Skip to main content

Privacy Policy

Last updated: November 2, 2026

1. Information We Collect

Account Information: Email address, display name, and authentication credentials when you create an account.

Request Data: Titles, descriptions, code snippets, and metadata submitted by your AI agents through the API.

Usage Data: API call logs, timestamps, response times, and feature usage patterns.

Device Information: Browser type, device info, and IP address for security and session management.

Projects You Build: The prompts you write, the agent's replies, the code and files in your projects, version history, and the secrets you add for your apps to use (stored encrypted, and never shown to the AI model).

Billing Data: Your credit balance, and the holds, charges and top-ups made against it.

2. How We Use Your Information

We use your information to:

  • Provide and operate the approval workflow service
  • Authenticate your identity and secure your account
  • Display your dashboard analytics and request history
  • Send email digests and notifications (when enabled)
  • Detect and prevent abuse, fraud, and security threats
  • Improve the Service based on usage patterns

3. Data Storage & Security

Your data is stored in encrypted Postgres databases and encrypted in transit. API keys are matched by their SHA-256 hash, and API keys, GitHub tokens and app secrets are encrypted at rest. Every database query the app makes is checked against an access policy so that you can only reach your own data and your workspace's. Code the agent writes runs in isolated sandboxes, not on our servers.

4. Data Sharing

We do not sell, trade, or rent your personal information. We may share data only:

  • With your explicit consent
  • To comply with legal obligations or law enforcement requests
  • To protect the rights, safety, or property of our users
  • With the service providers below, who operate parts of the Service for us

Service providers we use:

  • Vercel: hosting, serverless functions, file storage, build sandboxes, privacy-friendly page analytics, and the AI Gateway that routes requests to AI models
  • AI model providers reached through the AI Gateway, such as Anthropic (the coding agent and chat) and OpenAI (image generation). Your prompts, project files the agent reads, and its replies are sent to them to produce each answer.
  • Neon: the Postgres databases
  • 1Profile: sign-in
  • cred: credit balances and payments
  • Resend: email
  • GitHub, Discord and webhook endpoints, only when you connect them

5. Webhooks & Third-Party Integrations

When you configure webhook URLs or Discord integrations, request data is sent to those endpoints. You are responsible for the privacy practices of third-party services you integrate with.

6. Data Retention

We retain your data for as long as your account is active. Request data may be retained for up to 90 days after deletion for backup purposes. API logs are retained for 30 days. You can request full data deletion by deleting your account in Settings.

7. Your Rights

You have the right to:

  • Access and export your data (CSV export available on the dashboard)
  • Correct inaccurate information via your profile settings
  • Delete your account and associated data
  • Opt out of email communications

8. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification.

10. Contact

For privacy questions, or to ask for a copy or deletion of your data, email will.schulz@aw3.tech.