Privacy policy

Last updated 20 Oct 2026. WhatShouldMyBotDo is run by Rosh Perera. It is an independent site, not part of xAI.

The short version

There are no accounts. You can use the planner, the tools and the templates without signing up.
Your plan is encoded in your own result link. We don't keep it in a database.
We store your email only if you ask for something by email, and we never sell it.
Don't paste passwords, card numbers, addresses or other sensitive data into this or any AI tool.

What we store, and why

The planner. What you tap or type is used to build your result. If you describe your business in your own words, that text is sent to an AI model through Vercel's AI Gateway to read it, and the result is encoded in your link. If you use the voice button, your browser's own speech recognition turns your speech into text (some browsers, like Chrome, do this on their maker's servers), and we only receive the text.
Starter Kit and email forms. If you ask for the kit, we store your email with your consent in our email provider (Resend), along with which form you used and your result link if you sent it from a result. You can unsubscribe in one click.
First 5 routines page. If you leave your email there, we save it in our private storage, with no automatic emails.
Submit your setup and sponsor forms. What you send is stored in our private storage so we can read and answer it. Setups may be anonymized and added as new use cases, but only with your consent.
Purchases. Checkout runs on Whop, which handles your payment details. We receive your email and order details from Whop so we can send your files. We never see your full card number.
The MCP connector. It is read-only and needs no account. We don't store what your AI tool sends it, only how many times each tool is called. To slow down abuse, each server keeps a hashed version of the caller's IP address in memory for about a minute, never written to disk.

Analytics

We use Vercel Web Analytics to count page views. It doesn't use cookies. We also count button clicks, campaign tags in links (like utm_source) and the referring site, as totals per day. These counts store no IP address, no user agent and no email.

Your browser may keep small settings on your device, for example light or dark mode, that you already closed a banner, or that a visit was already counted so it isn't counted twice. You can clear them in your browser at any time.

Who else handles data

Vercel hosts the site, its private storage and the AI Gateway.
Resend sends our emails.
Whop runs checkout and payments.

Deleting your data

Want your email deleted? Reply to any email from us, or message Rosh on X, and we'll delete it.

Security

The site is served over HTTPS only. Found a security problem? Please tell us privately by messaging Rosh on X before you share it anywhere else. Our security.txt has the same contact.