Privacy Policy
1. Overview
LVLUP Agents AI is built on a privacy-first architecture. By default, your data stays on your device, your activity is not tracked for advertising, and your content is not transmitted to Project LVLUP, LLC (“LVLUP,” “we,” “us”) in the default configuration. This policy explains what we collect, what we don’t, and what choices are yours.
2. Information we collect
2.1 Account information. When you create an account on ai.lvlup.network, we store your email address, a bcrypt-hashed password, email-verification state, and session tokens. This information is held in a DigitalOcean Managed PostgreSQL database operated by LVLUP.
2.2 Billing information. Subscription payments are processed by Stripe. We receive a Stripe customer ID, subscription status, invoice history, and the last four digits of your payment instrument for display. We do not store full card numbers, CVCs, or other sensitive payment details on our servers; those live in Stripe’s vault.
2.3 Subscription entitlement. The desktop app caches a short-lived signed JWT that proves your subscription is active. The JWT contains your account identifier and expiration — nothing about your usage.
2.4 Support correspondence. If you email us, we retain the thread to help you and to improve the product.
3. Information stored locally on your device
The desktop app stores the following in local SQLite under ~/Library/Application Support/LVLUP:
- Conversations with ORION and sub-agents
- Task plans, task history, and event-log state transitions
- Agent definitions, manifests, and memory
- Generated files and tool-call artifacts
- Preferences and local model assignments
This local store is not uploaded to LVLUP by default. You can inspect, back up, or delete the directory yourself.
4. Local AI processing
By default, ORION and its worker agents run against a local language-model runtime (Ollama, LM Studio, llama.cpp’s server, or vLLM — any OpenAI-protocol-compatible server). Inference is processed on your machine, and the local runtime is bound to localhost. Nothing in your prompts, context, or generated output is sent to LVLUP or any third party unless you explicitly enable an online model.
5. Optional online model providers
You may, at your discretion, configure API keys for third-party providers including Anthropic, OpenAI, Google Gemini, Mistral, Groq, xAI (Grok), DeepSeek, OpenRouter, Perplexity, Together AI, and Cohere. When you do:
- Your API key is stored in the macOS Keychain via
keytar. It is never written to disk in plaintext, never committed to any logs, and never transmitted to LVLUP. - When you assign that provider to a slot and use it, the relevant prompt and context are sent directly to that provider under their privacy policy and terms.
- Online providers are visibly labeled throughout the UI so you always know when cloud inference is in use.
- You are responsible for the costs and policies of any provider you enable.
6. Orion’s Brain (v1.3.0)
“Orion’s Brain / Tower Access” is an optional collective-knowledge layer introduced in v1.3.0. It is always connected by default so the app can pull down curated known-bugs, version changelogs, and capability hints. Optional upload channels — learned session patterns and tool-gap reports — are opt-in, clearly labeled in the UI, and can be toggled off. When enabled, the uploads are anonymized and aggregated before being redistributed to other LVLUP clients.
7. Analytics & telemetry
We do not run hidden analytics, crash reporting, or advertising trackers. We do not sell your data. Any optional telemetry is disclosed in the app, user-gated, and off by default.
8. Security
We use industry-standard practices for account systems: bcrypt password hashing, HTTPS everywhere, short-lived tokens, email verification, and OS-level secret storage for third-party keys. Subscription data lives in a managed database with daily backups.
9. Retention & deletion
Account data is retained while your account is active. You may request account deletion by emailing [email protected]; we will delete account records within 30 days, subject to any legal or accounting retention requirements. Billing records held by Stripe follow Stripe’s retention policy. Local data on your device is under your control.
10. Children’s privacy
LVLUP Agents AI is not intended for children under 13. We do not knowingly collect information from children under 13.
11. Changes to this policy
If we change this policy materially, we will update the effective date above and notify active subscribers by email before the change takes effect.
12. Contact
Project LVLUP, LLC — a Wyoming limited-liability company. Privacy questions: [email protected].