Privacy Policy

Last Updated: 2026

At OpenDocBot, privacy is built into our core architecture. This Privacy Policy outlines how our application operates and handles user data.

1. Zero-Proxy Architecture (No Data Collection)

OpenDocBot runs 100% client-side within the Microsoft Office browser or WebView environment (Office.js).

• No Intermediary Servers: We do not own, operate, or maintain proxy or backend servers. Your document text, selections, and prompts never pass through or touch any server owned by OpenDocBot.
• No Telemetry or Tracking: We do not collect, store, or transmit personal information, usage analytics, or device identifiers, and we never transmit your document content. The only third-party requests are those you trigger explicitly (your configured AI provider), the optional videos you choose to play (section 4), and the hosting infrastructure described in section 5.

2. Local Storage, Not Cookies

OpenDocBot does not set or read any cookies of its own, and we run no analytics, advertising, or tracking scripts.

Configuration and state are kept in your browser or WebView localStorage, on your device:

• The add-in stores your settings and API keys (opendocbot-settings) and an anonymous session id (opendocbot-session-id) so it can remember your setup between uses. This data never leaves your device.
• This documentation site stores a search index and your theme preference in localStorage.

This storage is strictly necessary to provide the service you request, so no cookie-consent banner is required. You can clear it at any time by clearing your browser/add-in cache in Microsoft Office.

3. Direct Provider Connections

All API requests generated by the add-in are made via direct connections (HTTP/HTTPS) from your device to your selected provider:

• Local Models (Ollama, LM Studio): Requests are sent directly over HTTP/HTTPS to your local or private network endpoint (e.g., http://localhost:11434) without leaving your local environment.
• Cloud Providers (OpenAI, Anthropic, etc.): Requests are sent directly over encrypted HTTPS from your machine to the provider's API using the API key you provided. Data handling on their end is governed by the respective provider's privacy policy.

4. Embedded Videos (YouTube)

Some documentation pages include optional video tutorials hosted on YouTube. These embeds use a click-to-play facade: no request is made to YouTube or Google until you click the play button. Only then does your browser load the privacy-enhanced player (youtube-nocookie.com) and connect directly to Google, which may receive your IP address and set cookies as described in Google's own privacy policy. Watching a video is always your explicit choice; nothing is loaded in the background.

5. Hosting & Infrastructure

The hosted instance of OpenDocBot is served as static assets from Cloudflare infrastructure (Workers/Pages). Cloudflare processes standard, transient connection metadata (such as IP addresses and request logs) solely to operate the service and mitigate abuse, and may set a strictly necessary security cookie (for example __cf_bm) for bot protection. This metadata is not used by OpenDocBot for tracking, profiling, or marketing, and it never includes your document content, prompts, selections, or API keys. Those never reach our servers.

6. Self-Hosting

OpenDocBot's source is public under a fair-code license, and it can be self-hosted on your own infrastructure. When you self-host, you operate the server and any optional proxy functionality yourself. In that case:

• You act as the data controller/processor for any traffic that passes through your own instance, including any localStorage data you store and any requests routed through the optional proxy.
• If you enable SSO, session state and encrypted refresh tokens are kept on your server. You are responsible for storing them, for the encryption secret, and for the identity provider configuration.
• We are not responsible for the operation, security, or privacy practices of self-hosted deployments, which are governed by your own policies and configuration.

7. Your Rights (GDPR, CCPA & Similar Laws)

OpenDocBot does not collect, store, or process personal data or document content on its own servers. Accordingly:

• No data to delete: Because your configuration, API keys, and settings live only in your local localStorage, there is no server-side profile, account, or data set for us to access, correct, or delete on your behalf.
• Right to erasure: You can delete all locally stored data at any time by clearing your browser/add-in cache in Microsoft Office.
• Questions or requests: If you believe any personal data has been collected by us, contact us at privacy@opendocbot.com and we will investigate and resolve the matter promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last Updated" date at the top of this page will be revised. Material changes will be announced on the project's official website and GitHub repository. Continued use of the add-in after changes take effect constitutes acceptance of the revised policy.

9. Contact

For any privacy-related questions, concerns, or requests, contact us at privacy@opendocbot.com.