The short version: we hold your email. Your machine holds everything else.
Roy is designed so that the interesting data — your mail, calendar, notes, calls, memory — never reaches us. This page says exactly what does. Last updated 20 September 2026.
1. Two different things: this website, and Roy
This website (the account you create here) is the only part of Roy that runs on our servers. Roy the product runs on your own computer. The two talk once: your install checks your license key against your account to learn which plan you're on. Nothing about your day travels with that call.
2. What this website stores
When you create an account we store:
- The name you asked Roy to call you and your email address.
- A salted hash of your password (PBKDF2-SHA256). We cannot read the password itself.
- Your chosen plan, your trial dates and billing status, and your license key.
- A log of which installer you downloaded and when, so we can tell you when a build for your platform ships.
- A session token in one cookie (
roy_site_session) so you stay signed in. It is stored hashed, expires after 30 days, and is deleted when you log out. There are no analytics or advertising cookies on this site. - The six-digit codes we e-mail you (stored hashed, 15-minute life, single use), and — if you sign in with Microsoft or Google — the provider's stable account id, so the same account signs in next time.
When payment collection launches, card details will be handled by the payment processor, never stored by us; this page will be updated before that happens.
3. What Roy stores — on your machine
Everything Roy reads or writes stays on the computer you installed it on: mail and calendar caches, transcripts, People records, projects, drafts, its long-term memory (plain notes in your own vault), the learned profile, and an audit log of every action it took. Your API keys and tokens live in your operating system's credential store. We have no access to any of it, and Roy has no telemetry that reports it to us.
Roy does send data to the services you connect, on your own keys and credentials — for example the text of a thread to one of the AI providers to draft a reply, or a request to Microsoft Graph to read your inbox. Those providers' privacy terms apply to those calls. You choose which providers to connect, and you can disconnect any of them in Settings.
If you turn on the money desk, Roy keeps a mirror of your transactions on your machine — every customer paid and every person you paid is personal data too — for 730 days by default (a setting you can change), after which it exports them to a CSV on your disk and prunes the mirror; the payments, bills and invoices themselves stay as records. Payments run on PXP under your own merchant account, so PXP is a sub-processor for the money you move: the payment, payout or invoice you approved, and the card or account tokens it holds for you. Connect QuickBooks or Xero and Roy reads your books nightly and writes an entry only after you accept it.
If you sign in with Microsoft or Google, Roy reads only the verified e-mail address and name from the sign-in token and stores nothing else from it. Passkeys are stored as public keys; the private half never leaves your device.
4. What we don't do
- We don't sell, rent or share your account data with anyone.
- We don't run third-party trackers, ad pixels or fingerprinting on this site.
- We don't proxy your prompts or your data through our servers.
- We don't email you except about your account, your trial, or a build you asked to be told about.
5. Where and how long
Account records live on the server that runs this site and are kept for as long as your account exists. Downloads log entries are kept for 12 months. Backups are encrypted at rest and rotate out within 30 days.
6. Your rights and deleting everything
You can see everything we hold on your account page. To delete your account and all of the above, email hello@roychat.com from the address on the account; we delete within 7 days and confirm. Deleting your account does not touch the data on your machine — uninstalling Roy and removing its data folder does that.
If you're in the EU/UK you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR; the same address handles those requests.
7. Changes
If this policy changes in a way that matters, we'll say so on this page and, if you have an account, by email before it takes effect.
8. Contact
hello@roychat.com. A person answers.