Privacy Policy

Byoky is a local wallet. Your API keys and OAuth tokens are encrypted on your device and never leave it, except when the wallet sends a credential to the LLM provider it belongs to in order to make a request that you, or an app you approved, initiated. Byoky does not operate any service that receives your keys, prompts, responses, or usage data: there are no Byoky accounts, no cloud sync, no relay, no gift or token-pool service, and no app registry. The only service we operate is the byoky.com website. We do not run analytics, do not log prompts or responses, and do not sell or share data with advertisers.

The data controller for the byoky.com website is:

• Michael Lodzik
• Vienna, Austria
• Email: privacy@byoky.com

The Byoky browser extension, the iOS and Android apps, the Byoky Bridge, and the SDK run entirely on your own devices. Using them does not create a data controller relationship with us, because no personal data from them ever reaches us.

The Byoky software processes the categories below locally on your device. None of it is sent to us.

• Authentication credentials. The API keys and OAuth tokens you voluntarily add to Byoky for LLM providers (Anthropic, OpenAI, Google Gemini, Mistral, Cohere, xAI, DeepSeek, Perplexity, Groq, Together AI, Fireworks AI, OpenRouter, Azure OpenAI).
• Local-only request log. A history of which apps used which credentials, kept in the wallet's local storage. This never leaves your device.
• App-permission settings. If you create groups or authorize apps, the resulting policy mappings, spending caps, and routing rules.
• Encrypted backups. If you export a .byoky backup file, it is written to a location you choose and protected by a password you set. We never receive it.

When you visit byoky.com, our hosting provider processes standard HTTP request logs for the website (see below). We do not collect anything else.

• Directly from you. All authentication credentials and settings are entered by you in the extension or mobile app and stay on your device.
• Generated by your use of the software. The local-only request log is generated on your device as a byproduct of LLM calls you or your approved apps initiate. We do not buy, scrape, or otherwise acquire personal data from third parties.

The Byoky software uses the data described above only for these purposes:

• To authenticate you to the LLM providers whose keys you supplied.
• To proxy LLM API calls on your behalf, directly from the wallet on your device (the extension or the mobile app) or through the Byoky Bridge on your own computer.
• To show you a per-app history of which credentials were used and how many tokens were consumed, so you can audit and revoke access.
• To enforce the app permissions, groups, routing rules, and spending caps you set.

We do not use your data for advertising, profiling, training machine-learning models, or any purpose unrelated to the user-facing features above.

• On your device. All credentials are encrypted with AES-256-GCM using a key derived from your master password via PBKDF2 (600,000 iterations) and stored in the browser extension's local storage or in the iOS/Android secure store. Your master password hash is stored locally for unlock verification only.
• Not on our servers. Byoky has no backend that stores credentials, account records, request metadata, or policy data. Nothing you add to the wallet is uploaded to us.

Data leaves your device only in the following cases:

• LLM providers you have configured. When you make an LLM call, the wallet forwards your prompt and the relevant API key or OAuth token directly to the provider you selected (Anthropic, OpenAI, Google Gemini, Mistral, Cohere, xAI, DeepSeek, Perplexity, Groq, Together AI, Fireworks AI, OpenRouter, or Azure OpenAI). The provider then handles the request under its own privacy policy, which we do not control.
• Apps you connect. When you approve an app, or open one in the mobile app's built-in browser, it receives a session token and the responses to the requests it makes through the wallet. It never receives your keys. What the app does with your prompts and responses is governed by that app's own privacy policy.
• Vercel (US) — infrastructure subprocessor. Hosts the byoky.com website, including this Privacy Policy and the docs. Vercel processes standard HTTP request logs for the website itself.
• Resources loaded by the website. Some byoky.com pages load provider icons from unpkg.com and the GitHub star count from api.github.com directly in your browser. Those services receive your browser's request under their own policies.

We do not sell your data, share it with advertisers, or transfer it to data brokers. We do not disclose data to law enforcement except where required by enforceable Austrian or EU law.

Byoky has no user accounts and no cloud sync. Your credentials exist only in the wallet on the device where you added them. To move them to another device, you can export a .byoky backup file protected by a separate password and import it on the other device. Where you keep that file is up to you; it does not pass through our servers.

The extension declares the nativeMessaging permission so it can talk to the optional Byoky Bridge — a local helper you can install separately to use Byoky credentials from CLI or desktop apps. The Bridge runs entirely on your computer. Data exchanged between the extension and the Bridge does not leave your device, is not transmitted to our servers, and is not shared with any third party.

The extension injects a content script on all websites (<all_urls>) so that any page implementing the Byoky SDK can request a proxied LLM call. The content script only listens for BYOKY_* messages posted by the page; it does not read page content, form data, cookies, browsing history, or any other data on the websites you visit. The host permissions for LLM provider domains exist solely so the extension can forward your authenticated requests to those providers.

• Local data. Stays on your device for as long as you have the extension or mobile app installed. Uninstalling the extension or app removes it. Backup files you exported stay wherever you saved them until you delete them.
• Website server logs (Vercel). Standard HTTP logs retained for up to 30 days.

Our website hosting provider (Vercel) operates from the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, visiting byoky.com involves an international transfer of the HTTP request data described above. We rely on the European Commission's Standard Contractual Clauses (SCCs) and the provider's implementation of equivalent safeguards as our legal mechanism for this transfer. The Byoky software itself transfers no data to us.

If the GDPR applies to you, you have the following rights with respect to personal data we process about you:

• Right of access (Art. 15) — request a copy of your data.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21).
• Right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at) or with the supervisory authority of your country of residence.

Data held by the Byoky software lives only on your device: you can export it or delete it in the wallet's Settings, or remove it by uninstalling. For anything else, email privacy@byoky.com. We respond within 30 days.

Legal basis for processing under GDPR Art. 6: our legitimate interest in operating and securing the website (Art. 6(1)(f)) for website request logs.

• We do not operate servers that receive your keys, prompts, responses, or usage data.
• We do not collect analytics, telemetry, or tracking data in the extension.
• We do not track your browsing activity.
• We do not log prompts, completions, IP addresses, or user agents.
• We do not use cookies in the extension.
• We do not sell or share data with advertisers or data brokers.
• We do not use your data to train machine-learning models.

Byoky is not directed to children. We do not knowingly collect data from children under 14 (the digital-consent age in Austria) or under the age of digital consent in your country, whichever is higher. If you believe a child has provided us with data, contact privacy@byoky.com and we will delete it.

Byoky is fully open source under the MIT license, including the extension, the mobile apps, the bridge, the SDK, and this website. You can audit every line at github.com/MichaelLod/byoky.

If we make material changes to this policy we will update the “Last updated” date on this page.

Privacy questions, GDPR requests, or data-deletion requests: privacy@byoky.com. General support: support@byoky.com.