Privacy policy

Effective October 22, 2026 · Updated October 26, 2026

Lowkey is a hosted workspace where AI agents do real work for you: in chat, in files, on a schedule, in a browser, by voice, and on computers you choose to pair. This policy covers the lowkeyagents.com website, signing up and paying, the Lowkey service itself, and Lowkey Agent Email (previously Lucy Email) and our other Google integrations. “We”, “us” and “Lowkey” mean the Lowkey team, which provides the service.

The short version

Each customer gets their own private server (“your box”), a virtual machine that we run for you. Your workspace is not pooled with other customers’.
To do a task, your agents send the relevant content to the AI model provider that runs the model. Which providers are used depends on your plan and settings.
We don’t sell your data, don’t use it for advertising, and don’t train AI models on it.
You can export your data, disconnect any account, and ask us to delete everything.

Information we collect

Account and billing. Your name, email address, sign-in details (we store passwords only as secure hashes) and plan. Payments are handled by Stripe. We get your billing contact, payment status and the last digits of your card, never the full card number.

Your workspace. What you and your team put into Lowkey or ask agents to produce. That includes conversations, uploaded and generated files, tasks, schedules, decisions, project wikis, published pages, and the memories agents keep about your preferences and corrections. These are stored on your box.

Connected accounts and credentials. When you connect a service (an AI subscription, Google, or another tool), its access tokens, keys or passwords go into your box’s credential vault. Agents can use a credential without seeing its raw value, and only within the limits its owner sets.

Google data. If you connect Gmail, Drive, Calendar or other Google services, we access the data those permissions allow. This is described in detail below.

Paired devices. If you pair one of your own computers, agents can run commands on it, read and write its files, and, if you turn it on for a conversation, drive its browser or screen. What they read there becomes part of your workspace when they use it in a task.

The agent’s browser. Agents browse the web in a browser on your box. That browser keeps its own profile, including cookies and sign-ins for sites you log into through it.

Voice and screen. During a voice call, your audio is streamed to our voice provider so the agent can hear and answer you, and a transcript is saved to the conversation. If you share your screen, the agent can capture still images of it, and stills you freeze or mark up are saved with the conversation.

Notifications. If you turn on push notifications, we store your browser’s push subscription so we can send you alerts.

Website and technical logs. Our websites and servers log technical information such as IP addresses, request times, pages requested and errors. lowkeyagents.com uses no advertising or third-party analytics scripts.

How we use information

We use your information to provide and support the service: to run the tasks you and your agents start, keep your box working and secure, bill you, answer your requests, and tell you about changes to the service. We look at usage and operational records (for example, how much model usage a box consumes) to run, price and improve Lowkey. We don’t use your workspace content for advertising or sell it to anyone.

AI model providers

Agents think with AI models from providers that may include Anthropic (Claude), OpenAI (GPT), Google (Gemini), xAI (Grok) and Meta (Muse), as well as models we host ourselves. When an agent works on something, the content it needs is sent to that model’s provider for processing. That can include messages, files, email, web pages, screenshots and conversation context. Some features use more than one model, for example when you ask several models for an answer, or when a second model rewrites a reply in your agent’s voice.

Depending on your plan, either we supply these models or you connect your own AI accounts. When we supply them, we use API or business terms, or account settings, under which the provider does not train its models on the content we send. When you connect your own account, your agreement with that provider governs how it handles the content.

Voice calls use OpenAI’s realtime voice service.

Who can see your information

People on your box. Everyone you give access to your box can use its agents and see its shared projects, files and results. Credentials in the vault are available to others only if their owner shares them.
Us. We run your box, so our staff have technical access to it. We access your content only to provide and support the service, with your permission, to investigate security or abuse, or when the law requires it.
Reports you send us. If you use “Report this reply” on an agent’s reply, the report goes to your box’s admin, and a copy comes to us at Lowkey. The copy holds the reported reply (up to about 8 KB of text), the reason and any note you add, the agent’s name and the AI model that wrote the reply, your box’s web address and its Lowkey version. It doesn’t say who sent the report, and it doesn’t include the rest of the conversation or your files. We use reports to find and fix harmful or wrong AI output.
Service providers who help us run Lowkey, under contracts that limit their use of the data: the data centers that house our servers (space, power and network), the AI model providers above, Stripe (payments), Google Workspace (our own email), and the push services run by browser makers (Apple, Google, Mozilla) that deliver notifications.
People and services you direct. When you ask an agent to send an email, sync a Drive folder, post to another service or publish a page, the content goes where you sent it. Published pages are public to anyone with the link until they expire or you delete them.
Legal and business transfers. We may disclose information if the law requires it, to protect people’s safety, or as part of a merger or sale of the business. In a sale, this policy would continue to apply to your data.

Lowkey Agent Email and Google user data

When you connect Google, you authorize access through Google’s consent screen. Depending on the permissions you grant and the features you use, Lowkey can access:

Gmail (Lowkey Agent Email): your account address, message headers and bodies, sender and recipient details, labels, threads and attachments. Sending mail and changing your mailbox require the matching permissions.
Google Drive: the files in the Drive folder you connect to a project. Google’s approval covers your whole Drive because Lowkey needs to read, create, update and trash files, but Lowkey syncs only the folder you choose.
Calendar and other Google services: only what you separately connect, for the tasks you ask for. Connecting one Google service does not grant access to the others.

We use Google data only to carry out the features you request: finding, reading and summarizing messages; working with attachments; preparing or sending replies you authorize; organizing mail; keeping a synced Drive folder in step; and running automations you turn on. For an AI-assisted task, the relevant Google data may be sent to the AI provider running that task, as described above.

We do not sell Google user data or use it for advertising, credit decisions or unrelated profiling. We do not use Google user data to develop, improve or train general-purpose AI or machine-learning models, and we use AI provider terms and settings consistent with that restriction. Our staff do not read Google user data unless you ask us to, it is needed for security, or the law requires it.

Lowkey’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google handles your Google sign-in; Lowkey never asks for your Google password. You can revoke Lowkey’s access at any time in your Google account connections. Revoking stops future access but does not erase copies already in your workspace. Ask us, or delete them yourself, to remove those. Deleting a copy in Lowkey does not delete the original in Gmail or Drive.

Storage and security

Your box is a private virtual server that we run on our own hardware, in colocation data centers in the United States. Connections to your box and to the services it uses are encrypted with HTTPS. Credentials are kept in the vault or in files only the service can read, and are kept out of logs and command lines. Pairing a device, driving its screen, and using sensitive credentials each require a separate approval. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects it.

How long we keep it

While you’re a customer, your workspace data stays on your box until you or your agents delete it. Deleted conversations and files are removed from the box. Copies may remain in backups until those backups expire within 30 days.
When you cancel, you can export your data first. We delete your box and its contents 30 days after your subscription ends, and backups expire within 30 days after that.
Billing and account records are kept as long as tax and accounting law requires, typically 7 years.
Website logs are kept for 90 days.
Reported replies. We delete our copy 180 days after we review it. The report on your box is kept with your box’s other data.
AI providers may keep submitted content for a short time, for abuse monitoring for example, under their own terms.

Your choices and rights

You can see, export, correct and delete your workspace content from inside Lowkey, disconnect any connected account, unpair any device, and turn off notifications. You can also ask us to give you a copy of your personal information, correct it or delete it. Depending on where you live, you may have other rights under laws such as the California Consumer Privacy Act or the GDPR. We will not treat you differently for using them. We do not sell or “share” personal information for cross-context behavioral advertising.

If your box belongs to your employer or another organization, that organization controls the workspace, and some requests may need to go through them.

Children

Lowkey is not meant for children under 16, and we do not knowingly collect their information. If you think a child has given us information, contact us and we will delete it.

Changes

We update this page when our practices change and revise its effective date. We will tell customers about material changes before they take effect. Any new use of Google user data will be disclosed beforehand, and we will ask for your consent where it is required.

Contact

Send privacy questions, access requests and deletion requests to privacy@lowkeyagents.com. Tell us which box and account your request is about. Never send passwords or access tokens.