Privacy Policy

This policy describes how Foxl AI ("Foxl", "we") handles your information across Foxl Agent, Foxl Code and Foxl Notes, on desktop, web and mobile. It is written to describe what the software actually does. Where a product differs from the others, it says so per product rather than generalising.

1. What we collect

Account

• Email address. Required - it is your account identity and how sign-in links reach you.
• Display name and avatar. Optional. If you sign in with Google, Apple or GitHub we store the name and avatar that provider returns, refreshed on each sign-in unless you have set your own.
• Provider identity. For Google, Apple and GitHub sign-in we store the provider's immutable user id, so an account cannot be taken over by someone who later controls the same email address.
• Password. Only if you choose to set one. Stored as a PBKDF2-SHA256 hash with a per-account salt; we never store or log the password itself.

Usage and billing

• Token counts and request counts per model. Used to meter credits and enforce rate limits. These are the same records you can see on your own usage screen.
• Subscription tier and credit balance. Card details are handled by our payment provider; we never see or store them.

Devices and notifications

• Push token. If you enable notifications, the token Apple or Google issues for that device, so a notification can be addressed to it. Removed when you disable notifications or delete the account, and pruned automatically when the platform reports it as no longer valid.
• Session records. One row per signed-in device holding a coarse device description from your browser or app user agent, so you can see and revoke your own sessions.

Content, per product

• Foxl Agent. On the desktop app, conversations are stored locally on your machine. When you use the web or mobile app, each turn is relayed to the model provider you have selected and we record the token counts, not the message text.
• Foxl Code. Conversations, task plans and task event history are stored on our servers, because a coding task runs for minutes or hours across several invocations and has to survive you closing the app. Repository contents are cloned into a per-task sandbox and are not retained after the task ends.
• Foxl Notes. Notes and transcripts are stored on your device. While you are recording, audio is streamed to Amazon Transcribe to produce the live transcript; neither we nor the transcription service retain the audio afterwards. AI summaries send the transcript text to the model provider you have selected.

Logs

Our infrastructure provider processes request metadata, including IP address, in the course of serving and protecting the service. We keep a short-lived audit record of remote-access tunnel connections for abuse investigation.

2. What we do not do

• We do not advertise to you. There is no advertising SDK and no advertising identifier in Foxl. We do not combine your data with data from other companies, and we do not build advertising profiles.
• We do not put analytics in the apps. The Foxl desktop app and the Foxl apps for iOS and Android contain no analytics SDK and send no usage data. Our websites - foxl.ai, docs.foxl.ai, app.foxl.ai and code.foxl.ai - use Google Analytics to count page views, and only if you accept analytics cookies. See sections 3 and 4.
• We do not sell your personal information.
• We do not train models on your content. Foxl builds no models and trains nothing on what you write. Our hosted models run on Amazon Bedrock under an account configured for provider data sharing, which is a requirement of one of the models we offer, so content sent to a hosted model may be shared with that model's provider under their terms. If you would rather that did not happen, use your own provider key: those requests go to the provider directly under your own agreement with them, and are governed by it rather than by ours.
• We do not store your own provider API keys. If you bring your own key, it is held on your device. When a request is made through the relay the key transits our servers in order to reach the provider, and is not written to storage or logs.

3. Cookies and similar technologies

Foxl uses cookies and browser storage for two purposes.

• Strictly necessary. Sign-in and session storage, your preferences, and a device identifier that binds your session to this device. Foxl does not work without these, and they are not used for analytics. Your answer to the analytics question below is itself stored this way, because we need it in order to honour it.
• Analytics, only with your consent. On foxl.ai, docs.foxl.ai, app.foxl.ai and code.foxl.ai we use Google Analytics 4, which sets first-party cookies to count page views and returning visitors. We do not load Google Analytics and we do not set those cookies until you accept them. If you decline, nothing is loaded and nothing is sent.

You can change your answer at any time from the Cookie settings link in the footer of foxl.ai. One choice covers all four websites, and withdrawing it stops collection immediately.

We use no advertising cookies, and we allow no third party to advertise on our sites. The Foxl desktop, iOS and Android apps set no analytics cookie and load no analytics code.

4. Who processes your data

These are the third parties involved in running the service:

• Cloudflare - hosting, the database, and request routing for every surface.
• Amazon Web Services - Bedrock for models, Transcribe for live meeting transcription, and storage for Foxl Code task workspaces.
• Model providers you choose - Anthropic, OpenAI, Google, xAI, DeepSeek and Groq. A request only reaches a provider you have selected, and is governed by that provider's terms. Hosted models are reached through Amazon Bedrock under an account configured for provider data sharing; see the note above on model training.
• Resend - transactional email (sign-in links, receipts, and product notices you have not turned off).
• Apple and Google - push notification delivery to your devices.
• GitHub - only if you connect a repository to Foxl Code.
• Google Analytics - page-view measurement on our websites, and only if you accept analytics cookies. It receives your IP address (truncated by Google), the page you viewed, your browser and device type, and an approximate location derived from that address. It does not receive your conversations, notes, files, code, or account identity.

5. Recording other people

Foxl Notes records whatever your microphone can hear, which in a meeting includes other participants. Laws on recording conversations differ by country and by state, and in many places every participant must consent. You are responsible for having that consent before you record.

6. Retention

• Account and profile data: kept while the account exists.
• Usage and credit records: kept for billing history and dispute resolution.
• Foxl Code conversations and task history: kept until you delete the task or the account.
• Meeting audio: not retained after the recording ends.
• Push tokens: removed when notifications are disabled or the token stops working.
• Tunnel audit records: retained briefly for abuse investigation, then pruned.

7. Your choices and rights

• Export. Settings has a data export that returns your account data as JSON.
• Delete. Settings has account deletion. It removes your account and the records keyed to it. Deletion is permanent.
• Email. Product notices can be turned off, and marketing email is off unless you explicitly turn it on. Every marketing email carries a one-click unsubscribe that works without signing in. You can manage this at relay.foxl.ai/email/preferences using the link in any email we send.
• Notifications. Each notification category has its own switch in Settings, and marketing notifications are off unless you turn them on.
• Analytics. Nothing is collected until you accept, and you can withdraw at any time from the Cookie settings link in the footer of foxl.ai. One choice covers all four websites. Withdrawing stops collection immediately rather than at the end of the visit.
• Access and correction. Email us and we will help. If you are in a jurisdiction with statutory data rights, they apply.

8. Security

• HTTPS/TLS for everything in transit; encryption at rest in the database.
• Short-lived access tokens with rotating refresh tokens, and per-device sessions you can revoke.
• TLS between the web or mobile app, the relay, and your own desktop. The relay stores none of that traffic, but it can read the messages it routes - it is a trusted-service hop, not an opaque pipe. Run the desktop locally with remote access off and no relay is involved at all.
• Passwords hashed with PBKDF2-SHA256 and a per-account salt, never stored in plain text.

No system is perfectly secure. We aim to be honest about the boundaries rather than promise more than software can deliver - see the security documentation for where each product keeps its data.

9. Children

Foxl is not intended for children under 13, and we do not knowingly collect their information.

10. International transfers

Our infrastructure is globally distributed and our model and transcription providers operate in the United States. Using Foxl involves transferring your information to those facilities.

11. Changes

We will update this page when the product changes, and will tell you about material changes by email or in the app.

12. Contact

Questions about privacy, or a request about your data: support@foxl.ai.