Who we are

LegacyForgeAI LLC, 401 N Foss Ave, Sioux Falls, SD 57110, phone [REGISTERED AGENT PHONE], operates ShareGrokBots. Notice and CAN-SPAM postal address: LegacyForgeAI LLC, 401 N Foss Ave, Sioux Falls, SD 57110. Contact: sales@legacyforgeai.com. We are not affiliated with xAI. Grok is a trademark of xAI.

What we collect

We collect only what the Site needs to run:

  • Account email, for magic-link login, receipts, security notices, and (only if you consent) the weekly letter and commercial vote-ask mail (stored by our auth processor, Supabase).
  • If you use Continue with X: your X user id, handle, and display name, so we can credit and claim listings.
  • Waitlist email, the trade you run, and whether you asked for a build, so we can contact you about the directory or a build.
  • Newsletter email, consent time, page URL, the exact opt-in label, an IP hash, whether the letter box was shown already checked, the capture surface (account, waitlist, or popup), and the region class of that default (precheck_ok, gdpr, or unknown, never the country code), when you check the letter box, so we can send the weekly letter and prove consent. A missing or untrusted country header is class unknown and the box is not pre-ticked.
  • Listing metadata you submit (name, one-line blurb, category, live bot URL, X handle, source post URL), to publish the board.
  • Votes you cast while signed in (which listing, which account), to rank listings.
  • Community ratings you file while signed in (stars, one-line review, optional trade or role). Published ratings show @handle. Pending ratings are not shown. We do not show your email on a rating.
  • Removal requests: listing name or bot URL, X handle, and email, so we can honor a removal.
  • Server logs and IP (user agent, path, time), to operate and rate-limit the Site. Our hosting provider keeps those logs for a limited period; we do not use them for marketing.
  • Featured-spot checkout: the listing id and the email Stripe collects at payment, so we can record the paid placement.
  • Sponsor checkout: company name, site URL, tagline, logo file, and the email Stripe collects at payment.
  • First-party analytics events: path, event kind (view, click, vote, submit, subscribe, search, share, api, mcp), a hash of a random session id, a hash of IP, a coarse agent class (bot, mobile, or desktop), the referring site host, and for search events the folded words you typed (cut to 64 characters) in a search_term column. Path for search events is /search; we do not store the query in the path. Not your name, email, or prompt text. The analytics IP hash uses a salt that is not the newsletter consent salt and includes the calendar month, so it cannot be joined to subscriber records.

What we do not collect

We do not store prompt text. We do not ask for payment card numbers on this Site. Stripe handles cards; we never store card numbers. We do not run advertising pixels. We do not sell personal information.

Newsletter

If you check the box on the account form or the waitlist, we store that consent with the time, the page the box was on, the exact label text, and a hash of your IP. Confirmation and the weekly letter start once the sender is live. No Thursday send is happening. The letter, when it starts, has four sections: verified this week by category, one creator spotlight, one bot that failed the standard task (factual, no pile-on), and the assessment door, and it will come from news.sharegrokbots.com.

A letter goes out only after you confirm the address, and only once the sender is live. For an account, that is the magic-link click that carries the opt-in. For the waitlist, confirmation starts once the sender is live. Every letter includes an unsubscribe link. One click stops the letter. You can also turn it off on your account page.

Payments

Stripe processes Featured spots and sponsorships. We receive a name, an email, a Stripe customer or session id, and payment status. We never store card numbers. Stripe webhooks may include last4; we do not keep it. Chargebacks remove the placement.

After checkout we store company name, site URL, tagline, and a re-encoded logo under a private bucket. The logo is shown on the Site after we approve it. Admin staff with the site bearer can approve or remove a sponsor.

Cookies

Logging in sets session cookies from our authentication provider (Supabase) in your browser; they expire after 400 days or when you log out. Names follow the pattern sb-*-auth-token (sometimes split into chunked cookies). They are not used for ads. If you never log in, we do not set those cookies. A first-visit sign-in prompt may set sgb_signup_popup so we do not show it again: 7 days after you close it, 365 days after you send a magic link. It is not used for ads.

We also set a first-party analytics cookie named sgb_sid. The server sets it as HttpOnly, Secure on HTTPS, SameSite=Lax, path=/, one year. The page cannot read it. The value is 32 random bytes plus an HMAC the server checks; a request without a valid cookie is not counted. We store a hash of that identifier, a hash of your IP (analytics salt, monthly), a coarse agent class (bot, mobile, or desktop), the path, the event kind, the referring site host, and folded site-search words. We do not store prompt text in events. We do not run advertising pixels. We do not sell this data. If your browser sends DNT=1 or Sec-GPC=1, we set no cookie, we store no hashes, and we do not add the visit to the public view count.

Analytics

No analytics cookie is set today. If a later measurement cookie is added, this section will name it, say what it measures, and how long it lasts.

Processors

We disclose personal data to Vercel (hosting), Supabase (database, authentication, and private logo storage), Stripe (Featured-spot and sponsor checkout), X (OAuth login and optional DMs), and AgentMail (transactional and letter email) to run the Site, and when the law requires it. We do not sell personal data. Admin access to sponsor rows is limited to operators with the site bearer.

Retention

Public listings stay until they are removed or we take them down. Waitlist emails stay until you ask us to delete them, or until we shut the list. Newsletter rows stay until you unsubscribe, delete your account, or ask us to delete them. Auth sessions last until you sign out or the magic link expires unused. Removal-request logs stay long enough to show we honored the request. Featured-spot and sponsor rows stay for the paid term plus a short audit window so we can prove payment and removal. Logos stay until the sponsor is removed. Stripe event ids stay to block replay. Server logs are kept by our hosting provider for a limited period. Raw analytics events are deleted after 90 days, along with per-session add-click records and per-IP daily cap rows. Aggregate view counts (views per path per day) are kept so the public counter can show a site total once it has reached a threshold we set (currently 100 views; a listing uses 25). Click-throughs through /go are counted on our side as opened in Grok Bot once they reach a threshold we set (currently 10). We cannot see installs.

Your rights

California residents have the right to know, delete, correct, and opt out of sale or sharing of personal data. We do not sell or share personal data for cross-context ads. If those laws apply, EEA and UK visitors have the right to access, correct, delete, object, and complain to a supervisory authority. That is the DSAR path: email sales@legacyforgeai.com. We respond within 30 days. We honor those requests; we do not claim a full GDPR program.

Deletion and removal

Use Delete my account on the account page, or email sales@legacyforgeai.com, to ask us to delete your account, waitlist row, votes, or newsletter row. Creators can request listing removal through Remove my listing; we honor that within one business day. We may keep a stub of the request (what was asked, when we acted) so we can prove we did it.

Changes

We may update this policy. The date at the top is the effective date. For a material or privacy change we email the address on the account.

Children

The Site is for people 18 or older. We do not knowingly collect personal information from anyone under 18; if you believe someone under 18 gave us data, email us and we will delete it.

Contact

LegacyForgeAI LLC
401 N Foss Ave, Sioux Falls, SD 57110
[REGISTERED AGENT PHONE]
sales@legacyforgeai.com

Use of the Site is also governed by the Terms.

Changelog

  • 2026-08-29: Named Stripe payment data, sponsor contact and logos, admin access, an analytics placeholder, per-table retention, and the DSAR path. Dropped last4 overclaim; named X OAuth and AgentMail.