Privacy policy

• Your agent runs on infrastructure dedicated to you — its files, conversations, and memory are yours, not shared with other customers.
• We collect what we need to run and bill the service, and nothing more.
• We never sell your data, and we never use your conversations to train models.
• When you cancel, your agent's computer and its storage are deleted. Gone means gone.

Sunlit is operated by Sunlit Bytes, based in San Diego, California. This policy covers the Sunlit website, dashboard, and the hosted agent service. Questions or requests about your data can go to support@sunlitbytes.com.

Account information. Your name and email address. Sign-in is handled by Clerk, our authentication provider — your password lives with Clerk and never touches our servers.

Onboarding answers.What you tell us during setup — your agent's name, personality, and what you want it to help with — is used to configure your agent and for nothing else.

Conversations and agent data. Messages you exchange with your agent (on the web, or over iMessage/SMS if you connect a phone), and the files, schedules, and memory your agent keeps on its computer. These live on infrastructure provisioned just for you.

Phone number. If you enable the phone link, we verify and store your number so your agent knows the texts are really from you.

Usage and billing data. We meter the model tokens your agent uses so we can bill accurately and show you your own usage. Payment details are handled by Stripe; card numbers never touch our servers.

Bring-your-own-key. If you supply your own Anthropic API key, we store it encrypted and use it only to run your agent.

Cookies and analytics. We use a small number of first-party cookies to keep you signed in and remember preferences like your theme. We also use PostHog, a first-party product analytics tool, to understand how visitors move through signup and onboarding — never for advertising. No third-party ad trackers.

To run your agent, keep it awake, route your messages to it, bill you correctly, keep the service secure, and help you when something goes wrong. Our operators can access tenant infrastructure for support and reliability work, and we treat the contents of your conversations as confidential — we look only when needed to fix a problem you've raised or to investigate abuse.

• We never sell or rent your personal data.
• We never use your conversations, files, or memory to train AI models — and model calls go to Anthropic's API, which does not train on API traffic by default.
• We never show you ads or share your data with advertisers.

Running Sunlit takes a few trusted providers, each receiving only what they need:

• Anthropic— processes your agent's model requests (the content of conversations).
• Amazon Web Services and Microsoft Azure — host your agent's dedicated computer and storage.
• Vercel — hosts this website and dashboard.
• Stripe — payment processing and invoicing.
• Twilio and Photon — phone verification and the iMessage/SMS line, if you enable them.
• Langfuse — usage metering, so your bill reflects what your agent actually used.
• PostHog — first-party product analytics on our website (funnel and feature usage, not ads).

Every agent runs isolated from every other customer, all traffic is encrypted in transit with TLS, secrets and API keys are stored in encrypted secret stores, and access to production systems is limited to the operators who run the service.

We keep your data for as long as your account is active. When you cancel or ask us to delete your account, your agent's computer and its persistent storage are deprovisioned and deleted. Billing records are kept as long as tax and accounting law requires. To request deletion or a copy of your data, email support@sunlitbytes.com and we'll handle it within 30 days.

Depending on where you live (including under the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email us and we'll honor those rights regardless of where you live.

Sunlit is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we'll delete it.

If we make a material change to this policy, we'll email account holders and update the date at the top of this page before it takes effect.