Privacy Policy

Effective date: October 22, 2026

[Seller legal name, registered address and governing law: pending from owner]

Fluf is provided by the seller named above. We are responsible for personal data we process to operate the Fluf account and related services. Email hello@fluf.bot about this policy or your rights.

Your bots run on your computer

Fluf v1 runs your bots on your computer. Conversations, bot memory, skills and local working files are stored there, not on our servers. You decide which AI providers and tools to connect and what work to give them.

Local execution does not mean that all processing is offline. Model requests, including relevant prompts, conversation context, files, tool output and screenshots when needed, are sent from your machine to the AI providers you connect. Those providers process the requests under their own terms and privacy policies. Connected apps, websites and tools receive the information needed for the actions you authorise.

When you choose Codex or Anthropic’s Claude Code, Fluf runs the installed app, signed in with your own account. Sign-in is handled by the installed CLI through the provider’s own flow. Fluf does not extract, store or proxy the provider OAuth tokens held by those CLIs. API connections use the operating system’s credential store.

Information used to operate Fluf

We process account identifiers, email address, authentication records, licence status and billing records to provide your account and plan. Stripe processes payments. We receive payment status, subscription details and billing information needed for customer service and accounting, rather than your full payment-card details.

Resend sends account and service email. Cloudflare R2 provides release downloads. Hosting and security infrastructure can process IP addresses, request metadata and operational logs needed to deliver and protect these services. Our account services are not a central store of your bot conversations or memory.

If you contact support, we receive the information you choose to send. Redact private task content and credentials before sharing screenshots or logs. We do not ask for passwords, API keys or authentication codes.

Optional analytics

With your consent, we use PostHog’s EU service for product analytics in the Fluf app. It is off until you turn on Share anonymous usage in the Fluf app under Settings › Privacy, and you can turn it off there at any time. The website itself runs no analytics. Session replay is off. Leaving analytics off does not limit the core service. We do not intentionally include prompts, working files, secret keys or private conversation content in analytics events.

We do not sell personal data. We do not use your data to train AI models. The AI providers you choose have their own data-use policies; review them for the connection and account you use.

Telegram

If you connect a bot to Telegram, Telegram processes the messages, media and account identifiers sent through its service. Each contact is linked to the bot you pair. Disconnecting a contact in Fluf does not remove messages already held by Telegram or other recipients.

Why we process information

We process account and licence information to perform our contract with you. We use consent for optional analytics and optional marketing. We process security and reliability records for our legitimate interests in protecting the service, balanced against your rights. We retain records required for tax, accounting and other legal obligations. You can object to processing based on legitimate interests where applicable.

Service providers and transfers

Our subprocessor list explains the service providers used for account, payment, email, download and analytics functions. Access is limited to the purposes for which information is provided. Where personal data is transferred internationally, we use the legally required safeguards, including adequacy decisions or standard contractual clauses when applicable. Email hello@fluf.bot for details relevant to your information.

Your chosen AI providers and connected tools also have their own locations, safeguards and terms. They are not all covered by a single Fluf hosting location.

Retention and deletion

Local bot data stays on your computer until you remove it or the relevant local retention settings apply. Uninstalling the app does not by itself cancel billing, close your account or establish that all local files were erased.

We keep account data while needed to provide the service, resolve support requests and meet legal obligations. Billing and tax records are retained for the period required by applicable law. Security logs and backups are kept only as long as reasonably needed for their purpose. Email hello@fluf.bot from your account email for the applicable retention schedule or to delete your account.

Deleting an account does not delete records that we must retain by law or information held independently by an AI provider, Telegram or another connected service. We restrict retained information to the purpose that requires it.

Your choices and rights

Depending on the law that applies, you may request access, correction, deletion, restriction, portability or an objection to processing. You may withdraw consent without affecting earlier lawful processing. Email hello@fluf.bot and identify the account involved. We may verify your identity before acting.

You may complain to your local data-protection authority. We do not reduce rights that applicable law gives you. Keep backups of local work you need before deleting it.

Security and children

We use technical and organisational measures intended to protect information, but no system eliminates every risk. Protect your computer, connected accounts and credentials. Report a suspected security issue to hello@fluf.bot without including secret values.

Fluf is not directed to children under 16. If you believe a child has provided personal information without the required permission, email hello@fluf.bot.

Changes

We update this policy when the service or our practices change. The effective date identifies the current version. We provide additional notice where required.