Privacy policy

Last updated 12 November 2026

The short version

Buff is made by Codedevza AI Ltd ("we"), the controller of your data. We keep the information you put into Buff so the app works, and we don't sell it or use it for ads. You can ask us for a copy, or ask us to delete it, at any time.

What we collect

Your account. Your email address, and your name and profile picture from Google if you sign in with Google.
What you put in. Messages, files, bot settings, notes and approvals in your workspace.
How you use it. Basic logs such as sign-in times, device type and errors, so we can keep Buff running and fix problems.

How we use it

Only to run Buff for you: to sign you in, show your chats, let your bots do the work you ask, send you notices about your account, and keep the service secure. We don't use your content to train AI models.

Google sign-in and Google data

When you sign in with Google, we receive your name, email address and profile picture. We use them only to create your account and show who you are to your team.

If you connect a Google app such as Gmail, Calendar or Drive to a bot, that bot can read or change only what you allowed, and only to do the work you ask for.

Buff's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI accounts and connected apps

Bots run on the AI account you connect, such as Claude or ChatGPT. When a bot works, the messages and files it needs are sent to that AI provider under your agreement with them. The same goes for other apps you connect. You can disconnect any of them in Settings.

If you haven't connected your own AI account, bots use Buff's free starter models, which come from OpenCode Zen. While a model is free, OpenCode may use the prompts sent to it to improve that model. Don't put anything sensitive into a bot running on a free model; connect your own AI account instead. See OpenCode's privacy terms.

Buff for Chrome

The Buff extension for Chrome lets your bots use your browser, and shows your Buff chats in Chrome's side panel. It only works while the Buff app is open on the same computer, and only while the switch in its side panel is on.

What it reads. A bot sees a page only when it opens or uses that page for a task you gave it: the page's text, a screenshot, and the controls on it. That goes to your Buff app and on to your bot, the same as a file you give it.
Where it works. Bots work in their own tab groups, named for the task. They don't read your other tabs, your history or your saved passwords.
Sign-ins. When a bot signs in with something from your Buff Secrets, the extension types it into the page. The bot never sees the password.
Nothing else. The extension has no analytics and sends nothing to anyone but your own Buff app. Turn it off from its side panel at any time, or remove it from Chrome.

We share data only with the companies that help us run Buff, and only what they need:

Amazon Web Services, which stores your workspace in London (eu-west-2).
Amazon Simple Email Service, which sends sign-in links and account emails.
Recall.ai, in the EU, when you ask a bot to join a call for you.
OpenCode, which runs Buff's free starter models when you haven't connected your own AI account.

We'll also share data if the law requires it. We never sell it.

How long we keep it

We keep your data while your workspace is open. When you close it, we delete it within 30 days, apart from anything the law says we must keep.

Your rights

You can ask us to see, correct, export or delete your data, or to stop using it. Email us and we'll reply within one month. If you're unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Keeping it safe

Data is encrypted in transit and at rest. Each company's workspace is kept apart from every other. Only staff who need access to fix a problem can get it, and every access is logged.

Buff isn't for children under 16.

Contact us

Codedevza AI Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Registered in England and Wales, company number 16485057. Registered with the Information Commissioner's Office, number ZB905842. Email hello@buff.bot.

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.