Privacy notice

01Who is responsible

Joe Mather, operating under the name Locale, is responsible for the account, security and product data described here. Contact accounts@uselocale.dev or write to Locale, 2205 W 136th Ave, Ste 106 PMB 10071, Broomfield, CO 80023-9306, United States. This notice covers Locale's website, account services and Agent. Separate providers you connect have their own notices. Where Locale processes organization content on that organization's instructions, that organization may also have responsibilities to affected individuals.

02Account, billing and support data

We process your name, email, password hash or linked sign-in identifier, session identifiers, authorized devices, permissions, plan details, payment references, usage, support correspondence and security records. This enables access, account recovery, billing, abuse prevention and support. Stripe collects payment details directly; Locale receives payment status and necessary billing references, not your full card number. We receive linked account information from sign-in providers and verified billing events from Stripe. Do not send secrets or unnecessary sensitive information to support.

03Local work and remote requests

Browser chat history and Sandbox files are stored on your device. The Agent reads authorized folders and resources and performs approved operations. Local model processing stays on your hardware unless you use a network tool, remote model or transfer feature. Signing in alone does not upload your local history. When you send a remote request, the selected provider receives the submitted messages and relevant context, including selected files, tool results, images or other attachments. A local file can therefore leave your device when included in a remote request. Provider connections use their own authentication and terms.

04Optional history and file storage

Enabling cloud sync stores provider-neutral chat history and memory on Locale's servers and synchronizes it to signed-in devices. This copy is encrypted at rest using account-bound keys controlled by Locale; it is not end-to-end encrypted. Optional Agent file caching stores encrypted copies of repeatedly used text excerpts for up to 15 minutes, with cleanup normally running each minute. It stores content hashes for lookup, is limited to 8 MB per account and the storage quota, and clears active copies when disabled. Original device files are not a general cloud file mirror. Turning off sync stops synchronization but does not itself erase an existing cloud copy. Request deletion or export through the available controls or support.

05Shared team content

Sharing uploads the selected chat or project to Locale's servers, where current team members can read and edit the shared content. Shared records and team Messages use server-managed encryption at rest, not end-to-end encryption, and count against the owner's applicable storage allowance. Shared messages identify their author; membership, pool and ownership changes are recorded in team activity. Choosing Share commit also uploads that committed browser file version, including binary files; previous shared versions remain available until the shared item or team is deleted, subject to applicable retention. These files require the owner's file-storage entitlement and count against that quota. Joining or opening a team does not automatically upload device folders. Connected members can see who has a shared chat open and a temporary typing indicator, without receiving unsent draft text. Model requests in shared chats include member names and roles and the available chat-presence snapshot. Owners and admins can read team usage totals by member, model and day; ordinary members see their own usage. Reports do not include prompts or replies. Personal memory, provider keys and device folders are not shared by joining a team. Removing a member ends server access on subsequent requests but cannot erase copies they already obtained. Ownership transfer preserves the team's shared records under the new owner. Deleting a team removes its active shared records; applicable backup and billing retention still apply.

06Contacts and invitations

Contact invitations store the email address you enter and expire after seven days. Requests appear inside Locale; invitation email is not sent. The sender sees a pending invitation whether an address matches an account or not, and declining does not reveal that an account exists. A recipient sees the sender's name and email. Accepting shares both people's account name and email and adds each to the other's contacts. Removing a contact removes that connection for both people without changing existing team membership. Contact records are included in account export and removed from active contact lists when an account is deleted. Account registration remains invite-only.

07Temporary turn recovery

Account-hosted turns keep an encrypted recovery log on Locale's servers while running and for up to 15 minutes after ending. It contains visible output, tool events, usage and routing metadata so an authorized viewer can reconnect after a browser or service interruption. Expired logs are removed on access, and cleanup normally runs each minute. A service restart interrupts unfinished model work without automatically repeating it. Optional saved account history uses the separate history-storage controls.

08Locale Inference and caching

Locale forwards account inference through Vercel AI Gateway or another enabled gateway, such as OpenRouter, to eligible providers for your selected model. Premium Anthropic and OpenAI requests go directly to their providers under Locale's server-held API keys. Zero data retention is enabled by default in account privacy settings. Explicitly turning it off allows retention-permitted routes under the selected provider's applicable policy. A private direct API route requires provider-approved zero data retention for Locale's key; Locale does not silently relax the account preference. Default routing requires zero-data-retention and no-training controls where supported by the configured gateway and rejects requests when compliant routing is unavailable. Some explicitly listed models, including free routes, permit provider retention or training. Before using one, you must approve that named model's data use for the current tab and account; approval includes prompts, tool results and replies, and declining sends nothing. That approval does not relax privacy controls for other models. Gateways and providers process request content to generate output. Provider-defined zero retention can permit temporary in-memory prompt caching; it is not a guarantee that data never leaves your device. Locale retains usage, cost, status and request identifiers, not a general archive of inference prompts and responses. Separately enabled history sync and file-excerpt caching retain the content described above. Routing affinity identifiers identify an account/conversation route without storing a prompt fingerprint.

OpenAI Premium routes send selected context directly to OpenAI with Locale's inference credential. Paid routes require an active verified paid plan; displayed rates include Locale's configured service markup. Batch delivery uploads request files to OpenAI and can retain inputs and outputs there while processing. Locale encrypts replies waiting for collection, clears collected replies, requests deletion of batch files after processing and removes uncollected replies after 29 days. Batch, Flex and Fast requests use their selected published tariffs; completed work can still be charged after cancellation. OpenAI data sharing is optional and requires separate consent to sharing prompts and outputs with OpenAI for model improvement. It is incompatible with Zero data retention. When the configured project shares traffic, this consent applies to requests on that project. Normal published prices and paid-plan requirements apply. Supplier allowances lower Locale's costs without granting free customer usage or changing displayed prices. Do not opt in with content you are not authorized to share for model improvement. Revocation stops new sharing and interrupts active shared requests; it cannot recall information already sent.

10Optional Jev evaluation

When you enable Jev guidance for Enhanced compaction or Auto consultation, Locale sends eligible visible context and typed questions to the configured evaluation provider. The interface identifies direct TypeSafe processing when enabled. TypeSafe states that customer content is not used to train its models. Its standard data policy applies to the direct API; enterprise zero data retention requires a separate arrangement and is not promised by Locale. Private provider reasoning is excluded. Locale retains usage and decision metadata while original saved history remains recoverable.

11Essential operation and optional analytics

Essential cookies and local storage maintain sign-in, admission, security, consent choices and requested preferences. Necessary security and billing processing continues when analytics is off. Optional product analytics starts only with consent and includes page views, dwell time, model/provider usage, reported token and request counts, feature use and product consideration. It excludes prompts, replies, file names, file contents, API keys and arbitrary page URLs. Consented visitor IP addresses and browser details are encrypted. We honor Global Privacy Control and Do Not Track for optional analytics. The access page also records throttled aggregate views, browser families and device types without individual visitor records, excluding those signals. A separate anonymous receipt counter counts completed local calls.

12Email and optional services

Verification, recovery and billing email supports requested services. Product updates require confirmation; unsubscribe in settings or an email. Delivery providers process recipients, messages and delivery events. Interest promotions record the selected offer, email confirmation time, eligibility place, offer terms version, invitation and starter-credit status so Locale can fulfill the offer and resolve disputes. Optional Kickbacks.ai uses separate account, placement and interaction data under its notice. Third-party rewards are optional. Locale does not sell customer data as part of its core inference service or use optional product analytics for cross-site targeted advertising.

13Direct Locale sponsorships

Native sponsorships show a paid website link beside the composer using first-party artwork, without advertiser pixels, third-party scripts or remote favicons. Serving and measurement require consent and honor Global Privacy Control and Do Not Track. Locale links sponsorship eligibility and qualified impressions to the signed-in account and human turn internally for frequency limits, billing savings and reconciliation. The separate advertising service receives an opaque reference, not account identities, prompts, replies, files or model choices. Advertisers receive aggregate campaign and daily totals, not user or turn records. Network addresses are used transiently for rate limits. Clicking opens the advertiser's site without a referrer; that site processes the visit under its own notice. Some viewers receive reduced eligible monthly inference charges, not cash; no click or purchase is required. When both native Locale ads and separately enabled Kickbacks.ai are eligible, a choice is fixed for that human turn with a 75% Locale and 25% Kickbacks.ai allocation; otherwise the available option is used. Kickbacks.ai never qualifies for Locale's inference discount and follows its separate disclosures below.

14Boosted Mode and text filtering

Kickbacks.ai Boosted Mode requires a separate explicit opt-in. When enabled, Locale sends a capped, locally filtered excerpt of recent conversation prose, file extensions and a filtered repository-name hint to Kickbacks.ai, which may process and share cleaned context and derived interests with advertising partners under its own terms and privacy policy. This optional advertising disclosure may qualify as targeted advertising or sharing under applicable law. Locale excludes attachment contents, tool output and source-code blocks and applies its PII filter before sending; the Agent checks the provider's consent again before each context-bearing request. Turning Boosted Mode off stops new context sharing in Locale and withdraws provider consent when connected. It does not recall information already sent. PII filtering is mandatory for Boosted Mode and may also be enabled for model requests globally, per model or per chat. Filtering is best effort and is not anonymization; do not rely on it for confidential or third-party personal information. Saved history is unchanged, including any separately enabled history sync. Private placeholder mappings remain in memory by default. You can separately opt in to encrypted local storage of native provider context and its placeholder mappings for reload recovery within your browser tab's provider session. Those mappings are not included in account history or sent to the cloud evaluator. Model filtering supports text, blocks unfiltered images and binary attachments, and does not govern independent file or network actions authorized through tools.

15Service providers and disclosures

DigitalOcean hosts the account service and its operational data. Cloudflare supplies Turnstile challenge processing, encrypted backup object storage and operations monitoring; Turnstile can process device and network signals under its own notice. Vercel AI Gateway, OpenRouter when enabled, and the selected model's upstream providers process inference requests. Anthropic and OpenAI process direct Premium requests when selected. TypeSafe processes optional direct Jev evaluations when enabled. Stripe handles payment and fraud-prevention data and may act independently for its regulatory obligations. Google or GitHub receives sign-in interactions if you select it and supplies authorized identity information. Email hosting and delivery providers process messages. We share only information needed for the selected service, security, support or legal obligations. Service providers do not receive general permission to use your content for their own purposes through this notice. Provider notices and contractual roles can differ.

16Other lawful disclosures

We disclose necessary information to confidential advisers, under valid legal process, to prevent serious harm or in a business transfer with appropriate safeguards and notices. We assess requests for necessity and lawfulness. Other customers cannot access your private balances, records or content; operational reports require authorized administration.

17Retention

Raw optional activity events are normally removed after 90 days, consented visitor connection details after seven days and encrypted authentication security records after 30 days. Anonymous counter receipts expire within an hour and become eligible for cleanup after three days. Unconfirmed product-email addresses expire after two days; delivery events are normally kept for 90 days, with consent or suppression records retained as needed to honor your choice. Account, billing, audit and aggregate records are retained while needed for service, reconciliation, fraud prevention, disputes and legal obligations; there is no automatic promise to delete them on cancellation. Stored history remains until you delete it or request removal, subject to lawful retention. Encrypted backups follow the backup rotation and may retain removed records until they age out; we restrict restored copies and apply deletion requests again. Contact us for the retention applying to a particular record.

18Security and international processing

We use HTTPS, hashed passwords and sessions, access controls, encrypted account content and encrypted backups. Not every database field or local browser record is encrypted, and no system can guarantee absolute security. Providers may process data in the United States and other countries; the Broomfield business address is not a data-residency promise. Where applicable law requires safeguards for an international transfer, we use applicable provider processing agreements and recognized transfer mechanisms, such as contractual clauses, and can explain the arrangement relevant to your request. We do not claim certification under a privacy framework merely because a provider has one.

19Purposes and legal bases

Where a legal basis is required, we process data to perform requested services and account agreements; meet legal obligations; pursue legitimate interests in security, fraud prevention, service reliability and support, balanced against your rights; and obtain consent for optional analytics, product email or other processing requiring it. You may withdraw consent prospectively without affecting earlier lawful processing. We do not use account data to make solely automated decisions that produce legal or similarly significant effects about you.

20Your choices and rights

Account offers an authenticated export and permanent deletion with password confirmation. Deletion erases stored personal content, revokes sessions and linked devices, removes sign-in identities and replaces the profile with a restricted record for lawful billing and audit retention. Google users can set a password through account recovery. Support never asks you to email a password. Email accounts@uselocale.dev for access, correction, export, deletion, restriction, objection or appeal. We verify identity proportionately. Applicable rights may include an authorized agent, opt-outs from sale, targeted advertising or qualifying profiling, consent withdrawal and regulatory complaints. We do not discriminate. Colorado requests where the Act applies normally receive a response within 45 days, with notice of permitted extensions. Reply with 'Privacy appeal' to appeal; a denial explains Colorado Attorney General complaint rights. EU/UK residents may contact their regulator. Local device data and independent providers require separate actions.

21Children and changes

Accounts are for adults 18 and over. We do not knowingly solicit children's data; report concerns to support. This notice takes effect on the date above. Changes receive required notice or consent; retention alone does not authorize new uses. Ask support for an accessible format.