Privacy Policy

• API keys & access tokens — stored in your operating system’s keychain, encrypted. Never transmitted to us.
• Tool configurations & run history — kept in a local database on your machine.
• Your prompts, inputs, and agent outputs — processed locally and sent only to the model/tool providers you configure. We are not in that path.

• Anonymized, aggregate usage analytics — which features are used, error categories, and performance metrics. No prompts, no credentials, no personal content. This helps us improve the product.
• Account information — if you sign in or subscribe, our auth provider (Clerk) and payments provider (Stripe) process your email and billing details to run your account. We don’t store your card data.
• Team-shared definitions — if you share a skill or harness with your team, the definition syncs through our API so teammates can use it. It carries no credentials; secrets always stay local.
• Optional encrypted backups — if you enable backup, your personal run history is encrypted on your device before it’s stored. We hold only ciphertext we can’t read.

We don’t sell your data, and we never share your prompts, traces, or content with advertisers or model providers for training. We use a small set of infrastructure providers to run the service: Clerk (authentication), Stripe (payments), Vercel (hosting), Cloudflare (storage/CDN), and our analytics pipeline. Each processes only what’s needed for its function.

You can access, export, or delete your account data at any time. For requests under GDPR, CCPA, or similar laws — including data deletion or a copy of what we hold — email privacy@invoked.ai and we’ll handle it promptly. Because most of your data lives on your device, you’re already in control of the bulk of it.

Invoked is not directed to children under 13, and we don’t knowingly collect their data.

We’ll post any material changes here and update the date above. Questions about privacy? Email privacy@invoked.ai. For our security posture, see the security page.