Privacy Policy
Last updated June 2026
The short version: Invoked is local-first. Your most sensitive data — API keys, tool configurations, and run history — stays on your machine. We can’t see it, and we don’t want to. This page explains exactly what we do and don’t collect.
What stays on your device (and never reaches us)
- API keys & access tokens — stored in your operating system’s keychain, encrypted. Never transmitted to us.
- Tool configurations & run history — kept in a local database on your machine.
- Your prompts, inputs, and agent outputs — processed locally and sent only to the model/tool providers you configure. We are not in that path.
What we do collect
- Anonymized, aggregate usage analytics — which features are used, error categories, and performance metrics. No prompts, no credentials, no personal content. This helps us improve the product.
- Account information — if you sign in or subscribe, our auth provider (Clerk) and payments provider (Stripe) process your email and billing details to run your account. We don’t store your card data.
- Team-shared definitions — if you share a skill or harness with your team, the definition syncs through our API so teammates can use it. It carries no credentials; secrets always stay local.
- Optional encrypted backups — if you enable backup, your personal run history is encrypted on your device before it’s stored. We hold only ciphertext we can’t read.
Who we share data with
We don’t sell your data, and we never share your prompts, traces, or content with advertisers or model providers for training. We use a small set of infrastructure providers to run the service: Clerk (authentication), Stripe (payments), Vercel (hosting), Cloudflare (storage/CDN), and our analytics pipeline. Each processes only what’s needed for its function.
Your rights
You can access, export, or delete your account data at any time. For requests under GDPR, CCPA, or similar laws — including data deletion or a copy of what we hold — email privacy@invoked.ai and we’ll handle it promptly. Because most of your data lives on your device, you’re already in control of the bulk of it.
Children
Invoked is not directed to children under 13, and we don’t knowingly collect their data.
Changes & contact
We’ll post any material changes here and update the date above. Questions about privacy? Email privacy@invoked.ai. For our security posture, see the security page.