Privacy policy · Effective 31 October 2026
llamay runs on your own machine, and a model running there sends your text nowhere. This page lists everything that does leave it, everything the website and the hosted service keep, who handles it for us, and how to get it back or have it deleted.
LLAMAY_NO_UPDATE_CHECK=1 turns it off.llamay is made by Kosa8 Labs. For the personal data described on this page, Kosa8 Labs is the controller. Kosa8 Labs is registered in India and the United States. You can reach us about anything here at [email protected].
This policy covers the llamay software (the llamay
engine and command line, the Mac, Windows and Linux desktop apps, and
Studio), the website llamay.com, and the hosted service at
app.llamay.com. It does not cover a llamay server or sync service
that you or your organisation run yourselves; whoever runs that is
responsible for it.
What stays local. llamay runs models in a process on your machine. Your prompts, the answers, your conversations, memory, documents, saved attention state, API keys and configuration are stored there. We have no copy and no way to see them. The command line and the local server need no account.
The update check. Once a day the engine and the desktop apps
ask GitHub's public releases API whether a newer version of llamay
exists. The request identifies itself as llamay-update
and carries nothing about you or your machine beyond what any web
request carries (your IP address, which GitHub receives). Set
LLAMAY_NO_UPDATE_CHECK=1 to switch it off. The sovereign
build makes no network requests at all.
Downloads. The installers and release files are served from
GitHub Releases, and install.sh and
install.ps1 from llamay.com. GitHub and Cloudflare
receive your IP address and request details when you download. We
see only aggregate download counts.
The desktop apps. The Mac app asks you to sign in when you first open it, because what it adds over the command line — sync, hosted models and your plan — belongs to an account. A model running locally in the app still sends nothing to us.
These happen only when you ask for them. Data goes from your machine to the service you name, under that service's own terms, and does not pass through us.
Hosting. llamay.com is served by Cloudflare. Like any web server, Cloudflare processes your IP address, browser user agent, the pages you ask for and similar request data, to deliver the site and protect it from abuse.
No cookies, no analytics. The site sets no cookies and runs no analytics or tracking scripts. Fonts, styles and scripts are all served from llamay.com, and the site's security policy forbids loading them from anywhere else.
Pages that call out. A few pages make a request from your browser, and only these:
localhost:11435, and to nothing else.Links to GitHub, Polar and other sites take you to sites with their own privacy policies.
An account is optional for the command line and needed for sync, hosted models, plans and Studio at app.llamay.com.
Signing in. Sign-in is run by Clerk. Clerk holds your email address, name, password if you set one, any Google or GitHub account you connect, two-factor settings and your sign-in sessions, and sends the verification emails. Our service checks Clerk's signature on your sign-in and keeps: Clerk's id for you, your sign-in name (your username, or your email address if you have none), your display name, your plan and any storage add-on, and when the account was made. Sign-in tokens and API keys are kept only as SHA-256 hashes, never in the clear.
Signing in from an app. While a sign-in started in an app waits for you to finish it in a browser, we keep, for up to ten minutes, a hash of the app's secret, a short label for the app (such as "llamay for Mac 0.4.4") and the country and city Cloudflare places the request in, so the sign-in page can show you whether the code is your own device's. No network address is kept.
Hosted models. When you use a hosted model from the apps, Studio or an API key, our service, a Cloudflare Worker, receives your messages, adds the instruction and any memory your app sent with the turn, and forwards them to Cloudflare Workers AI, which runs the model. The text is held for the length of the request and written to none of our storage, and every model call asks Cloudflare's AI Gateway to log metadata only. Cloudflare's Workers AI data usage terms say it does not use customer content to train models. We keep a usage ledger of what each call cost: the model, tokens, amount charged and time. When a conversation outgrows the model's context, the older part is replaced by a model-written summary, which is kept for thirty days so the next turn does not pay to write it again.
Web search. When a hosted turn searches the web, the search query goes to public search services (such as Bing, DuckDuckGo, Google News, Stack Exchange, Hacker News and Wikipedia) and the pages the model reads are fetched from their sites. They see a request from our service, not from you.
Sync and the drive. Conversations, memory, attention state and settings that your apps sync, and files you put in the drive, are stored in Cloudflare R2 under your account's own prefix. Studio asks before it syncs your conversations. They are kept until you delete them or the account.
Seats. If you or your organisation buy seat licences, we keep each seat holder's name and email address, the licence issued and its expiry, and a log of who issued or released which seat.
The full list, with exactly what each item holds, is on What hosted llamay keeps and Your hosted account.
Paid plans, storage and credit are sold by Polar, our merchant of record. Polar runs checkout, takes payment, handles tax, issues invoices and receipts, and is the name on your statement. Polar and its payment processors collect your name, email address, billing address and payment details under Polar's privacy policy. We never see or store your card.
We pass Polar your account id and email address when you start a checkout, and Polar tells our service what you bought and whether your subscription is active, so we can apply your plan. Top-ups are recorded in your usage ledger with their order reference.
A message sent through the contact form is stored with the name, email address and organisation you typed, and the network address and country it was sent from, for ninety days. It is also emailed, through Cloudflare's email service, to the inbox that answers it. The network address is used to limit abuse of the form.
Email to any llamay.com address is delivered by Cloudflare Email Routing to our inbox. We keep correspondence for as long as we need it to deal with what you asked, and longer only where we have a legal or contractual reason to.
Search services, model registries, your own model providers, connectors and telemetry endpoints receive data only when a turn or a setting of yours sends it to them, as described above. They are not our processors for it.
| What | How long |
|---|---|
| Hosted prompts and answers | Not kept. Held for the length of the request. |
| Compaction summaries | Thirty days, or until the account is deleted. |
| Usage ledger | The last 500 entries per account, until the account is deleted. |
| Your account | Until it is deleted. |
| Sessions | Ninety days, or until you sign out or delete the account. |
| Sign-ins in progress | Ten minutes, or until the app collects the session. |
| API keys (hashed) | Until you revoke the key or delete the account. |
| What you sync | Until you delete it or the account. |
| Seat licences | A seat until it is released; licences issued and the log until the account is deleted. |
| Contact form messages | Ninety days. |
| A deleted account | A marker that an account was deleted and when, with nothing about you, for ninety days. |
| Logs | Request metadata and errors, held by Cloudflare under its log retention. No message text. |
| Clerk and Polar | For as long as your account exists; Polar keeps orders and invoices for as long as tax law requires. |
Data on your own machine is under your control. Deleting it there deletes it.
Where the GDPR, the UK GDPR or similar laws apply, we rely on:
We do not make decisions about you by automated means that have legal or similarly significant effects.
Wherever you are, you can ask what we hold about you, have a copy, and have it corrected or deleted. Most of it you can do yourself: at app.llamay.com/account, Download my data gives you everything the service holds for you in one file, and Delete my account deletes it. Anything else, write to [email protected]. We may need to confirm it is you, and we aim to answer within thirty days.
EEA, UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority.
California. You have the right to know, delete and correct personal information, and not to be discriminated against for using those rights. We do not sell personal information or share it for cross-context behavioural advertising.
India (Digital Personal Data Protection Act, 2023). You have the right to a summary of the personal data we process and of the processing, to correct, complete, update or erase it, to withdraw consent, to nominate another person to exercise your rights if you die or are incapacitated, and to grievance redressal. Send grievances to [email protected]; if you are not satisfied with our answer, you can complain to the Data Protection Board of India.
llamay.com sets no cookies. The docs and blog store one value in
your browser's local storage, llamay-theme, to remember
whether you chose light or dark. It is never sent anywhere.
The conch in the corner of each page keeps score of small
achievements (copying the install command, reading a guide to the
end) in one more local storage value, llamay-delight:
which achievements you have unlocked, which docs pages and articles
you have finished, and whether you turned its sound on. It stays on
your device, is never transmitted, and the script that keeps it
makes no network requests. Reset on the conch's trophy shelf
deletes it, as does clearing this site's data in your browser.
On app.llamay.com, Clerk sets the cookies that keep you signed in, and Studio keeps its settings (appearance, connections, whether you have seen the introduction) in local storage. Both are needed for the thing you asked for, and none is used to track you. You can clear them with your browser's site data controls, which signs you out.
llamay is not directed at children, and accounts are for people aged 18 or over. If you believe a child has given us personal data, write to us and we will delete it.
Everything between the apps, the website and the service travels over HTTPS. Bearer tokens and API keys are stored only as hashes, payment notifications are accepted only with a valid signature, and what you sync is kept under a prefix only your account can reach. How the software is built and checked is on the security page; report a vulnerability to [email protected].
Cloudflare, Clerk, Polar and GitHub process data in the United States and other countries. Where the law requires it, those transfers are covered by their data protection terms, including standard contractual clauses.
If what the software, the site or the service collects changes, this page and its effective date change before the release that does it. A material change is also noted in the release notes and, if you have an account, sent to you by email.
Privacy questions and requests: [email protected]. Anything else: [email protected]. A person reads both.
Effective 31 October 2026.