your workspace’s settings allow: members of your workspace, guests in the projects shared with them, and the owners and admins of an organization. We may share data if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of Llamabyt, under this policy.

5. Organizations

In an organization, the company decides who’s in and what happens to the workspace’s content, and we process that content on its behalf. Requests about an organization’s content go first to its owners and admins. Companies that need a data processing agreement can write to us.

6. Where your data is

Llamabyt stores data in the United States, and some providers process it elsewhere as listed above. When data leaves your country, we rely on the protections the law provides for that, such as standard contractual clauses where they apply.

7. How long we keep it

• Your account and content: while your account is open. If you ask us to close it, we delete your account and the content only you could see within 30 days. Messages and other content you shared in a workspace stay with that workspace for its other members, unless the workspace is deleted.
• Workspaces: until their owner deletes them, or until the account that owns them is closed.
• Backups our database provider keeps are replaced on a rolling basis, and we don’t restore deleted accounts from them.
• Billing records are kept by Paddle as the tax laws require.
• Yarvi’s usage counts are kept as daily and monthly totals, with your account.
• Server logs are kept by our hosting provider for a limited time.

8. Keeping it safe

Everything travels over HTTPS. API keys are encrypted, passwords and session tokens are stored only as hashes, workspaces are kept apart, and our staff tools show accounts and plans, not your workspaces’ content, logging everything staff do in them. Privacy and security has more.

9. Your choices and rights

• See and correct: most of your data is in the app, in your profile and settings.
• Export: download Canvas items, export your Brain as an Obsidian vault, or ask us for a copy of your data.
• Delete: ask us to close your account and delete your data.
• Say no: turn notifications off, don’t allow the microphone, or object to how we use your data.
• Complain to the data protection authority where you live, if you think we got something wrong. We’d like the chance to fix it first.

Write to hello@llamabyt.com from your account’s email address, and we’ll answer within 30 days.

10. Cookies and storage in your browser

We don’t use cookies for analytics or advertising.

• The app uses one cookie to keep you signed in (for 30 days), and one while you sign in with Google (for 10 minutes). It keeps small things in your browser’s storage: your theme and view choices, the last workspace you opened, notices you dismissed, an access code you typed while signing up, where you came from, and Yarvi’s conversation in the open tab.
• This website uses no cookies. It keeps where you came from in your browser’s storage for 60 days, so your sign-up can say so.

If we ever add analytics, we’ll update this policy first, and ask for your consent where the law requires it.

11. Children

Llamabyt isn’t for anyone under 18, and we don’t knowingly collect data from children. If you think a child has an account, tell us and we’ll delete it.

12. Changes to this policy

We’ll post changes here with a new date. If a change is significant, we’ll tell you by email or in the app before it takes effect.

13. Contact

For anything about your data: hello@llamabyt.com.