Obie Widget — Data & Security

What the embed script actually does

The embed (widget/embed.js) is a single, dependency-free vanilla JS file. It does not load any other third-party script, tracker, or analytics library. On your page it only:

• Renders its own floating chat button and window (isolated DOM, doesn't read or modify the rest of your page)
• Reads/writes exactly two localStorage keys, both namespaced to your widget key, storing only the widget's own position and minimized/expanded state on screen
• Sets no cookies, does not read your page's cookies, and does not access document.cookie at all

What gets sent to our servers

Only when a visitor actually opens the chat and sends a message:

• The message text they typed
• The current page URL (window.location.href) — used only so Obie can answer "where am I / what is this page" correctly
• Your widget key (identifies which site's config/knowledge base to use — not a secret credential a visitor could misuse)

We do not collect IP addresses, device fingerprints, user agents, or any cross-site identifier. Nothing is linked to a visitor's identity beyond what they type in that conversation.

Where that data is stored

Conversations (message + reply + page URL + timestamp) are stored per-site in our database, used only to show you basic usage stats and — if you opt in — response quality feedback. Site owners only ever see their own site's data; there is no cross-customer visibility.

Security measures currently in place

• If you connect your own OpenAI/Anthropic API key (BYOK plans), it's encrypted at rest — never stored or transmitted as plain text after being saved
• Per-site rate limiting on the chat endpoint, to blunt abuse of a leaked or scraped widget key
• Every database write goes through access-controlled functions — no direct, unauthenticated table access
• The widget only ever calls our own API — it never talks to any other third party from the browser