Privacy

Draft. Accurate about what the software does, and not reviewed by a lawyer. Treat the descriptions as true and the legal framing as provisional.

What is stored

• Your account — an email address and a password hash, both held by Supabase rather than by us.
• Your agents — names, policies, configuration, and the record of what each one did. The record is the product; it is kept until you delete the account.
• Your credentials — encrypted with a key per secret, wrapped by a master key that is not in the database. We cannot read them.
• Operational logs — requests, errors and their references, for a short window. These carry no secrets by construction: an error that reaches you carries a reference, and the detail stays in the log.

What is not stored

• No analytics, no advertising identifiers, no third-party trackers. The pages load nothing from anyone else — no fonts from a CDN, no scripts, no pixels.
• No copies of what your agent says or reads beyond the record you can see yourself.

Who else sees it

The providers running the infrastructure: Supabase for the database and sign-in, Railway for the control plane, Hetzner for the machines your agents run on. Your model provider sees whatever your agent sends it, under their terms rather than ours.

Getting it back, or getting rid of it

Export the record of any agent from its page. To delete an account entirely, write to [email protected] — a self-service path is not built yet.