Privacy

• Who we are
• Visiting a site that uses Bothy
• The chat assistant
• Reading websites
• Organisations that use Bothy
• Cookies
• Who else handles data
• How long we keep it
• Security
• Asking for access or deletion
• Changes

Who we are

Bothy is a service from Highland Creative LLC ("Highland", "we"), a web studio run by Sid O'Neill. You can reach us at hello@madebyhighland.com. A person reads it.

This policy covers bothy.tools, the Bothy script tag and chat assistant that organisations put on their websites, the crawler that reads those websites, and the dashboard the organisations sign in to.

When you visit a website that uses Bothy, that website belongs to the organisation that runs it. We handle information about its visitors on that organisation's behalf, to provide the service it asked for. We do not sell it, and we do not use it to advertise to anyone.

If you visit a website that uses Bothy

The organisation chooses which parts of Bothy are on. Each is off until it asks for it.

The script tag

A short script loads from bothy.tools. It sets no cookie and uses no local storage on the website you are visiting.

Page counts, if the site has them on

For each page view the script sends:

• the page's path, without any query string;
• the page you came from, which we reduce to a type (search, AI assistant, social, email, the same site, or other) and then throw away;
• whether the page was a "not found" page;
• a number worked out from the page's title and when it last changed, so we can tell when a page has been edited;
• if you click a phone or email link, the word "tel" or "mailto". Not the number or the address.

We store daily counts per page. To count unique visitors we make a one-way hash from the day, a secret for that site, your IP address, your browser's description of itself and the page path. The hash is deleted after 7 days. Your IP address and browser string are used in memory for this and are never written to our database. Because the hash changes every day and differs for every site, it cannot follow you from one site to another.

The script honours Do Not Track and Global Privacy Control. If your browser sends either, nothing is counted.

What we do not collect

• No form contents from the website's pages.
• No keystrokes, mouse movement, scroll depth or session recordings.
• No cross-site profile, and no advertising or tracking cookies.
• No logins or passwords.

Site search, if the site has it on

The words you type, up to 200 characters, are sent to Bothy to search that site's own pages. Bothy does not store them.

The chat assistant

The chat assistant is off unless the organisation turns it on. When it is on, the panel tells you before your first question where your conversation goes and how long it is kept. This is what happens to it.

• What is sent. Your question, your last 10 messages and replies in the conversation, the sources of the last answer, and a random id for the conversation that identifies no one. The id is kept in your browser's session storage until you close the tab.
• Bothy's own server keeps no copy. No transcript is written to our database, the conversation is never put in a session, and our logs record how long a question is, never its words.
• Bothy's orchestrator, a separate server run by Highland, sorts the question and searches the site's pages for an answer. It keeps each conversation for 3 days.
• Anthropic, the AI company that writes the answers, receives the question twice: once from the orchestrator and once from Bothy. Anthropic keeps it for up to 30 days and does not train its models on it. A message Anthropic flags for misuse may be kept for up to 2 years.

We do not remove names or personal details from a chat question before it is sent, so please leave them out. An organisation can also list words that stop a message before it leaves Bothy; such a message gets a fixed reply and goes nowhere else.

Leaving a phone number

If the site offers a call back and you leave a number, Bothy stores it with the first 200 characters of your last question and emails both to the organisation's office. We keep them until the office asks us to delete them, or until the site leaves Bothy. Our email provider keeps its copy of the email for 45 days.

Sites on the Craft CMS plugin

Some sites run Bothy through our Craft CMS plugin, with its own chat. On those sites the website itself keeps conversations for the period it sets, and its chat panel tells you what that is. If the site sends its visitors' questions to Bothy for reports, email addresses and phone numbers are removed before they are stored, private names are removed as they arrive or in a nightly pass, and Bothy deletes them within 400 days.

A question asked on two or more of those sites may be kept for Highland to review for Bothy's standard list of questions, with no site, visitor or date attached. Within 400 days it is deleted, or reduced to a one-way fingerprint if we turned it down, unless we add it to the list.

Checking answers about Church teaching

Each night Highland checks a few of the assistant's answers about Church teaching, using stored questions from those reports. The question, already stripped of names, contact details, links and the site's own name, is sent to Magisterium AI to find Church sources. The question, the assistant's answer and those sources are sent to Anthropic to judge whether they agree. Nothing that identifies a site or a visitor is sent, and the results are seen only by Highland. This is not part of what visitors see.

How Bothy reads websites

Our crawler, BothyBot, reads the public pages of the websites Bothy works with, the way a search engine does. It honours robots.txt, sends no passwords, and never logs in or fills in forms. How BothyBot reads sites explains how to recognise it, slow it down or block it.

Once a day, from the same address, a readiness check visits a site's home page, a few of its answer pages and the files AI assistants look for. It identifies itself as BothyBot, with the same signature as the crawler, and never uses another crawler's or a browser's name.

If your organisation uses Bothy

• Signing in. We keep the email addresses of the people Highland has listed for your site, and a log of each sign-in: who, which site, the IP address and the time. Sign-in links are emailed, work once and expire after 20 minutes.
• Google data, if you connect it. If you give Bothy read access to Google Search Console or Google Analytics, we store the search terms and page figures it reads for 490 days.
• Your website's content. The text of your public pages, as crawled, and the reviews and to-dos made from it.
• The form on our home page. If you ask for a first look, we keep your name, email address, organisation, website and message so we can reply. If you do not become a client, the copy of your website we read for the first look is deleted after 90 days. Your message is kept until you ask us to delete it.

When your contract ends, we remove your site. That deletes its pages, counts, signals, reports, to-dos, call-back numbers, people, keys and search index in one step. A few copies age out on their own: questions held for the standard list within 400 days, our database's change log within 30 days, database backups within 365 days, the orchestrator within 3 days, Anthropic within 30 days and our email provider within 45 days.

Cookies

bothy.tools carries no analytics or advertising scripts. Most of its pages load a font from Google Fonts, so Google sees your IP address when you open them.

Who else handles data

These companies help us run Bothy. Each sees only what it needs for its part.

Bothy runs on three servers, all Highland's own at DigitalOcean in New York: the application server, which holds the database and serves this site, the dashboard and the script tag; the search index (Typesense), on a separate server, where each site's pages are kept in a collection of their own; and the chat orchestrator. The search index and the orchestrator are run by Highland, not by another company.

How long we keep it

Everything Bothy stores is on servers in the United States. There is no option to keep it elsewhere.

Backup copies of the database age out after 365 days, so a deletion reaches the backups within that time.

Security

• Every connection to Bothy is encrypted (TLS 1.2 or 1.3).
• From the internet our application server answers only on its web ports and on SSH, which takes keys only.
• Highland's staff sign in with an individual account, a password and a two-factor code every time.
• Client sign-in links work once and expire after 20 minutes. A client account reaches one site only.
• If an incident affects your organisation's data, we tell your named contact within 72 hours of confirming it.

Bothy is small and new. We answer IT and security questionnaires directly. Send yours to hello@madebyhighland.com.

Asking for access or deletion

Email hello@madebyhighland.com. We will tell you what we hold about you and delete it on request. Deletion is done by a person, by hand; there is no self-service delete. If you were a visitor to an organisation's website, you can also ask that organisation, and we will act on its request.

A website owner can stop BothyBot reading their site through robots.txt at any time.

Changes to this policy

When something here changes, we update this page and the date at the top. If a change affects how we handle an organisation's data, we email that organisation before it takes effect.