furybot

Nothing you send goes to a third-party AI service

Generation and chat run on infrastructure we operate and control — hardware we own today, and possibly capacity we rent as the service grows, but in every case administered by us with the data on it under our control. Your prompts, photographs and conversations are never sent to OpenAI, Anthropic, Google, Stability or anyone else for processing.

If that ever stops being true — if any part of generation moves to a third party's service — this policy changes first and says so plainly. It is the single commitment the rest of this document rests on.

One exception exists and it is opt-in per request: if you explicitly escalate a chat message to a frontier model, that message is sent to that provider. It does not happen silently and it does not happen by default.

What we collect

Deliberately little.

• Account: a username, an email address, a password hash, and your declared date of birth. No name, no address, no phone number.
• Content: the prompts you write, the files you upload, the files you generate, and your chat messages.
• Operational: sign-in times, a client IP address on security-relevant events, and counts of what you generated for rate limiting and billing.
• Support: anything you write in a support request.

What we never collect

We do not store payment card details. When you buy a paid plan, card data goes directly to Stripe, our payment processor, and never touches our servers — we hold only a Stripe customer reference, subscription state, and your plan tier.

There is no third-party analytics, no advertising network, no tracking pixel and no third-party cookie. The only cookie is the one that keeps you signed in.

We do not use your content to train models.

Organizations on their own hardware (Galtops)

When an organization runs the platform on hardware they control, we do not monitor what they do with their models, prompts, or workloads on that hardware. Inference stays on their side; we are not in the request path.

What we do enforce is a license to operate: their deployment periodically pulls entitlement status from our control plane (active, past due, or suspended, plus budgeted seats and concurrency). That is commercial and operational control — whether the organization is paid up and within its allocation — not content surveillance.

Child-safety and the other legal floors on this public demo (Furybot) are obligations of a shared service we run. They are separate from the promise that we do not spy on a customer's private GPU, and a license status never lifts those floors anywhere.

How long things are kept

Retention is short by default and enforced by a sweeper rather than by good intentions:

• Uploaded photographs: deleted when the job finishes, overwritten with seven random passes and a zero pass rather than merely unlinked. A janitor removes anything missed after two hours.
• Generated files: erased when you delete them, and swept automatically after twenty-four hours.
• Prompt text: blanked after twenty-four hours. The job record survives so your gallery still works; the words do not.
• ComfyUI's own history, which otherwise keeps the entire graph including your prompt forever, is purged per job regardless of the above.
• Logs: rotated and shredded every twelve hours.
• Expired sessions: swept hourly.

The one category we deliberately keep

When a request crosses one of the four hard limits, we record it: the prompt text, the terms that matched, which tool was used, and the client IP address. This record is not deleted on the ordinary schedule.

We keep it because a safety control that forgets is not a safety control — a pattern of attempts is the thing worth being able to see, and the obligation attached to the child-safety limit is not one we may discharge by discarding the incident record.

These records are encrypted at rest, readable only by an administrator, and purgeable from the admin console. We would rather tell you this plainly than write a privacy policy that omits the single category we keep on purpose, because a policy that conceals that retention is not credible about anything else.

Where the law requires a report to the National Center for Missing & Exploited Children, the associated material is preserved for as long as the obligation requires and is not deleted on request.

Counting visitors, without identifying them

We count how many people use the service and how often. What is stored for that is one number per visitor per day — and the visitor is a salted digest, not your address. The salt is regenerated every day and never written down, so the stored value cannot be reversed to an address by us or by anyone who takes the database, and cannot be matched to the same person on a different day.

Nothing about what you did is attached to it. Not the page, not the account, not the prompt, not the result. It answers how many people came and how often, and it is not capable of answering anything else.

Your address is recorded against an action in exactly one case, and it is the one already described above: when a request crosses one of the four hard limits. That is the deliberate retention, and it is separate from this.

Encryption

Prompts, chat messages, support request bodies, queued email, two-factor secrets and incident records are encrypted at rest with AES-256-GCM. The database file additionally has secure delete enabled, so a deleted row is overwritten rather than left readable in free pages.

Traffic to the site is TLS only, with older TLS versions refused.

Deleting your account

Ask us and your account goes, along with your credentials, two-factor secret, recovery codes, any live password-reset or confirmation links, your conversations, jobs, support messages, declared date of birth, stored balance, anything you asked the assistant to always know about you, and any queued email — that last one matters because queued mail carries your address.

Two things can lag for up to 24 hours after deletion, and both are worth stating rather than glossing. If your account belonged to an organization using shared learning, a short unattributed summary of prompt intent may persist in that organization's shared learning pool; it is a merged summary with no name or account attached and cannot be separated per person, which is why it expires rather than being deleted — an organization administrator can also purge it at once. Separately, short-lived cached copies of your own conversation context, recent history, and personal learning may remain in the organization's cache until their time-to-live expires; nobody can sign in as the deleted account to read them, and they are not copied out of that cache.

What survives beyond that is listed in the terms and is limited to legal reports and holds, the safety record, and accounting records. Their link to you is left pointing at an account that no longer exists.

Who else sees anything

No one buys this data, because we do not sell it. It is disclosed only where the law compels it, where it is necessary to make a report the law requires, or to a service provider that is part of running the service.

Today that includes the email sender that delivers confirmation and reset messages (email address and the text of that message), and Stripe when you pay for a plan (billing identity and payment details handled on Stripe's side; we receive customer and subscription references, not card numbers). Tax authorities may receive what the law requires when we collect tax.

Your rights

You can see and change your account details from your profile, download anything you have generated, and ask for the account to be deleted. Depending on where you live you may also have the right to a copy of your data or to object to some processing. Ask through the contact page.

Where this runs

The service is operated from the United States and data is processed there.

Children

This service is for adults. Registration refuses anyone declaring an age under 18, and we do not knowingly collect anything from a child. If you believe a child has created an account, tell us through the contact page and it will be removed.

Questions

Anything here that is unclear, or that does not match what the service actually does, is worth telling us about — write through the contact page. The full list of what we refuse and the law behind each item is at what we block.