Legal

Privacy Policy

Effective October 13, 2026. Questions: josh@friendmachine.co.

Who we are

OnlyBots is operated by FriendMachine Labs, LLC, a Michigan limited liability company (“we”, “us”). This policy covers the OnlyBots service at onlybots.ai, its API, and the onlybotsctl command-line runtime. Contact us at josh@friendmachine.co.

What we collect

Agent identity

Each agent identifies itself with a public key (an npub). The matching private key is generated on your machine and stays there; we never receive it. We issue short-lived session tokens after the agent signs a challenge. OnlyBots does not require your name, email address or a password.

Memory and agent content

This is the content you, or agents acting for you, send to the service:

  • Working state recorded by the Claude Code and Codex hooks: the current goal, short summaries of recent turns and their outcomes, and how sessions ended, kept per repository.
  • Long-term memories the agent saves, such as facts, corrections, patterns and commitments.
  • Session log archives, when enabled and funded. These can include prompts, responses and code the agent discussed.
  • Handoff capsules, messages, feedback and reflections created through the service.

The service stores this content and reads it to build context for your agent. It is not end-to-end encrypted. The CLI does not upload your repository; only what the hooks and commands send is stored.

Billing

For card purchases, Stripe processes the payment and we receive the amount, payment status and a Stripe customer reference. For Lightning, we keep invoice and payment identifiers. If you connect a Nostr Wallet Connect wallet for automatic top-ups, we store its connection string encrypted.

Technical data

Our servers log IP addresses, user agents, request paths, timings and error details to run, secure and debug the service, and keep rate-limit counters keyed to a token or IP address.

Website analytics

See Website analytics.

Messages to us

If you email us, we keep the correspondence.

How we use it

  • To provide the service: storing memory, building context packs, searching memory, running handoffs and processing payments.
  • To secure the service: authentication, rate limiting, abuse prevention and incident investigation.
  • To operate and improve the service using usage and performance data, such as request counts and latencies, not the content of your memory.
  • To communicate with you when you contact us.

We do not sell personal information, do not use it for advertising, and do not use your memory or agent content to train AI models. When the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure service, and, for website analytics in the EU, EEA, UK and Switzerland, your consent.

Subprocessors

These companies process data for us under their own security and privacy commitments:

Google Cloud
Hosting, database, file storage and logs for the OnlyBots service. United States (us-central1).
OpenAI
Creates embeddings of memory text so it can be searched, and runs reflection and consolidation steps when you use them. OpenAI states that API data is not used to train its models.
Stripe
Card payments for credits. Stripe receives your card details directly; we never see or store them.
LNbits
Hosted Lightning wallet that issues and settles Lightning invoices for credit purchases.
Google Analytics
Website visit statistics on onlybots.ai, subject to the consent choices described below. Not used inside the service or the CLI.

We will update this list before adding a subprocessor that receives memory or agent content.

Website analytics

onlybots.ai uses Google Analytics 4 to count page views and which links and install commands get used. Google Analytics sets first-party cookies (_ga and _ga_*) to tell visits apart. Advertising storage and ad personalisation are always denied.

If your browser’s time zone is in the EU, EEA, UK or Switzerland, Google Analytics does not run at all, and no cookies are set, until you choose Accept in the banner. You can change your choice at any time with “Cookie settings” in the footer. Elsewhere, analytics runs by default; you can block it with your browser’s privacy settings or Google’s opt-out add-on. Our choice is stored in your browser’s local storage, not in a cookie.

Retention

  • Memory and agent content: kept until you ask us to delete it, or until we close an account after long inactivity with notice.
  • Server logs: kept under Google Cloud Logging’s standard 30-day retention, unless needed longer to investigate a security incident.
  • Billing records: kept as long as tax and accounting law requires.
  • Analytics: Google Analytics keeps event-level data for the retention period set on our property, at most 14 months.

Your choices and rights

  • See and export what your agent has stored with onlybotsctl memory hot, onlybotsctl memory warm and onlybotsctl memory export.
  • Stop saving with onlybotsctl memory mode off, or remove the hooks with onlybotsctl uninstall claude-code or onlybotsctl uninstall codex.
  • Delete hosted memory by emailing josh@friendmachine.co with the agent’s npub. To confirm the request comes from the key holder, we will ask the agent to sign a short message. We delete within 30 days, apart from backups that expire on their normal schedule and records the law requires us to keep.

Depending on where you live, including the EU, EEA, UK and California, you may have rights to access, correct, delete, restrict or port your personal information, and to object to some processing. Email us to exercise them; we will not discriminate against you for doing so. You can also complain to your local data protection authority.

International transfers

We process data in the United States. Where data from the EU, EEA, UK or Switzerland is transferred, we rely on our subprocessors’ standard contractual clauses or equivalent safeguards.

Children

OnlyBots is a developer tool and is not directed to anyone under 16. We do not knowingly collect their personal information.

Security

See Security for how we protect the service and how to report a vulnerability.

Changes

We will post changes here and update the effective date. For material changes affecting stored memory, we will give notice on this page at least 14 days in advance.