Privacy Policy
The current privacy text and the official contact channels.
Public beta privacy notice · effective 2026-10-12.
This notice covers Uptokey software and documentation, operated by Tecaless. It distinguishes local/BYOK workflows from the optional account and Uptokey-funded cloud service. Providers process requests under their own terms.
Local work and your API keys
Local models process inference on your computer. With BYOK, your key stays in the local vault and the local service sends selected request content to your provider. Uptokey's hosted executor is not in that path. Native history and project files remain local unless you include content in an authorized request.
Account and funded cloud processing
Auth0 handles sign-in and account profile information. Uptokey stores a canonical account identifier and authorization metadata remotely. Funded requests pass through Uptokey's web service and executor, which check access, allowance and limits before forwarding them to the chosen provider. Messages are processed in memory; the account and usage ledger do not store conversation transcripts. This path is not zero-knowledge processing of your request content.
Remote service records contain account/request identifiers, timestamps, model/pricing references and numeric allowance, usage and charges. Uptokey uses its own server-side provider credentials for funded inference, not your BYOK keys.
History, retention and controls
Standalone hosted history is encrypted in your browser for the confirmed account; temporary chats use memory. Signing out hides saved history. Clearing browser storage removes its history and encryption key.
Local deletion, purge and export apply to local data, not remote account records or provider-held copies. A general retention or erasure deadline for remote account/ledger records is not published in this notice. Provider retention follows each provider's terms; no remote backup or provider-deletion guarantee is made here.
Rights and contact
GDPR and LGPD describe the relevant rights. Local controls are not a complete mechanism for exercising rights over remote account data. A verified private channel for privacy requests containing personal data has not yet been published. Do not put personal data or secrets in public issues. GitHub Issues is for non-sensitive general questions.
Changes
This dated notice clarifies the account and funded-service data path. Material changes receive a dated entry in the changelog. See architecture and retention for the separate boundaries.