← Back to Bonnet · Terms

Privacy Policy

Last updated September 29, 2026.

Bonnet is designed so that generated scripts execute locally on the user's computer. The desktop app stores button metadata, execution state, and preferences in a local SQLite database. This page lists what does leave your device, where it goes, and how long it is kept. The Bonnet website loads no analytics or advertising scripts and no third-party fonts, and the desktop app sends no usage analytics.

Prompt data and AI providers

When you create or refine a button, your prompt and related generation context — for example the button’s current script and any error output — are sent to the AI provider you chose. So are the prompt and the values you enter when you press a button whose job is an AI prompt. Which route they take depends on that provider:

• Anthropic, OpenAI, Grok, DeepSeek, and OpenRouter (your own API key): the request goes through Bonnet’s relay at bonnet.ink, in both the desktop app and the browser version. Your key travels in a request header for that one call and is forwarded to the provider. The relay does not store the key, the prompt, or the answer.
• ChatGPT sign-in, in the desktop app: the app talks to OpenAI directly. The sign-in tokens stay on your computer, encrypted with Windows data protection, and never pass through Bonnet’s servers.
• ChatGPT sign-in, in the browser version: a browser cannot call OpenAI directly, so the sign-in steps and each request are relayed through bonnet.ink. Your ChatGPT access and refresh tokens are kept in your browser’s storage. The access token is sent with each generation request and forwarded to OpenAI; the refresh token is sent only when the access token needs renewing. The relay stores neither.
• A local model server: requests go to an address on your own computer and never leave it. Bonnet only accepts localhost addresses for this option.

Your provider’s own terms and privacy policy govern what it does with the prompt. In the desktop app your provider key is kept in Windows Credential Manager. In the browser version it is kept only if you choose to remember it, in your browser’s storage; otherwise it is held in memory for the tab and forgotten when you reload.

Local data

Button definitions, saved inputs, approvals, and execution history are stored locally in the app’s data directory. In the browser version, they are stored in that browser’s storage (IndexedDB, or local storage where IndexedDB is unavailable). Shared buttons exported from the app intentionally exclude local execution history.

Live faces that show system or audio activity read CPU load, memory use, or the level meter of your microphone or speakers, only while such a face is loaded in a Bonnet window. A face that is scrolled out of view or on another page keeps reading for as long as it stays loaded, and reading stops when the face is removed or its window closes. Only numbers are read; no audio is recorded, and nothing from these readings is sent to Bonnet. What a script does with your files or network is up to that script and the permission level you gave it; Bonnet does not receive it.

Accounts

Signing in is optional. The desktop app works with a license key alone, and the browser version can be used without an account. If you do sign in with Google or GitHub, Bonnet receives a provider account identifier and your verified email address, and stores the identifier as a keyed hash. The email address is stored as is, so your account page can show it and a purchase can be matched to it. Bonnet does not receive your password, and it asks Google only for your identity and email and GitHub only for your profile and email address — no access to your files, repositories, or contacts.

Library sync

Sync is off by default and must be turned on explicitly. While it is on, the buttons you have chosen to sync — including their scripts, icons, images, input and output definitions, and the prompts you used to create and refine them — are stored on Bonnet’s servers, together with your pages, layouts, custom categories, swatches, saved looks, theme, and view preferences, so the same library appears everywhere you sign in. Execution history, saved input values, approvals, AI provider keys, ChatGPT tokens, and your license key are never uploaded.

Turning sync off stops further uploads; it does not remove what is already stored. Deleting a button while sync is on removes it from the server, with a deletion record (without the button’s content) kept so that other signed-in devices learn it was deleted. A record older than 30 days is discarded the next time your library is written, so one can outlast 30 days if nothing is synced in between.

Stickerbook

If you sign in on the Bonnet website, the stickerbook there can be saved to your account: its pages, which stickers sit where, your doodles, how stickers are dressed, and any sticker sheets you cut. This needs an account but not a license. Deleted pages, sheets, and looks leave a deletion record so your other devices follow along; a record older than 30 days is discarded the next time your stickerbook is saved.

Billing data

Stripe processes the one-time purchase. Bonnet does not store raw card details; it only stores the billing email and Stripe purchase identifiers required to deliver and verify licenses. License keys are stored as keyed hashes rather than plaintext.

Public shares

Publishing a button uploads its script, prompt history, and portable configuration to a public link. Anyone with that link can read it. Shares expire 180 days after they are published (the default; the server can be configured for a shorter or longer lifetime, up to a year) and can be removed earlier using the private deletion capability returned to the publishing app; the server keeps only a keyed hash of that capability. A share does not record who published it.

What Bonnet’s servers see

Requests to bonnet.ink carry your IP address, as any web request does. To limit abuse, Bonnet keeps your IP address only as a keyed hash inside request counters for sign-in, checkout, sharing, license, and AI requests. The counters cover windows of an hour or a day, and the readable address is not stored.

The desktop app and the browser version each generate a random installation ID. It is sent when the app asks for an AI session or checks your license entitlement, and is used in hashed form to rate-limit requests and to tie a signed entitlement to that installation.

The site sets two cookies. bonnet_session keeps you signed in and lasts 30 days. bonnet_checkout_claim lets your browser collect the license key after a purchase and lasts 30 days. There are no advertising or analytics cookies.

The desktop app checks GitHub Releases for signed updates when it launches, at most once every six hours, so GitHub sees that request as it would any download.

Who processes data for Bonnet

The Bonnet website and its API are hosted on Vercel, and account, library, share, license, and sticker data is stored in an Upstash Redis database. Stripe processes payments. Google and GitHub confirm your identity if you sign in with them. The AI provider you choose — Anthropic, OpenAI, xAI (Grok), DeepSeek, or OpenRouter — receives your prompts as described above, and GitHub hosts app updates.

Deleting your data

You can delete synced buttons from within the app, delete a public share with its deletion capability, and sign out to end your session. There is no self-service account deletion yet; requests about your account or stored data can be sent to hello@bonnet.ink.

Questions

Questions about privacy can be sent to hello@bonnet.ink.