Privacy

Last updated: 23 September 2026

crowbot is run by emlinhax, in Germany.

What we keep

• Your account. An account id, your balance, and when the account was created. Your account number is stored only as a keyed hash (HMAC-SHA256, with a key kept outside the database), so we can check it but cannot read it back.
• What you used. For each request: the time, the model, the token counts and what it cost. Not the text of the request or the reply.
• What you paid. For each payment: the amount, its status, the payment processor's reference, and for crypto the chain it was paid on.

We never ask for your name, email address or phone number, and we store none of them.

What we don't keep

• Your prompts and replies. They pass through crowbot to the model provider and back. We do not write them to our database.
• Your web chat conversations. They are saved in your own browser, not on our servers. Clearing this site's data in your browser deletes them. Signing out does not.
• A log of your requests. Our servers keep no access log, so your IP address is not written down with what you asked for.

Who else sees your requests

• The model provider that serves the model you choose receives your prompt and sends back the reply. Each provider handles that data under its own terms.
• Cloudflare carries all traffic to crowbot.sh and its subdomains.
• Stripe processes card payments. Your card details go to Stripe and never reach us.
• OxaPay processes crypto payments.

IP addresses

Your IP address is used, and kept briefly, in two places only:

• To limit how many accounts one address can create, the address (for IPv6, its /64) that creates an account is kept for 24 hours.
• When you pair a device, its address is shown to you on the approval screen and deleted after 15 minutes.

In your browser

• crowbot_key, in local storage and as a cookie: your account number, which is what signs you in. Signing out removes both.
• crowbot_effort and crowbot_codesearch: two chat preferences.
• No analytics, advertising or tracking scripts. The site's security policy blocks third-party scripts outright.

Deleting your account

Open the account panel and choose Delete account. It asks you to type your account number, then erases it and every key on the account, so nobody, us included, can open it again. It also clears the account and its conversations from that browser. Any unspent balance is lost.

Your usage and payment records stay, because they are our books. Nothing links them to you any more, and payment records are kept only as long as German tax law requires, up to ten years.

Contact

[email protected] · Discord: https://discord.gg/HKTMW5zsbG