Tools for autonomy, not surveillance.

The mission contract

You sign in to AgentVibe for two reasons:

1. Authentication — to confirm it's you on the device that's running your agents.
2. Tier management — to track how many agents you've deployed so we can offer free, tester, and pro plans without honor-system gating.

That's the whole deal. Your account is a billing and identity surface, not a window into your work.

What we collect

Intentionally minimal. Each item below maps to a concrete feature or legal obligation; nothing is collected just in case.

• Account profile. Email, name, and avatar URL from your Google account. Stored in the profiles table.
• Tier state. Whether you have an active pro subscription, an active tester grant from a friend invite, and when each expires.
• Deployment ledger. One row per agent you deploy: deployment ID, framework (OpenClaw / Hermes / etc.), host kind (local / docker-local / docker-host / etc.), and lifecycle state. Used to enforce your tier's agent cap. We do not store your agent's name in a way that's joinable to its content.
• Linked devices. Each desktop install you sign in from gets a long-lived device token. We log the device ID, name, OS, and last-seen timestamp so you can list and revoke devices.
• Friend invite metadata. If you send a Deploy-for-a-Friend invite, we store the invite code, who created it, who installed it, and when. We never see the agent payload — it's encrypted on your machine with a PIN you choose, and the platform only ever sees ciphertext.
• Audit events. Sign-ins, tier changes, deploy reservations, account actions. Used for your own visibility (Settings → Audit Log) and for security incident response.
• Anonymous deploy stats (opt-in, off by default). If you turn this on in Settings → Privacy, each successful deploy emits a single ping with framework, runtime, host kind, success/failure, app version, and OS. Not linked to your account. No IP address. Off by default; first-deploy modal asks you explicitly.
• Subscription receipts. If you upgrade to pro, our payment provider (Dodo Payments or LemonSqueezy) handles card data; we receive only a customer ID, plan, and renewal date. We never see your card.

What we never collect

• Your agents' conversations, prompts, outputs, or memory. Those live on your machine.
• Your workspace files — SOUL.md, MEMORY.md, skills, schedules, custom code. None of it is sent anywhere.
• Your model API keys (Anthropic, OpenAI, Google, OpenRouter, etc.). They live in your OS credential store or environment, and are read directly by the agent process on your machine. The platform never touches them.
• Your channel messages — Telegram, Discord, Email, Signal — all flow directly between your agent and the channel provider. We don't proxy them.
• Your local files, terminal history, browser data, or anything else on your machine outside of the AgentVibe workspace directory.

Where data lives

Account data is stored in a managed Supabase Postgres database with row-level security policies that scope every query to the authenticated user. We use Resend for transactional email (sign-in links, password resets when applicable) and Dodo Payments (or LemonSqueezy) for billing. No data is sold or shared with advertisers, period.

Your controls

• Export. Settings → Privacy → Export account data. Returns a JSON file with everything we hold about you.
• Delete. Settings → Privacy → Delete account. Permanently removes your profile, deployments ledger, friend grants, audit logs, and linked devices. Hard delete, not soft. Existing local agents on your machines continue to run; they were never on our servers.
• Telemetry toggle. Settings → Privacy → Share anonymous deploy stats. Off by default.
• Sign out per device. Settings → General → Sign out. Revokes that device's token; doesn't affect your other devices.

Retention

Account data is retained for as long as your account is active. When you delete your account, all associated rows are removed within 30 days (the lag accounts for backup rotation; backups expire on a 30-day schedule). Anonymous telemetry is aggregated after 90 days and the per-event row is dropped.

Children's privacy

AgentVibe is not directed at children under 13 (or 16 in the EU). If you believe we've inadvertently collected data from a minor, contact us and we'll delete it.

Changes to this policy

We'll update the “Last updated” date at the top when this page changes. For material changes (new categories of data, new providers, retention extensions), we'll surface an in-app notice before the change takes effect.

Contact

Privacy questions, data requests, or concerns: [email protected].