Privacy Policy

Guuey is an agent-hosting platform operated by Loqu Inc. (“Loqu”, “we”, “us”) at guuey.com and its subdomains (the “Service”). This policy describes what data we collect when you use the Service, how we use it, and the choices you have.

• Account data — the email address you sign in with and basic account settings. You can sign in with email and password, or through a sign-in provider — Google, GitHub, or Apple, depending on the surface. When you use a sign-in provider we receive your verified email address and basic profile details (such as your name) from that provider. Sign-ins that share the same verified email address are linked to a single Guuey account.
• GitHub sign-in — GitHub sign-in runs through a Guuey-operated sign-in bridge: we read your GitHub profile and your verified primary email address from GitHub, and Guuey mints the sign-in token itself. We do not store your GitHub access token.
• Invitation data — when a workspace member invites a collaborator, we store the invited email address (provided by the inviter) to deliver the invitation and link it to an account on acceptance. If you do not have a Guuey account, we hold it only to manage the invitation; contact us at hello@guuey.com to have it removed.
• Builder content — the agent definitions you deploy: configuration, system prompts, code you upload, and the per-agent environment variables and secrets you set.
• Secrets and credentials — provider API keys you bring, hosted-MCP vault secrets, and connected-account OAuth tokens are encrypted with a managed key service before storage and are never returned in plaintext by listing APIs. Per-agent environment variables are stored and returned as plaintext configuration; use the secrets surfaces, rather than environment variables, for sensitive values.
• Conversation history — the messages exchanged with agents hosted on the Service, persisted so conversations can be resumed and reviewed.
• Agent memory and files — agents can store per-user files and memory so they can remember returning users; this data is scoped per app and per user.
• Usage and metering data — records of deployments, agent invocations, and metered LLM usage (measured in tokens), used to operate the Service and calculate billing.
• Billing data — handled by Stripe, our payment processor. Your card details are collected by Stripe and never touch Guuey systems; we receive only the billing metadata needed to manage your subscriptions and invoices.
• Email delivery data — we send transactional email (such as sign-up verification codes) through Amazon SES and monitor delivery telemetry (bounces and complaints) to keep email working. If you join our updates list, that list is also managed through Amazon SES.
• Operational logs and audit events — server and agent runtime logs and audit records of account and workspace actions, used to operate, secure, and debug the Service.
• Cookies and analytics — we use cookies to keep you signed in (authentication sessions), and guest chat sets the identifier cookie described below. On guuey.com, our documentation site (docs.guuey.com), and our blog (blog.guuey.com) we use PostHog, a product-analytics service, in cookieless mode: nothing is stored on your device — no cookie, no local storage — and visitors are counted with a short-lived, non-reversible hash that resets daily. It records page views, page leaves, and interactions such as clicks — including, on the documentation site, copying a code sample — along with standard request data (IP address and user agent). We also classify visits from automated tools and AI crawlers by user agent. Those events are anonymous: they are not tied to your name or email. In the web console, product analytics runs only if you accept the analytics prompt shown there; if you accept, PostHog stores an identifier in your browser (a cookie and local storage) and analytics events are associated with your account to understand and improve the Service. Declining stores nothing.

We use the data above to provide and operate the Service: to run your agents, persist and serve conversation history, meter usage, bill you, send transactional email (such as verification codes), secure the platform, respond to support requests, and improve the product. We do not use your builder content or conversation history to train machine-learning models, and we do not sell personal data.

Builders on Guuey can publish agents that their own end users interact with. When you use an agent published by a builder, the builder is responsible for that agent and for its relationship with you; Guuey processes your conversations, per-app memory, and related data on the builder’s behalf to run the agent.

Some capabilities are under your own control as an end user, not the builder’s: your Guuey-wide profile is shared with an app only if you grant that app access, and you can review, change, or deny those grants; you can link an identity from a builder’s own sign-in system to your Guuey account, and you can ask Guuey to delete what an individual app remembers about you. Builders can also ask us to erase an individual end user’s data for their app, and deleting an app or an account cascades deletion through the associated end-user data.

If you chat with a published agent as a guest (without signing in) — including through a public share link or an agent embedded on another website — we set a cookie containing a random guest identifier, store the conversation under that identifier so the chat can continue, and keep a per-agent daily message count for abuse prevention. Clearing the cookie starts a fresh guest identity. If you later sign up from a guest session, that guest conversation history is linked to your new account.

The Service runs on Amazon Web Services. Account data, agent configurations, and conversation history are stored in the AWS us-east-1 region (Northern Virginia, United States). Data is encrypted in transit and at rest, and per-agent secrets are additionally encrypted before storage.

We share data only with the processors needed to run the Service:

• Model providers — when your agent makes an LLM call through the Service, the request content (such as prompts and conversation messages) is proxied to the configured model provider (Anthropic, OpenAI, or Google) to generate the response.
• ggui (ggui.ai) — generative-UI rendering, operated by Loqu, Inc. Agents that use the default generative-UI server send tool-call content derived from your conversation, a per-app identifier, and a signed end-user token (a pseudonymous user ID and, where available, your email address and name) to the ggui service to render interfaces; usage records flow back for billing.
• Amazon Web Services — cloud infrastructure, storage, and email delivery, including transactional email and our updates mailing list (Amazon SES).
• Stripe — payment processing.
• PostHog — product analytics for the web console, docs.guuey.com, blog.guuey.com, and guuey.com; hosted on PostHog Cloud US (United States).
• Sign-in providers — Google, GitHub, or Apple, when you choose to sign in with them.

If you connect your agent to external MCP servers or other third-party services, data your agent sends to those services is governed by their own terms and privacy policies. Credentials stored in the hosted-MCP secrets vault and connected-account OAuth tokens are KMS-encrypted and decrypted only at call time. Values you place in per-agent environment variables (including tokens referenced by an agent’s external MCP configuration) are stored as plaintext configuration protected by our infrastructure-level encryption at rest, and are provided to your agent’s runtime environment while it runs. We may also disclose data where required by law.

We keep your account data, builder content, and conversation history while your account is active. Database point-in-time-recovery backups are retained for up to 35 days, deployment build artifacts expire after 30 days, and agent runtime logs (which can include conversation content) are retained for 30 days. When you delete an app, it enters a 30-day reversible window before its data is removed; account deletion follows the same 30-day window. Retention for other operational records is as described in the product documentation.

You can delete individual agents and their configuration from the console at any time; deletion becomes permanent after the 30-day reversible window. To delete your account and the personal data associated with it, request account deletion from your account settings — deletion completes after a 30-day window during which you can cancel — or contact us at hello@guuey.com and we will process the deletion. Account deletion cascades through your agents, workspaces, files, and profile data. Residual copies in backups age out within the retention windows above. You can clear or block cookies in your browser settings at any time; analytics cookies are not required for any Guuey site to work, though blocking authentication cookies will sign you out.

Agent workloads run on isolated infrastructure with sandboxing between customer workloads. Data is encrypted in transit and at rest, and secrets and stored credentials are additionally encrypted with a managed key service. Access to production systems is restricted to authorized personnel. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you as required by applicable law.

The Service is not directed to children under 13, and we do not knowingly collect personal data from them.

We may update this policy as the Service evolves. If a change is material we will give notice — for example by email or in the console — before it takes effect. The “Last updated” date above reflects the current version.

Privacy questions or requests: hello@guuey.com. See also our Terms of Service.