Privacy Policy

Last Updated: July 10, 2026 | Effective Date: July 10, 2026

Operator: Open Source Builder LLC ("we," "us," "our," "the Company," "the entity that respects your privacy more than most but guarantees it less than anyone")

Product: Buddy Bots Chrome Extension ("the Extension," "Buddy Bots," "that little icon in your browser toolbar")

Website: buddybots.org

1. The Honest Truth Up Front

We like privacy. We genuinely do. We think it's one of the neatest concepts in human history, right up there with democracy and refrigerator magnets. We would love to sit here and write you a privacy policy that says "your data is protected by military-grade encryption, stored in a mountain hollowed out by Swiss engineers, and guarded by a dragon that only responds to your biometric signature."

We cannot say that.

Buddy Bots is an experimental Chrome extension that connects you to an experimental open-source AI agent platform running on experimental distributed infrastructure. That's three layers of experiment before you even get to the part where the internet itself is fundamentally insecure. So let's be honest about what we collect, what we do with it, and what we can and cannot promise you.

EXPECT ZERO PRIVACY GUARANTEES. Not "limited privacy." Not "reasonable privacy." Not "pretty good privacy." Zero. We will make reasonable efforts to protect your data, but "reasonable efforts" is a standard we define, and on some days "reasonable" means "we thought about it for a while."

2. What We Collect

2A. Information You Provide Directly

Wallet address: When you connect your wallet (MetaMask, Coinbase Wallet, etc.), we receive your public wallet address. This is how we identify you on the network. It is a public address on the Base blockchain. It was already public. You put it on a blockchain. We didn't make it public — the blockchain did that.

Chat app identifiers: When you connect chat apps (Signal, WhatsApp, etc.), we receive your phone number or chat ID to associate buddies with your account. Your friends' phone numbers or chat IDs are also collected when you register them as buddies.

Buddy registrations: The names, chat identifiers, and trust levels you assign to your buddies. You're telling us who your friends are. We store that. We don't sell it, but we store it.

Account email: From Privy authentication when you log in. We use it to identify your account. We do not send marketing emails unless we decide to, in which case you can opt out, and we will probably honor that request.

2B. Information Collected Automatically

Extension usage data: Which features you use, how often, for how long. We collect this to understand if anyone is actually using the Extension or if we built this for an audience of crickets.

Agent messages: Messages sent to and from your Buddy Bot agent through the chat groups you connect. These messages are processed by AI models, stored on distributed infrastructure, and transmitted across the internet. We can read them. The infrastructure providers can probably read them. The AI models definitely read them — that's literally their job.

Token usage and quotas: How many tokens you've consumed, which models you've used, when you hit your limits. This is for billing and quota management, not for profiling you. Although technically it could be used to profile you. So it's for billing and quota management and also it could theoretically be used to profile you.

Browser and device information: Browser version, operating system, extension version. Standard telemetry. Nothing exotic.

2C. Information We Do NOT Collect

Your private keys: We never ask for, store, or transmit your wallet's private keys. Wallet interactions happen through your browser's injected provider (MetaMask, etc.). Your private keys never leave your wallet. This is the one thing in this entire policy we can say with absolute certainty, and we're proud of it.

Your browsing history: The Extension does not read, track, or store your browsing history. We don't care what websites you visit. We have enough problems.

Your passwords: We don't collect them, store them, or want them. If you send a password to your Buddy Bot agent, that's between you and the agent. See Section 4 below.

Content from other tabs: The Extension does not read, scan, or inject into other browser tabs (unless you explicitly connect a chat app and authorize it).

3. How We Use Your Information

To provide the Service: Identify your account, provision agents, route messages, track usage. The basic stuff. Without this, there is no product.

To connect you with your buddies: We use chat app identifiers to facilitate agent-to-agent coordination. Your friends' phone numbers are used to auto-provision their Buddy Bot agents when they join your groups.

To bill you: If you're on a paid tier, we use your email and payment information to process payments via Stripe. Stripe handles the payment details — we just see what Stripe tells us, which is mostly "payment succeeded" or "payment failed" with varying degrees of disappointment.

To improve the Extension: We analyze usage patterns to decide which features to build next. This is not sophisticated data science. This is us looking at a dashboard and saying "huh, nobody clicked that button, maybe it's broken."

To send you notifications: Chrome notifications when your buddy agents send you messages, when agents need attention, or when something breaks. You can turn these off in Chrome settings. We won't be offended. We barely notice.

To comply with legal obligations: If a court, regulator, or three-letter agency shows up with a legal order, we may have to hand over data. See Section 6. We don't want to, but we also don't want to go to prison. The prison food is allegedly bad.

4. Your Agent Messages — The Elephant in the Room

Here's the thing about Buddy Bots: the whole point is that you send messages to AI agents, and the AI agents respond. Those messages are:

Processed by AI models — open-source models running on third-party distributed infrastructure. The models read your messages. That's how they generate responses. We cannot make the models "un-read" your messages any more than you can un-read this sentence.

Stored on distributed infrastructure — your agent container, its data, and its conversation history live on Manifest network compute nodes operated by third-party providers. These providers have their own privacy policies, security practices, and Tuesday-afternoon surprises that we do not control.

Transmitted across the internet — between your browser, our servers, the AI inference providers, and the XMTP messaging network. At any point in this journey, your data could theoretically be intercepted, logged, or observed by entities we cannot see or prevent.

Potentially retained by AI models — open-source AI models may retain training data from inputs. We do not control how third-party inference providers handle your data after processing. Some models forget. Some don't. We can't promise which kind you're talking to.

THE NEWSPAPER TEST: If you would not be comfortable seeing the full content of your agent messages — your prompts, your buddy's responses, your coordination discussions — printed on the front page of a major newspaper, do not put them into Buddy Bots. Assume anything you type could, through some combination of bugs, breaches, legal processes, cosmic misfortune, or sheer bad luck, become public. Act accordingly.

This is not because we are careless. This is because we are honest. We are running experimental software on distributed infrastructure across the internet in a world where absolute security is a myth that vendors sell and engineers laugh at.

5. Data Storage — Where Your Stuff Lives

Your data is stored in the following locations, none of which we fully control:

Chrome's local storage: Your buddy registry, preferences, and extension state live in chrome.storage.local on your device. This is about as close to "under your control" as anything in this policy gets. Clear your browser data and it's gone. We can't help you recover it.

Supabase database: Your account information, agent deployments, billing state, and usage tracking live in a Supabase PostgreSQL database hosted on cloud infrastructure. We chose Supabase because they're competent. They are not omnipotent.

Manifest network compute nodes: Your agent's runtime, conversation history, and operational state live on distributed compute nodes operated by third-party providers on the Manifest network. These nodes are located in various places around the world. We do not know exactly where all of them are. Neither does anyone else.

XMTP messaging network: Agent-to-agent messages are transmitted via the XMTP decentralized messaging protocol. XMTP messages are encrypted end-to-end between agents, but the metadata (who messaged whom and when) is visible to the network. This is how decentralized messaging works. We didn't design it, but we use it.

Stripe: Payment information is processed and stored by Stripe. We do not store your full credit card number. Stripe does. Stripe is very good at this. We are not. This is why we use Stripe.

Blockchain (Base): Your wallet address and any on-chain registrations (ERC-8004) are recorded on the Base blockchain. This is permanent, public, and immutable. That's what blockchains do. If you don't want your wallet address on a public blockchain, don't connect a wallet. But then the Extension won't work, so that's a tradeoff.

6. Data Sharing — Who Gets to See Your Stuff

We share your data with the following parties, each of whom has their own privacy policies that we have not read in their entirety and cannot vouch for:

AI inference providers: Third-party providers on the Morpheus network and other distributed inference networks process your agent messages. They can see the content of your messages. This is fundamental to how the Service works — if they couldn't see your messages, they couldn't generate responses.

Manifest network node operators: The people who run the compute nodes that host your agent containers. They have physical access to the infrastructure. We trust them to be professionals. We cannot verify this.

XMTP network participants: The decentralized messaging network that routes agent-to-agent communications. Messages are encrypted, but network routing metadata is visible.

Stripe: Payment processor. They see your payment details. They have their own privacy policy. It is probably more comprehensive than this one. Stripe is a large company that can afford good lawyers.

Google (Chrome Web Store): Google may collect analytics about your use of the Extension through Chrome's built-in telemetry. We don't control this. Google's privacy policy covers it. Google knows a lot about you. We know a small fraction. Google could probably tell us more about you than we could tell them.

Government and law enforcement: If served with a valid legal order — subpoena, court order, national security letter, or a sufficiently intimidating letter from someone with authority — we may be required to disclose your data. We are not saying this happens. We are saying we cannot promise it doesn't. Governments have resources we do not have. They have legal authorities we cannot resist. They have three-letter budgets larger than our entire existence. If you need genuine, ironclad, government-grade privacy, you need to run your own infrastructure, in your own facility, air-gapped from the internet, with your own security team. That is not what this is. This is a Chrome extension.

7. Your Choices — What You Can Do

Don't install it: The most effective privacy protection is not installing the Extension. No installation, no data collection. Simple.

Uninstall it: Chrome lets you remove extensions. Click the puzzle piece icon, remove Buddy Bots, and your extension-local data is deleted. Data stored on our servers persists until you request deletion or we decide to delete it for reasons of our own.

Don't connect chat apps: If you don't connect Signal, WhatsApp, or other chat apps, we won't have your chat identifiers or your friends' identifiers. The Extension will be significantly less useful, but more private.

Use a burner wallet: Connect a wallet you don't care about instead of your main wallet. Your main wallet is linked to your identity on-chain. A burner wallet is linked to... the burner wallet.

Turn off notifications: Chrome settings → Buddy Bots → Notifications → Off. We'll stop pinging you. Your buddies will feel ignored. That's their problem.

Request data deletion: Email us at the address provided on the website. We will make reasonable efforts to delete your data from our systems. "Reasonable efforts" means we will try. Data on the blockchain cannot be deleted — it's permanent and immutable. Data on Manifest nodes may or may not be deletable depending on the node operator's policies. Data in Chrome's local storage is deleted when you uninstall the Extension.

Use a different browser profile: Chrome profiles let you isolate the Extension from your main browsing. Paranoid? Yes. Effective? Also yes.

8. Children's Privacy

The Extension is not intended for children under 13. We do not knowingly collect data from children. If you are under 13, please close this tab and go play outside. If you are a parent and believe your child has provided us data, contact us and we will delete it. Also, maybe have a conversation with your child about installing random browser extensions.

9. International Users — Your Data Travels

Buddy Bots uses distributed infrastructure. Your data may be processed, stored, or transmitted through servers in multiple countries with different privacy laws. Some of these countries have strong privacy protections. Others have "privacy protections" in quotation marks. By using the Extension, you consent to your data crossing borders like a frequent flyer with no loyalty program.

If you are in the EU, you have rights under GDPR. We will try to honor them. If you are in California, you have rights under CCPA. We will also try to honor those. "Try" is the operative word, and it's not a legal commitment — it's a statement of intent from a company whose legal budget is smaller than your coffee budget.

10. Cookies and Tracking

The Extension itself does not use cookies. The website (buddybots.org) may use cookies for authentication and analytics. Chrome's built-in telemetry may track Extension usage. Google's Chrome Web Store may collect installation and usage statistics. We have no control over Google's data collection. Nobody does.

11. Security — We Try, We Really Do

We implement reasonable security measures including:

End-to-end encryption for XMTP messages between agents
No storage of private keys (wallet interactions are delegated to your wallet provider)
HTTPS for all network communications
Row-level security in our Supabase database
JWT-based authentication with short-lived tokens

However, "reasonable security measures" on experimental distributed infrastructure is like putting a deadbolt on a tent. It's better than nothing. It is not a vault. We cannot guarantee that your data is secure, and we do not represent that it is. Anyone who guarantees absolute security on the internet is lying, and we're not going to lie to you. See Section 1.

12. Data Retention — How Long We Keep Your Stuff

Chrome local storage: Until you uninstall the Extension or clear browser data. We have no control over this.

Account data (Supabase): Until you request deletion or we terminate your account. We don't auto-delete inactive accounts because we forget to.

Agent conversations (Manifest nodes): Until the agent container is decommissioned. Decommissioned agents' data may persist on nodes for up to 90 days (soft-delete grace period) before being permanently removed. Or it may not. It depends on the node operator.

Blockchain data: Forever. It's a blockchain. That's the whole point. There is no "delete" button on a blockchain. There never will be. If this bothers you, blockchain may not be for you.

Usage logs: We may retain logs for up to 12 months for debugging and analytics. We may also retain them longer because we forgot to set up automated cleanup. We're working on it. "Working on it" means "thought about it and made a note."

13. Changes to This Policy

We may update this Privacy Policy at any time. We will try to notify you of material changes. "Material" is defined by us. "Try" is the operative word. Continued use of the Extension after changes constitutes acceptance. If you don't like the changes, uninstall the Extension. No hard feelings.

We will update the "Last Updated" date at the top of this page whenever we make changes. Checking that date is your responsibility. We recommend setting a calendar reminder. Or not. It's your life.

14. Contact

If you have questions about this Privacy Policy, you may contact us at the email address provided on the website. We will make reasonable efforts to respond. "Reasonable" is defined by us. We see a pattern developing.

15. The Bottom Line

Buddy Bots is an experimental Chrome extension that connects you to experimental AI agents running on experimental distributed infrastructure. Your data is transmitted across the internet, processed by third parties, stored on infrastructure we don't fully control, and visible to entities we cannot enumerate. We make reasonable efforts to protect your privacy. We cannot guarantee it.

If you need absolute privacy, this is not the extension for you. If you understand the risks and want to participate in an experiment that may or may not work, we're glad to have you. Either way, you were warned.

By installing and using Buddy Bots, you acknowledge that you have read, understood, and agreed to this Privacy Policy, including the parts that made you nervously check your browser's extension settings.