Privacy

Last updated: 5 October 2026

crowbot is run by emlinhax, in Germany.

What we keep

• Your account. An account id, your balance, and when the account was created. Your account number is stored only as a keyed hash (HMAC-SHA256, with a key kept outside the database), so we can check it but cannot read it back.
• What you used. For each request: the time, the model, the token counts and what it cost. Not the text of the request or the reply.
• What you paid. For each payment: the amount, its status, the payment processor's reference, and for crypto the chain it was paid on.

We never ask for your name, email address or phone number, and we store none of them.

What we don't keep

• Your prompts and replies. They pass through crowbot to the model provider and back, and we keep them nowhere: not in our database, not in a cache, not in a log.
• Your web chat conversations. They are saved in your own browser, not on our servers. Clearing this site's data in your browser deletes them. Signing out does not.
• Images and videos made in the chat. fal.ai makes each one from the description the model writes (and the pictures it names, to edit or animate them), and crowbot passes it straight back. It is saved in your own browser with the conversation, never on our servers.
• Pictures you attach. Saved in your own browser with the conversation, never on our servers. They pass through crowbot only when they are used: to the model provider, if the model you chose can see pictures, and to fal.ai, if one is edited or animated.
• A log of your requests. Our servers keep no access log, so your IP address is not written down with what you asked for.

Who else sees your requests

• The model provider that serves the model you choose receives your prompt (and the pictures in the conversation, if that model can see them) and sends back the reply. Providers are third parties and may be outside the EU/EEA; each handles that data under its own terms.
• fal.ai makes the images and videos you ask for in the chat: it receives the model's description and any pictures it is given, and keeps the result for up to a day so your browser can fetch it. We ask it to keep no copy of the request.
• Cloudflare carries all traffic to crowbot.sh and its subdomains.
• Stripe processes card payments. Your card details go to Stripe and never reach us.
• OxaPay processes crypto payments.

IP addresses

Your IP address is used, and kept briefly, in two places only:

• To limit how many accounts one address can create, the address (for IPv6, its /64) that creates an account is kept for 24 hours.
• When you pair a device, its address is shown to you on the approval screen and deleted after 15 minutes.

In your browser

• crowbot_key, in local storage and as a cookie: your account number, which is what signs you in. Signing out removes both.
• crowbot_signed_in, a cookie our subdomains share: whether you are signed in, never your account number, so the top bar on every page shows the right button.
• crowbot_effort: a chat preference. crowbot_video_always_…: whether you let videos start without asking.
• crowbot_greeted: that the chat has greeted you in this browser, so it greets you once.
• crowbot_pending_pay and crowbot_seen_pay: a checkout you opened and the newest payment this browser has shown you, so the chat tells you once when a payment arrives.
• crowbot, a database in your browser: your conversations.
• crowbot-images, a database in your browser: the pictures and videos of your conversations.
• crowbot_vouches, in session storage: set when you close the vouches popup on the front page, so it stays closed until you close the tab.
• The vouches popup shows avatars and emoji from our Discord server. Your browser loads them from Discord's image server (cdn.discordapp.com), which sees your IP address when it does.
• No analytics, advertising or tracking scripts. The site's security policy blocks third-party scripts outright.

Deleting your account

Open the account panel and choose Delete account. It asks you to type your account number, then erases it and every key on the account, so nobody, us included, can open it again. It also clears the account and its conversations from that browser. Any unspent balance is lost.

Your usage and payment records stay, because they are our books. Nothing links them to you any more, and payment records are kept only as long as German tax law requires, up to ten years.

Contact

[email protected] · Discord: https://discord.gg/crowbotai