PRIVACY

If you have an account: your email address, a password hash (or nothing, if you signed in with GitHub or Google), your board layout and panels, and the things you've configured on top of them — rules, the Steward's autonomy dial, and any chat channel you've linked.

Your personal Steward keeps a short, plain-language memory of what you seem to care about — the same summary the "what does my assistant know about me?" page shows you. You can read, edit or wipe it at any time; a run of the Steward never overwrites a memory edit or wipe you made while it was in progress.

Engagement signals — that you opened, expanded, pinned, dismissed or muted something — are kept 90 days. They're what the Steward learns from and what a graduation pass reads; nothing needs them older than that, so nothing keeps them older than that.

If you're on Pro and the builder writes you a panel, each build run's debug transcript (what the coding agent did, for tracing a failure) is kept for 30 days and then cleared — the run's outcome and timing stay on record as ordinary build history, only the transcript text itself is wiped.

We also keep operational records that aren't about you specifically: which modules were fetched and when, and their health.

No payment card details — Stripe holds those; we keep a subscription status.

No plaintext API key, ever. A key you add under Settings so a module can call an API on your behalf is envelope-encrypted (two layers of AES-256-GCM) the moment it's saved, and from then on it's write-only: no page, response or log can read it back. It's only ever decrypted inside the egress proxy, at the moment of the outbound request it authorizes — never inside an agent's prompt, a module's output, a build sandbox, or anything we log.

No reading history beyond the aggregate engagement counts above, no scroll or mouse tracking, no session recording, no fingerprinting.

Composing your board, judging what's worth an alert, and building a requested panel each run through a model gateway — primarily our own self-hosted model, with a capped pay-as-you-go cloud model used only as overflow when it's unavailable. What's sent is what those jobs need: your request, your board's current shape, and the module data being judged — never another user's data, and never a stored API key (see above).

A coding-agent build runs inside an isolated sandbox, not on the machine serving the site, and reaches the outside world only through the same key-vault proxy every module fetch uses.

Pageviews and a small set of product events (like "signup completed") are counted by Umami, self-hosted on our own infrastructure, when it's configured. It sets no cookies, assigns no cross-site identifier, and sends nothing to any third party. It honors your browser's Do Not Track setting automatically.

Nobody buys it, and nobody gets it for marketing. The parties who touch your data are only the services required to run the product: Stripe for payment if you subscribe, our OAuth providers if you chose to sign in with one, our email and web-push providers when we send you something you asked for, Telegram, Discord or Slack if you've linked one of them — and only for the alerts and replies you'd expect a linked channel to carry — and, only when our own model is unreachable, the capped cloud model provider we use as overflow, which receives just what that one job needs (see "the assistants and the model" above).

Settings → Your data has a one-click JSON export of everything tied to your account, and account deletion — a hard delete, no soft-delete grace period — confirmed by re-typing your email address. Deletion is real deletion: your board, layout, rules, Steward memory and linked channels go with it.

Traffic is HTTPS end to end. Passwords are hashed, never stored or logged in the clear. API keys are envelope-encrypted as described above, and a chat-channel link code is single-use, expires in minutes, and only its hash is ever stored — never the code itself.

This is a small service. It is not certified against any audit standard, and saying otherwise would be the kind of claim this page exists to avoid.