chatbarry

Terms of Service & Privacy Policy

Last updated: July 3, 2026

Terms of Service

1. Overview

ChatBarry (“we”, “us”, “the service”) is a self-hosted, multi-user agentic chat platform. It lets you converse with AI models, give the AI agent tools to act on your connected services, schedule automated agents, and organise your work into projects. The service is provided to you on an “as is” basis.

2. Your Account

You create an account with an email address and password. You are responsible for keeping your credentials secure and for all activity under your account. You must be at least 13 years old (or the minimum age in your jurisdiction) to use the service.

3. Your Content

You retain ownership of all content you submit — chats, documents, prompts, and any data in your connected services. You grant us permission to process this content solely to provide the service to you, including sending it to the AI model providers and connected integrations you have configured.

4. Acceptable Use

You agree not to:

  • Use the service for any unlawful purpose or in violation of any applicable law.
  • Attempt to access another user’s data, accounts, or connected services.
  • Submit content that infringes the rights of any third party.
  • Use the agent or tools to send spam, harass others, or automate actions that violate the terms of any connected third-party service.
  • Attempt to disrupt, reverse-engineer, or overload the service.

5. AI Output

Output generated by AI models may be inaccurate, incomplete, or offensive. You are responsible for reviewing and verifying any output before relying on it. The service is a tool to assist you; it does not provide professional advice.

6. Connected Services

You may connect third-party accounts and services (such as Google, Trello, Slack, or others) to the service. When you do, you authorise us to access those services on your behalf to the extent you have granted. You are responsible for complying with the terms of each connected service. You may disconnect any service at any time, which revokes our ongoing access (subject to the third party’s own token-revocation behaviour).

7. Termination

You may delete your account at any time from Settings, which permanently removes your data from the service. We may suspend or terminate access if you violate these Terms.

8. Disclaimer & Limitation of Liability

The service is provided “as is” and “as available” without warranties of any kind. To the maximum extent permitted by law, we are not liable for any indirect, incidental, or consequential damages, or for any loss of data arising from your use of the service or any connected third-party service.

9. Changes

We may update these Terms from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use after changes constitutes acceptance.

Privacy Policy

This Privacy Policy explains what personal data ChatBarry collects, why, and how it is used and protected. It applies to all users of the service.

Data We Collect

To provide the service, we collect and process the following:

  • Account information — your email address, name (optional), and timezone. Passwords are stored as one-way bcrypt hashes (never readable).
  • Chat content — your conversations, messages, and prompts.
  • Documents & uploads — text documents you attach (stored as text and injected into the conversation). Images are stored in Cloudflare R2 object storage when you use multimodal chat.
  • Long-term memory — the service builds a per-user memory store (via the DiffMem component) from your conversations to personalise future responses.
  • AI provider credentials — API keys you add for model providers (OpenAI, Anthropic, OpenRouter, etc.). These are encrypted at rest and decrypted in memory only for the duration of a model call.
  • Connector credentials — credentials you provide for connected services (e.g. a Slack bot token, a Trello key, SMTP settings, or a Google OAuth token set). All credentials are encrypted at rest.
  • Usage data — token counts and cost estimates per model call, used to display your usage and enforce budgets.
  • Agent run records — inputs, outputs, and step logs for scheduled (cron) agents you configure.

How We Use Your Data

Your data is used solely to operate the service for you:

  • To run conversations and stream AI model responses.
  • To execute the tools and connectors you have explicitly connected and enabled.
  • To store and retrieve long-term memory that personalises your experience.
  • To run scheduled agents on your behalf at times you specify.
  • To display usage and cost analytics to you.

We do not sell your data. We do not use your content to train AI models — the models you interact with are provided by the third-party AI provider you configure, and are governed by that provider’s own terms.

Google API Data Usage

When you connect a Google account, ChatBarry requests access to the following Google API scopes. Access is granted only with your explicit consent via Google’s OAuth flow, and you may revoke it at any time from your Google account or by disconnecting the account in ChatBarry.

  • Google Docs API — create, read, and edit documents you own or have granted the app access to.
  • Google Sheets API — create, read, and write spreadsheet data.
  • Google Slides API — create presentations and add slides.
  • Google Calendar API — list, create, update, and delete calendar events.
  • Google Drive (drive.file) — access only files that ChatBarry creates, or that you explicitly open with ChatBarry. The app cannot browse your entire Drive.
  • OpenID Connect (openid, email, profile) — read your account email, name, and profile picture to label the connection.

Limited use.ChatBarry’s use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements. We transfer Google data to third parties only as necessary to provide the feature you requested (for example, passing a document’s text to the AI model you have selected) and do not use Google data for advertising or to train our own models.

Gmail is not accessed. ChatBarry does not request or use any Gmail scopes. The app does not read, send, or manage your email through Google.

Third-Party Services

ChatBarry is self-hosted but interacts with several third-party services. Data you provide is shared with these services only when you configure them and only to perform the action you requested:

  • AI model providers(e.g. OpenAI, Anthropic, OpenRouter) — your conversation content is sent to the provider whose key you configured so it can generate responses. Governed by that provider’s privacy policy.
  • Google — Docs, Sheets, Slides, Calendar, and Drive (file-level) access via OAuth, as described above.
  • Tavily & Serper— web-search providers used by the agent’s search tool when you have configured an API key.
  • Trello, Todoist, Slack, Stripe — productivity integrations you connect. The agent acts on these only with the credentials you provide. Stripe access is read-only.
  • Email (SMTP) — when configured, the agent can send email through your SMTP server (e.g. PurelyMail, Gmail SMTP, Amazon SES).
  • Custom MCP servers — you may connect any remote Model Context Protocol server; the agent calls tools on that server per its own terms.
  • Cloudflare — used for image storage (R2) and signup-verification email sending. These are configured at the instance level, not per-user.

Each third-party service has its own privacy policy governing how it handles your data once received. We encourage you to review those policies.

Security

We take reasonable measures to protect your data:

  • Encryption at rest — all API keys, connector credentials, and OAuth token sets are encrypted with AES-256-GCM. Plaintext is held in memory only for the duration of the operation that needs it and is never logged.
  • Password hashing — passwords are stored as bcrypt hashes; the service cannot read your password.
  • Secure sessions — authentication uses httpOnly cookies with JWT sessions.
  • Network isolation — the database and cache bind to localhost only and are not exposed publicly. The only public port is the web application.
  • Per-user isolation— all data queries are scoped to your user account; no user can access another user’s data.

No method of transmission or storage is completely secure. If a data breach occurs we will notify affected users in accordance with applicable law.

Data Retention

Your data is retained for as long as your account is active. When you delete your account, your data is permanently removed from the primary database (via cascading deletion). Best-effort cleanup is also requested from the memory store, cache, and task queue; external services (e.g. your connected Google account) retain their own copies of any data you created through them, governed by their own policies.

OAuth tokens for disconnected accounts are deleted immediately. Access to a connected service can also be revoked at any time from that service’s own settings (e.g. your Google account security page).

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. You can exercise most of these directly within the service:

  • Access & export — view your chats, settings, and connectors within the app.
  • Correction — edit your name, timezone, and credentials at any time from Settings.
  • Deletion— delete individual chats, or delete your entire account permanently from Settings → Account.
  • Revoke access — disconnect any connected service at any time.

To exercise any other right, contact us using the details below.

Contact

If you have questions about these Terms, your data, or your account, contact:

Replace [email protected] with your preferred contact address by editing this page at src/app/(public)/terms/page.tsx.