Legal
Privacy Policy
What Stray collects, why, who sees it, and what you can do about it, for the owners who build Strays and for the people who talk to them.
Last updated August 17, 2026 · Effective August 17, 2026
OperatorStray, operated by Rob Strayer, postal address available on request
Contactlegal@strays.ai
Who this covers
Two kinds of people meet Stray:
- Owners, you create an account, give a Stray your knowledge, and get transcripts and messages back.
- Callers, you talk to someone’s Stray, on its web page or on the phone.
This policy explains what we do with data from both. The owner of a Stray decides what it knows and receives what its callers say. In data-protection terms, the owner is the controller of what their callers tell their Stray and we process that data on the owner’s behalf; for owners’ own account data, we are the controller. Owners are responsible for their own disclosures to their callers (see the Terms of Service).
What we collect
From owners
- Account details, your email address, your name if Google or Apple share it, and sign-in identifiers. Passwords are stored only as salted hashes by our authentication provider (Supabase); we never see them.
- Knowledge, the text you paste, files you upload, and links you share (we fetch the page contents), plus the persona generated from them (summary, greeting, tone, FAQ, boundaries) and any corrections you teach your Stray by voice.
- Stray settings, its name, voice, greeting, notification email, and, if you set them, your Whistle and code words, which are stored only as hashes.
- Usage and billing, minutes used per Stray per month, your plan, and, once paid plans launch, a Stripe customer ID. Card details go straight to Stripe; we never store them.
- Technical data, IP address, browser type, and the server logs we need to run and secure the Service, plus aggregate page-view analytics via Vercel Web Analytics.
From callers (and from owners when they talk to a Stray)
- Conversations, a text transcript of what the caller and the Stray said, an AI-generated summary, when the conversation happened, how long it lasted, and whether it was on the web or by phone.
- Messages, the name, contact details, and message a caller chooses to leave for the owner.
- Phone metadata, the number dialed, the caller’s number when it isn’t withheld, call timing, and Twilio’s call identifiers.
- Audio, the caller’s voice is carried through the real-time voice providers described below to run the conversation. Stray does not create or store audio recordings as part of the Service.
Where the audio goes
When someone talks to Meet Stray or another browser agent already cut over to LiveKit, audio travels over an encrypted WebRTC connection into a LiveKit room. Stray’s hosted voice worker handles that audio in transit and sends it to OpenAI’s Realtime API, then returns the spoken reply through LiveKit. Browser agents still in the temporary compatibility window connect from the browser to OpenAI’s Realtime API over encrypted WebRTC instead. When someone calls a Stray’s phone number, Twilio carries the call through the configured voice path; phone routes may transit LiveKit before OpenAI processes the conversation. Stray keeps the text transcript and operating metrics described in this policy, but does not create or keep audio recordings as part of the Service. OpenAI processes this data under its API terms, which at the time of writing say API inputs and outputs aren’t used to train OpenAI’s models and may be retained by OpenAI for a limited period for abuse monitoring.
How we use it
- Run the Service, build your Stray’s persona from your knowledge, answer callers, transcribe and summarize conversations, store messages, and email you what you’ve asked for.
- Meter and bill, count minutes, enforce plan limits, and process payments.
- Keep it safe, prevent abuse (including automated moderation of uploaded knowledge and rate limits on calls), enforce our terms, debug problems, and secure accounts.
- Talk to you, transactional email (confirmations, password resets, the transcripts and messages you opted into) and occasional product news you can opt out of.
- Comply with the law.
Things we don’t do. We don’t sell personal information. We don’t use your knowledge, transcripts, or messages to train AI models, ours or anyone else’s. One owner’s knowledge is never used to answer another owner’s callers. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.
How long we keep it
- Account details, as long as your account exists.
- Knowledge, transcripts, summaries, and messages, as long as the Stray they belong to exists; you can read them in your dashboard any time. Deleting a Stray takes it offline immediately, and we purge its knowledge, transcripts, and messages from our active systems within 30 days, keeping only anonymized usage totals and billing records.
- Your account, delete it from your account page in the dashboard, or email legal@strays.ai; we delete your account and everything in it within 30 days.
- Backups, encrypted backups age out on their own schedule, typically within 30 days.
- Server logs, kept for a short period for security and debugging.
- Billing records, as long as tax and accounting law requires.
Your choices and rights
Owners
- See your data, transcripts, summaries, and messages are in your dashboard. Ask us for a copy of anything else.
- Fix it, edit your Stray’s name, voice, greeting, and notification email in its settings.
- Delete it, delete any Stray from its settings page, and your whole account from your account page (or email us and we’ll do it).
- Turn emails off, summary emails are a switch in your Stray’s settings; message emails go to the notification address you set there, and stop when you clear it.
Callers
- If you talked to a Stray and want your transcript or message deleted, ask the owner, or email legal@strays.ai, tell us which Stray you spoke to and roughly when, and we’ll delete it or pass the request to the owner.
Everyone. Depending on where you live (for example the EU or UK under the GDPR, or California under the CCPA), you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to complain to your local data-protection authority. We honor these requests from anyone, wherever they live, where we reasonably can. Email legal@strays.ai and we’ll reply within 30 days. We won’t treat you differently for exercising your rights.
Security
Every table in our database is protected by row-level security, so an account can only reach its own rows. Server-side keys are used only in server code and never sent to browsers. Passwords, Whistles, and code words are stored as salted hashes. Everything travels over TLS, and our providers encrypt data at rest. No system is perfect, if you find a vulnerability, email legal@strays.ai and we’ll take it seriously.
Children
Stray isn’t for children. You must be at least 16 to have an account (older where local law requires it), and we don’t knowingly collect personal information from children under 13, or under 16 where that is the local age of consent. Owners must not build Strays aimed at children. If you believe a child has given us personal information, email legal@strays.ai and we’ll delete it.
Where your data lives
Stray is hosted in the United States, and our subprocessors process data there and possibly in other countries where they operate. If you use Stray from outside the U.S., your data is transferred to the U.S. Where the law requires safeguards for such transfers (for example EU standard contractual clauses or the Data Privacy Framework), we and our subprocessors rely on them.
Changes to this policy
When we change this policy, we’ll post the new version here and update the date at the top. For material changes, a new kind of data, a new use, a new subprocessor that changes the picture, we’ll also email account holders before the change takes effect.
Contact
Privacy questions and requests: legal@strays.ai. Postal address: available on request, see the operator line at the top of this page.