Privacy Policy

The short version

This website sets no cookies, runs no analytics, and loads no third-party scripts. The software runs on your machine or phone, stores everything locally, and sends nothing to us — there is no Levix account and no Levix cloud. Data leaves your device only when a feature you use requires it: messaging goes to WhatsApp, and AI requests go to the provider you configured with your own key. The single exception is deliberate and yours to make: if you write to the developer through the feedback form, the text you typed is sent.

1. This website

• No cookies, ever. The site stores nothing in your browser. There is no session, no preference store, no consent banner because there is nothing to consent to.
• No tracking. No analytics, no ads, no social pixels, no fingerprinting. Fonts are downloaded at build time and served from this site — your browser never contacts Google for them.
• One outbound call, made by our server, not your browser. The download page shows release names and file sizes from the GitHub API. That request is made server-side and cached for 30 minutes; GitHub sees our server, not you. When you click a download link you obviously go to github.com, under GitHub's own policy.
• The feedback form. /feedback is the only page that accepts input. What you type there — your message, the topic, an optional rating and an optional contact you choose to leave — is delivered to the developer as a Telegram message and is not written to any database on this site. The message also carries the browser or app user-agent string, because a bug report without a device is guesswork; your IP address is not included in it. The same endpoint receives feedback sent from inside the app; see the row in section 3. Leave the contact field empty and nothing you sent names you.
• Ordinary hosting logs. Like any web server, the hosting layer may record requests (URL, time, status). We don't analyze them and no ad network gets them.

2. The software — what is stored locally

Levix is self-hosted. Everything it owns lives in one data directory (levix where prints it — ~/.levix, the Docker volume, or the Android app's private storage). The bot does not archive other people's messages: the only metadata kept about incoming traffic is a per-message forward counter (which expires after 30 days) and the sender's last-seen row. Deleted and edited messages are not captured at all. Some data stored locally — especially AI conversation history, long-term memory, names and WhatsApp identifiers — can be included as context in a later AI request when you choose to use an AI feature. Local storage does not mean that this context can never leave the device.

On Android, cloud backup of app data is switched off in the manifest (allowBackup=false) on purpose: the app holds your WhatsApp session and sealed keys, and they should not silently ride into a cloud backup.

3. The software — what leaves, and to whom

Depending on which features you use, data sent outside the device for app functionality can therefore include name, WhatsApp user identifiers or phone number, messages, mentioned or quoted participant identifiers, photos, videos, voice or other audio, files and documents, AI memory or other user-generated content, web-search queries, and URLs/pages the AI is asked to read. Levix does not request Android Contacts permission; participant identifiers come from the WhatsApp conversation you are using.

Pointing the AI provider at a local Ollama or LM Studio server keeps that traffic on your machine — the software explicitly allows loopback endpoints for exactly that. Everything a hosted provider receives is then governed by that provider's own privacy policy, not this one.

We — the Levix project — are not a recipient of anything above. The software contains no telemetry, no crash reporting, no update pings, and no usage statistics. There is no server of ours for it to talk to.

4. Optional diagnostics & crash reports

Two features are off by default and each has its own consent. Ticking one never enables the other, and neither runs without you pressing a Send button.

Feedback diagnostics. In the panel's Feedback tab you can tick “Attach device & technical diagnostics”. The panel then shows exactly what will be sent before you send it — the preview is built by the same code that forwards it. The fields are: the Levix version, the Node.js version and platform the bot runs on; on Android, the app version, Android release and API level, device manufacturer and model, CPU ABI, WebView version, connectivity, and whether memory or storage are low; and from the panel page, screen size and pixel ratio, panel language and theme. Nothing else is collected — no phone number, IMEI, Android ID, advertising ID, precise location, Wi-Fi SSID, contacts, messages, chat identifiers or keys. Leave the box unticked and no diagnostics key is added at all.

Crash reports. When the app, the bot or the panel hits an unexpected error, a report can be written to the local data directory. A report holds the error type and a sanitized message, up to 20 sanitized stack frames, the screen or activity it happened on, the app and device details available at that moment, and up to 20 short breadcrumbs (navigation, lifecycle or action names — never message text). The sanitizer replaces WhatsApp identifiers, e-mail addresses, long numbers, URL paths, key-like strings and home-directory paths with placeholders. A report stays on your device until you open the panel's Crash reports list and send that one report; a pending report is deleted after 7 days, and nothing is ever sent automatically. You can also delete any report locally at any time. When you do send one, it is stored on the receiving server for 30 days and then deleted; you can ask for deletion earlier by report id, and sending the request is what tells the server the id.

Neither feedback diagnostics nor crash reports carry a device or install identifier. Report ids are random, one per report, and exist only so a report can be grouped and deleted — nothing follows a device from one report to the next. The crash-report tools themselves contain no telemetry and no update pings.

5. How secrets are protected

• API keys and the WhatsApp auth blob are sealed at rest with AES-256-GCM; the encryption key sits in a separate levix.key file with mode 0600, so a stolen database alone reveals nothing.
• The panel only ever reports whether a key is configured — it never returns the value, not even to a logged-in operator.
• The panel password is stored as an scrypt hash with a random salt; logins are throttled to 5 attempts per 15 minutes keyed on the connecting peer; changing the password invalidates every existing session.
• Public AI endpoints must be HTTPS, private and reserved addresses are rejected, and the software pins the validated DNS answer to the socket so a key can't silently cross hosts through a redirect.

6. The Android app's permissions

Six permissions, none of them location, camera, microphone, contacts or storage:

The in-app browser (WebView) loads only the local control panel at http://127.0.0.1:3001 — never third-party web content.

7. Deleting your data

• AI conversation history: !del per chat, !delall for all of it, or from the panel.
• Long-term memory: !memory forget / !memory clear, or from the panel.
• Unlink (Connection → Unlink): clears the WhatsApp credentials, roles, AI history, memory and buffered context, and pauses the old account's schedules.
• On a server: stop the bot and delete the data directory — that is a full wipe.
• On Android: uninstall the app. Nothing survives elsewhere, because there is no elsewhere.

8. Children

Levix is intended for users aged 16 and over and is not directed at children under 16. Users must also meet WhatsApp's minimum-age requirements that apply in their country or region.

9. Changes & contact

Material changes ship with a new date at the top of this page. Questions or disputes: the issue tracker — the same place as bugs. See also the Terms of Use.