Your data, plainly.

octokan is a chat widget that businesses ("site owners") add to their apps and websites. There are two kinds of people whose data we handle:

• Site owners who create an octokan account. For this data, [Company name] ("octokan", "we") is the controller.
• Visitors who chat with a site owner through the widget. For this data the site owner is the controller and octokan is the processor, acting only on the site owner's instructions.

Site owners: name, email address, sign-in method (password or Google), an optional profile photo, the apps you create and your settings.

Visitors: only what is needed to hold a conversation.

• The messages they write, and the replies they receive.
• Their browser language and the page they were on, shortened to the address without any query string or fragment.
• A name, email or user id. These come from the site owner's app, from a form the visitor chooses to fill in, or, unless the site owner turns it off, from the sign-in the visitor already has on that site: once the chat is opened, the widget reads only the id, email and name from that sign-in and never an access token. The chat window shows "Signed in as …" with a "Not you?" link. Identities that the site owner has not signed are labelled unverified.
• A random token, stored in the browser's local storage, so the conversation can continue. Only a one-way hash of it is kept on our servers.

Nothing about a visitor is stored until they open the chat. The widget sets no cookies, uses no analytics or advertising trackers and makes no third-party requests. We do not store IP addresses in our database. Our hosting provider may keep ordinary server logs for security and reliability.

Encryption. Message text is encrypted in transit and again before it is stored (AES-256-GCM, a separate key per app, held only in server settings). Someone with access to the database alone sees ciphertext. Our servers decrypt a message only to deliver it, to send the site owner's alerts and, when the owner turns it on, to draft a reply with AI.

On octokan's own website and dashboard (not in the chat widget on your site) we measure which pages people open, how long they stay, which buttons they press and where they come from, so we can improve the product. It uses an anonymous identifier in your browser's local storage, links it to your account when you sign in, never records what you type and never stores IP addresses. It is switched off for browsers that send Do Not Track or Global Privacy Control.

• To deliver the service: carry messages between visitors and site owners, send replies and keep the inbox up to date.
• To protect the service: rate limiting, abuse prevention and keeping accounts secure.
• To contact you about your account, such as sign-in, verification and password emails.

We do not sell personal data, and we do not use visitor messages to advertise or to train models.

We use a small number of providers to run octokan.

• Supabase: database, authentication and realtime. [Region: replace with your project region]
• Cloudflare R2: profile photos.
• [Hosting provider]: serves the website and API.
• Dodo Payments: our merchant of record. It processes payments and handles taxes; we never see your card number.
• Anthropic: only if a site owner turns on AI insights for their app. Chat text is sent with emails, phone numbers and link parameters removed, and visitors are anonymised.
• Google: only if you choose "Continue with Google" to sign in.

Where data is transferred outside your region, we rely on the providers' standard contractual clauses or equivalent safeguards. A data processing agreement for site owners is available on request at [[email protected]].

• Conversations are kept until the site owner deletes them, or for the retention period they set in Settings. Old conversations are then erased automatically.
• Visitors who opened the chat but never wrote anything are removed after 30 days.
• When a site owner deletes their account, their apps, visitors, conversations and photo are deleted with it.

Depending on where you live, you can access, correct, export or erase your data, and object to or restrict how it is used.

• Site owners can download everything as a JSON file and delete their account from Settings, at any time.
• Visitors can erase their own conversation with "Delete my chat" in the chat window. To exercise other rights, contact the site owner, who can export or delete the conversation from octokan. If you cannot reach them, write to us and we will help.
• You can complain to your local data protection authority.

• Everything is encrypted in transit (HTTPS) and at rest by our providers.
• Row level security in the database means a site owner can only ever read their own apps' data.
• Visitor tokens are stored as hashes and travel in a header, never in a URL.
• Site owners choose which websites may load their chat, and can verify who is chatting with a signed identity.
• Requests are rate limited, and the widget runs in an isolated shadow DOM so a host page's code cannot read the conversation through the interface.

No system is perfectly secure. If a breach affects your data we will tell the people involved and the authorities as the law requires.

octokan is a business tool and is not directed at children under 16. If you believe a child has used it, contact us and we will remove the data.

If we change this policy in a meaningful way we will update the date above and notify site owners by email. Questions: [[email protected]], [postal address].