Privacy at Gobare
What this website stores, what the Agent API does with your model key and your session data, and what leaves the machine a session runs on. Written to describe behaviour you can verify rather than to describe intentions.
This website
This marketing site sets no cookies and runs no analytics, advertising or session-replay script. It stores three values in your browser’s local storage, all of them interface preferences and none of them sent anywhere: the colour theme you picked, the language you picked, and which of the two products you were last reading about. Clearing site data removes them and the site behaves as it does for a first-time visitor.
Fonts are served from this origin rather than from a third-party font host, so loading the page does not disclose your visit to anyone but us.
Your model key
Gobare never holds your provider key at rest in a session. It is used to authenticate a single model call and is kept in memory for the length of that call. It is not written into the sandbox’s environment variables and it is not written to disk, which means an agent running inside the session cannot read it however it inspects its own environment.
Gobare does not resell model credits, so your prompts and completions are billed by your provider on your own account, under your provider’s terms and retention policy rather than ours.
Session data
A session is a computer. What you send it, what the agent does, what it writes to the workspace and what it produces as artifacts are stored so that your own product can read them back — that is the point of the API, and it is why a transcript and its artifacts outlive the session that made them. Anything you put into a session should be treated as data you have chosen to store with us.
A preview URL makes what the agent built reachable by other people. That is its purpose, and it means anything served from a session preview is public to whoever has the URL. Do not put data in a preview that you would not put on the open web.
What this page does not yet state
This page describes behaviour that can be checked. It does not yet state a data controller of record, a postal address, a retention period in days, a list of subprocessors, or a lawful basis under GDPR or an equivalent regime. Those are statements the company has to make rather than statements that can be read off the product, and publishing a guess for any of them would make this page less trustworthy rather than more. If you need them for a procurement or compliance review, ask on Discord and we will answer specifically.