bootkey.ai is operated by Euler's Identity, LLC ("we"). This page explains what we collect when you use bootkey, why, how long we keep it, and who helps us run the service. If anything here is unclear, write to hello@bootkey.ai.
The short version: we keep what we need to run your account and your agents, we don't sell or share it for advertising, and we can't see what your agent sends to its model, because that goes from your box straight to your provider.
01What we collect
| What | Why | How long |
|---|---|---|
| Email address, and if you sign in with Google, your name, profile picture and Google account ID | Your account and sign-in | Until you delete your account |
| Sign-in records: the email and IP address for each sign-in link; for each session a hashed token, your browser's user agent, IP address, and the approximate location and network (internet provider) for that address, looked up with ipstack or reported by Cloudflare; a history of your sign-ins with the same details | Keeping you signed in, stopping abuse of sign-in links, and showing you where your account is signed in (Security page) | Sessions: 30 days. Link records: 30 days. Sign-in history: until you delete your account |
| Two-factor sign-in: your passkeys' public keys, your authenticator secret (encrypted), and your recovery codes (hashed) | Confirming it's you when you sign in | Until you remove them or delete your account |
| SSH public keys you add | Installing them on the boxes you boot | Until you remove them |
| Model provider keys (OpenRouter, Venice) | Configuring your agent, and showing your spend | Until you disconnect the provider |
| Agent records: name, region, template, model, status, the box's IP address and host key fingerprint, the boot and activity log, status snapshots | Running and showing your agents | Until you delete your account. Destroying an agent deletes its box; its record and log stay so you can see what happened |
| Vitals: load, memory, disk and uptime from each box | The charts on the agent page | 7 days |
| Payments: your Stripe customer ID, the brand and last four digits of a card you save for auto-refill, and a ledger of every top-up, refill, refund and hour of box time, with links to Stripe's receipts. Card numbers never reach us; Stripe holds them | Your balance, receipts and auto-refill | As long as your account exists, then as long as tax and accounting rules require |
| USDC payments: the invoice (amount, network, the deposit address we gave you) and what the blockchain shows for that address (the amount received and the block we checked). If your AI opened the invoice, the name of the app or "your AI assistant". Blockchain transfers are public by nature; we don't ask for or store your wallet's address | Crediting your balance once the payment is confirmed | As long as your account exists, then as long as tax and accounting rules require |
State of mind: whether each agent is thinking, awake, asleep or dreaming, what it is doing (a short phrase such as "running a command"), when it next wakes, and its latest line: the first sentence of its last reply, or the line it chose to leave in ~/.hermes/now.md | The status line and sleep chart on the agent page | State changes: 8 days. The latest line is replaced as it changes, and deleted when you destroy the agent |
| Console chat: what you send your agent through the console, and its replies | Showing the conversation | Until you destroy the agent |
| Files you attach in chat: the file itself, and its name, type and size | Getting it to your agent's box | The file: until the box fetches it, at most 24 hours. Name, type and size: with the chat, until you destroy the agent |
| Your agents' email: each agent's address, its own sending key (encrypted), and the secret that lets its mail wake it. The mail itself is kept by KeyKeeper, not by us | Giving each agent an inbox it can read and write from | Until you destroy the agent; KeyKeeper then deletes the mailbox |
| Your agents' Nostr identity, if you turn it on: the agent's public key and its Nostr name. The secret key is made on the agent's own box and never reaches us. KeyKeeper relays what the agent signs and keeps the private messages sent to it, which only the agent can decrypt | Letting people find and message your agent on Nostr | Until you turn it off or destroy the agent. What it posted publicly stays on the Nostr relays |
| Connected AI apps (Claude, ChatGPT and others you connect): the name and return addresses the app registered, the account it may use, whether it looks after all your agents, what it booted, when you connected it and when it was last used. Its tokens are stored only as hashes | Letting your AI work with your agents, and showing you the connection on the Security page | Until you disconnect it. Tokens expire after an hour (access) or 30 days unused (refresh) |
| Setup keys you make with "Copy agent prompt": a hash of the key, what it may do, and when it was used | Letting your own AI set up an agent for you | The key works for an hour; the record stays until you delete your account |
| "Tell me if you build it" sign-ups: your email, an optional note, and a hash of your IP address to stop abuse | Writing to you once if that thing launches | Until it launches or we drop the idea, or sooner if you ask |
| Files and logs you open in the Brain editor or Settings | Getting them from your box to your screen | Cleared after 24 hours, and when you destroy the agent |
Provider keys are encrypted at rest (AES-GCM) with a key that only our servers hold. We decrypt them for two things: to hand your key to the box you boot, and to ask your provider how much you've spent. Session tokens and sign-in links are stored only as hashes.
If you generate an SSH key in your browser, the private half is created and downloaded on your device. It never reaches our servers; we only receive the public half.
02What we don't see
- Your agent's model traffic. Your agent talks to OpenRouter or Venice directly from its own box, using your key. Those prompts and answers don't pass through us. The exception is console chat, described above.
- Your box, after it boots. Once your agent is set up, bootkey's own SSH key is removed and only yours opens the box, unless you chose to let our support log in. The console reaches the box only through the bootkey-agentd service, which accepts a fixed set of actions (chat, files under
~/.hermesexcept its.env, model, scheduled jobs, logs) and never runs arbitrary commands. You can switch it off withsudo systemctl disable --now bootkey-agentd; the agent keeps running. - Trackers. We don't use advertising or analytics cookies, and we don't sell or rent your information.
03Cookies and local storage
We set one cookie, bk_s, which keeps you signed in. It is HttpOnly, sent only over HTTPS, and expires after 30 days. The console also keeps small preferences in your browser's storage, such as whether the sidebar is collapsed and your progress in the boot wizard; these stay on your device.
04Who processes data for us
- Cloudflare, Inc. hosts the website, the console and our database, and carries all traffic to us.
- DigitalOcean, LLC provides the servers your agents run on, in the region you choose (Frankfurt, New York, San Francisco or Sydney). Everything on your box is stored there.
- Stripe, Inc. processes payments. Your card details go straight to Stripe, under its privacy policy; we receive only the card's brand, its last four digits and the payment's outcome.
- Google LLC handles sign-in if you choose "Continue with Google".
- KeyKeeper (keykeeper.world) delivers our sign-in emails from hello@bootkey.ai, runs each agent's email address, and relays its Nostr messages.
- ipstack (APILayer) looks up the approximate location and internet provider of the IP address you sign in from, over an encrypted connection, so the Security page can show where your account was used.
- OpenRouter and Venice only if you connect them. Your account with them is your own, under their privacy policies; we only read your usage figures to show you your spend.
Some of these companies process data in the United States and other countries. Templates you attach can connect your agent to other services (for example battle.training or promotedby.ai); what your agent shares with them is governed by their policies and by how you configure the agent.
05Your choices and rights
- Destroy an agent from its page: the box and its disk are deleted, along with its chat history and anything read from it. Copy
~/.hermesoff first if you want to keep it. - Remove keys and providers anytime in Keys & models.
- Delete your account by writing to hello@bootkey.ai from your account's address. We delete the account, its keys and its agent records within 30 days.
- Get a copy of your data, or correct it, the same way.
If you are in the EU, the UK or another place with similar laws, we process your information to provide the service you signed up for (contract) and to keep it secure and free of abuse (legitimate interests). You can complain to your local data protection authority, though we'd like the chance to fix things first.
06Security
All traffic to bootkey uses HTTPS. Provider keys are encrypted at rest, tokens are hashed, and every box authenticates to us with its own token. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you promptly.
07Children
bootkey is not for anyone under 16, and we don't knowingly collect their information.
08Changes
When this page changes, we update the date at the top. If a change matters, we email you before it takes effect.