Privacy Policy

01Two modes of use

Local mode (default)

No account, no telemetry, no data leaving your machine. Sending any report requires the Store to be configured, so in local mode there is nowhere to send anything. Your prompts and files go directly from your machine to third-party AI providers under your own subscription. In this mode we are not a controller of any of your data — we process nothing.

Store mode (opt-in)

Only here do we collect data, and we act as data controller. Our entire privacy exposure lives in this mode, described below.

02What we collect — and don't

What we NEVER collect

• Your prompts or the content you send to AI models.
• Your code, files or project contents.
• File paths, your task names, or the contents of your workspace.
• Behavioural analytics, profiling or advertising tracking. We use no Google Analytics or equivalent product, in the app or on the website.
• Your data is never sold or shared with third parties for commercial purposes.

What we collect only in Store mode

• Email address (account identity).
• The display name and username (@handle) you choose; the username is public and bylines the workflows you publish.
• Basic Google profile data if you sign in with Google: name, avatar and identifier (sub).
• A session token stored as a SHA-256 hash (never in plain text).
• The content of any workflows you choose to publish to the Store.
• Your IP address, under the conditions described in Section 6.
• Technical failure reports, described in Section 7.
• The record of your acceptance of these documents (see Terms).

03How we use it

• Create and authenticate your Store account.
• Publish, moderate and distribute the workflows you share.
• Maintain security and prevent abuse.

04Legal bases (GDPR)

• Contractual necessity (Art. 6(1)(b)): creating your account, authenticating you and providing the Store.
• Legitimate interest (Art. 6(1)(f)): operating and moderating the community Store and keeping it secure.
• Legitimate interest (Art. 6(1)(f)): abuse prevention, failure diagnosis, and retaining proof of acceptance of these documents.
• Legal obligation (Art. 6(1)(c)): retaining the acceptance record where needed to evidence agreement to these terms.
• Legitimate interest (Art. 6(1)(f)) and the erasure exception for the establishment, exercise or defence of legal claims (Art. 17(3)(e)): after an account is deleted, retaining the minimum segregated acceptance evidence for the applicable limitation period or while an active claim exists.

05Who we share it with

• Cloudflare (processor): hosts the Store's database, compute, email delivery, installer distribution, anti-bot verification (Turnstile) and server logs.
• Google (identity provider): only if you choose to sign in with Google. Additionally, if your profile has a Google picture, your browser loads it directly from Google's servers when it is displayed.
• Your own AI providers (Anthropic, OpenAI, Google and others): they receive your prompts directly from your machine under your subscription. They are independent controllers; we neither mediate nor see that traffic.

We do not sell or share your personal information for advertising or third-party commercial purposes.

06IP address

In Store mode your IP address is used for three purposes, and no others:

• Rate limiting and abuse prevention. It is used as a key to count requests per minute and slow down automation. For this use it is not stored in our database: it is a temporary counter inside Cloudflare's infrastructure.
• Anti-bot verification. When you request a magic link, your IP is sent to Cloudflare Turnstile along with the challenge token, to verify the request comes from a person.
• Proof of legal acceptance. When you create your account we store the IP alongside the record of which version of these documents you accepted. It is what makes that acceptance attributable. After account deletion, the IP remains only within the segregated legal-evidence archive for the period described in Section 8.

Server logs

Independently of the above, the Cloudflare infrastructure hosting the Store logs every request — including the source IP address, the path and the headers — in its operational logs, retained under Cloudflare's own retention policy. This is standard web-server behaviour; we use those logs to diagnose errors and detect abuse, never to analyse your behaviour.

Legal basis and non-use

Processing of your IP relies on our legitimate interest in keeping the Service secure and in being able to evidence acceptance of these documents. We do not use your IP to geolocate you, profile you, measure your behaviour or build audiences, and we do not share it with third parties beyond Cloudflare in the uses described.

07Technical failure reports

In Store mode, when a task or the application fails, a technical report is sent. Nothing is sent during normal use: only on a failure. In local mode no report is sent at all.

What it contains — and why it cannot contain anything else

The report is composed exclusively of values from a closed list, numbers, and identifiers generated by our own code. There is no free-text field anywhere in it, so there is no way for it to carry your content:

• The reason for the failure, from a fixed list of causes. A reason not on the list is recorded as other, never as text.
• Environment data: operating system and version, architecture, and application version.
• Stage data: which CLI was used, stage type, position, round, exit code and duration.
• For a server error: the route template (for example /api/tasks/:id), never the real path, because that contains your task identifier.
• The code location where it happened, trimmed to file.ts:line. The absolute path is discarded on purpose: it contains your operating-system account name.

Never included: your prompts, the contents of your files, paths on your system, your task titles or descriptions, or any text you wrote.

It is linked to your account

With an active session the report is linked to your user identifier. We do not present it as anonymous. It exists to tell "one user with a recurring problem" apart from "a problem many people hit", which is the distinction that decides whether something gets fixed.

Retention: 30 days, then aggregated

The detailed report is kept for 30 days. It is then discarded, leaving only an aggregate with no user identifier: a counter per combination of reason, CLI, operating system and version. That aggregate is no longer attributable to any person and is kept indefinitely to observe trends across releases.

Control

Sending can be disabled server-side, entirely or per source, and that setting takes effect without updating the application. There is currently no per-user switch in the app: the way to send no reports at all is to not enable the Store, in which case the application works fully in local mode. If we add a per-user control we will say so here.

08Retention

Sessions

A session has two deadlines: an idle one that renews with use, and an absolute one that never renews.

• Desktop app: expires after 90 days of inactivity, and in any case 365 days after sign-in.
• Remote browser access (phone): 7 days idle, and in any case 30 days. The windows are shorter because a browser is a more exposed surface.

Other data

• Account data: until you delete your account or request erasure.
• Published workflows: for as long as they are published. A workflow's version history is retained even if you withdraw it, because other people may have downloaded that version; contact us if you need it erased.
• Magic links: the token expires in 15 minutes and is single-use.
• Failure reports: 30 days in detail, then aggregates only, with no user identifier (Section 7).
• Server logs: per Cloudflare's retention (Section 6).
• Legal acceptance record: for as long as your account exists. After deletion, we keep in a segregated archive only the encrypted email address and acceptance evidence —document, version, date, IP address, browser or application, and method— for the applicable legal limitation period. If a claim or proceeding remains active when that period ends, it is retained until final resolution and then deleted.

09Your rights

If the GDPR applies to you, you have the right to: access, rectify, erase, restrict and port your data, object to processing, withdraw consent and lodge a complaint with your supervisory authority. California residents may exercise access and deletion rights; we reiterate that we do not sell or share personal information. Write to the contact in Section 14; we respond within one month.

The right to erasure has one exception: we may retain the minimum acceptance evidence for these documents where necessary for the establishment, exercise or defence of legal claims (Art. 17(3)(e) of the GDPR), as described in Section 8.

10International transfers

The Store's infrastructure (Cloudflare Workers and D1) is hosted in the United States. If you are in the European Economic Area, your data is transferred outside the EEA under the Standard Contractual Clauses (SCCs) and the supplementary measures Cloudflare incorporates in its Data Processing Addendum.

11Security

Session tokens are stored as SHA-256 hashes and the OAuth secret lives only as a Cloudflare secret, never on the client. When an account is deleted, the email linking the legal evidence is kept encrypted at the application layer with a separate key held as a Cloudflare secret; it does not remain in plaintext in the evidence archive and access is restricted to legal claims. The security of data residing on your own machine is your responsibility and depends on your operating-system account; note that agents run without isolation (see Terms, Section 8).

12Children's privacy

The Service is not directed to minors and we do not knowingly collect data from anyone under 16. If you believe a minor provided us data, write to the contact in Section 14 and we will delete it.

13Changes

We may update this policy; the current version will be published here with its date. Material changes will be highlighted prominently.

14Contact

To exercise your rights or ask about privacy: