Privacy Policy

Last Updated: 2026

At OpenDocBot, privacy is built into our core architecture. This Privacy Policy outlines how our application operates and handles user data.

1. Zero-Proxy Architecture (No Data Collection)

OpenDocBot runs 100% client-side within the Microsoft Office browser or WebView environment (Office.js).

• No Intermediary Servers: We do not own, operate, or maintain proxy or backend servers. Your document text, selections, and prompts never pass through or touch any server owned by OpenDocBot.
• No Telemetry or Tracking: We do not collect, store, or transmit personal information, usage analytics, IP addresses, device identifiers, or document content.

2. Local Storage (localStorage)

All configuration settings, including your personal API keys (OpenAI, Anthropic, DeepSeek, etc.) and model parameters:

• Are stored exclusively in your local browser/WebView storage (localStorage) on your device.
• Are never transmitted to OpenDocBot. You can clear this data at any time by clearing your browser/add-in cache in Microsoft Office.

3. Direct Provider Connections

All API requests generated by the add-in are made via direct connections (HTTP/HTTPS) from your device to your selected provider:

• Local Models (Ollama, LM Studio): Requests are sent directly over HTTP/HTTPS to your local or private network endpoint (e.g., http://localhost:11434) without leaving your local environment.
• Cloud Providers (OpenAI, Anthropic, etc.): Requests are sent directly over encrypted HTTPS from your machine to the provider's API using the API key you provided. Data handling on their end is governed by the respective provider's privacy policy.

4. Hosting & Infrastructure

The hosted instance of OpenDocBot is served as static assets from Cloudflare infrastructure (Workers/Pages). Cloudflare processes standard, transient connection metadata (such as IP addresses and request logs) solely to operate the service and mitigate abuse. This metadata is not used by OpenDocBot for tracking, profiling, or marketing, and it never includes your document content, prompts, selections, or API keys. Those never reach our servers.

5. Self-Hosting

OpenDocBot is open source and can be self-hosted on your own infrastructure. When you self-host, you operate the server and any optional proxy functionality yourself. In that case:

• You act as the data controller/processor for any traffic that passes through your own instance, including any localStorage data you store and any requests routed through the optional proxy.
• We are not responsible for the operation, security, or privacy practices of self-hosted deployments, which are governed by your own policies and configuration.

6. Your Rights (GDPR, CCPA & Similar Laws)

OpenDocBot does not collect, store, or process personal data or document content on its own servers. Accordingly:

• No data to delete: Because your configuration, API keys, and settings live only in your local localStorage, there is no server-side profile, account, or data set for us to access, correct, or delete on your behalf.
• Right to erasure: You can delete all locally stored data at any time by clearing your browser/add-in cache in Microsoft Office.
• Questions or requests: If you believe any personal data has been collected by us, contact us at privacy@opendocbot.com and we will investigate and resolve the matter promptly.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last Updated" date at the top of this page will be revised. Material changes will be announced on the project's official website and GitHub repository. Continued use of the add-in after changes take effect constitutes acceptance of the revised policy.

8. Contact

For any privacy-related questions, concerns, or requests, contact us at privacy@opendocbot.com.