Privacy Policy

Who we are

Agentevo ("we", "us") runs agentevo.sh, the web console at agentevo.sh/console and the Agentevo Cloud API at api.agentevo.sh. The local runtime and SDK are open-source software you run yourself. Questions about this policy go to support@agentevo.sh.

What stays on your machine

The local runtime works offline and needs no account. Local capture and recall use data on your machine or in your own VPC:

• Raw operational data: prompts and model responses, tool arguments and results, source code and diffs, terminal output and internal URLs are stored in an encrypted local vault. Ordinary sync does not upload raw traces. Text you explicitly include in a cloud recall query or its error context can be sent to the Cloud API after local screening and redaction.
• Secret detection: the runtime redacts matches to configured secret patterns before local storage, and the Cloud API screens supported payloads for secret patterns. These checks are finite: they can miss secrets and other sensitive information. Review data before using cloud recall, sync or embeddings.

Local-first covers data sent to Agentevo. The coding agent you use (for example Claude Code or Codex) talks to its own model provider under that provider's terms; we do not control that traffic or how the provider keeps it. Optional BYOK embeddings also send input text directly to the embedding provider you configure, under its terms.

What we receive

When you create an account

Sign-up and sign-in are handled by Clerk, which manages your account identifiers and email address. Our Cloud API receives your verified Clerk user ID and provisions a personal tenant and Default workspace. The console displays your email from Clerk. Workspace names supplied through the API are control metadata.

When you use the cloud

Control metadata only, by default: tenant, workspace and user IDs, your plan, request counters and quota, feature flags, the public keys of devices you register, the personal access tokens you create (stored as hashes), and service audit records such as who changed a workspace's sync mode and when.

When you request cloud recall

Explicit cloud recall (for example, agentevo recall --cloud) sends your query text and selected workspace, capability and risk settings to the Cloud API. Optional automatic context can include repository, branch, stack and runtime details; failure context can include a failed command or error text. Local checks redact detected patterns and reject remaining detected secret material, but do not guarantee that the text contains no sensitive information. This request is separate from turning sync on.

Only if you turn sync on

Sync is off until a workspace owner opts in under the sync terms. Then:

• Opaque Relay sends full skill steps end-to-end encrypted. We store sealed envelopes we cannot read; your devices index and decrypt them locally.
• Searchable Sync sends sanitized step templates, fingerprints and verification summaries, so the service can search them for you. Ordinary sync excludes raw file contents, diffs, command output, prompts and absolute paths; templates can still contain sensitive information that automated screening does not detect.

If you enable BYOK embeddings for cloud recall or searchable sync, the SDK sends the selected query or template text to your configured embedding provider and can send the resulting vectors to the Cloud API. That provider traffic is separate from AgentEvo hosting.

This website

• We do not use analytics, advertising or tracking scripts.
• Fonts load from Google Fonts, which receives your IP address and browser details when it serves them.
• If you sign in, Clerk sets the cookies it needs to keep you signed in, and the sign-up form may run Cloudflare Turnstile to stop bots.
• Session storage holds a post-sign-in navigation flag and short-lived plan and usage caches. These disappear when you close the tab. Local storage keeps a sign-in display hint and sidebar preference, plus recent workspaces, calculator assumptions and dismissed quota notices associated with the signed-in user. These preferences can persist across tab closes. The console removes preferences belonging to a different or signed-out user when it observes that session state; signing out elsewhere may leave them until the console next loads. Access tokens are not stored by the console in local storage.
• Like any web service, our servers may keep short-lived operational logs (such as IP address, request path and time) to run and secure the service.

How we use it

To provide the service you asked for: sign you in, keep every tenant's data separate, count requests against your plan, run the sync and cloud recall you turned on, prevent abuse, and answer support requests. We do not sell personal data, and we do not use your data to train models.

Service providers

• Clerk: accounts, sign-in and session management.
• Hetzner: hosting for the website and the Cloud API.
• Google Fonts: font delivery for this website.
• Cloudflare Turnstile: bot protection on sign-up, loaded by Clerk.

Paid plans are not available yet, so no payment details are collected. When they launch, a payment processor will handle card data and this policy will say which one.

How long we keep it

• Account and control data: operational account data is removed when the tenant is deleted. Minimal audit and security history, billing records and a Clerk user-linked monthly usage ledger remain to preserve accountability and prevent quota resets. Their retention periods have not yet been finalized; contact us for the current operational policy.
• Synced skill data: while your workspace keeps it. Switching a workspace back to Local-only stops new uploads and search right away; the copies already stored stay until you delete that workspace's cloud data.
• Revocations: a revoked object leaves a minimal tombstone (an identifier, no content), so it can never be replayed.
• Backups: routine database snapshots retain the latest 96 copies by default (about 24 hours when the configured 15-minute cadence runs continuously). Operational and archive backups need a separate retention policy; elapsed time alone does not guarantee that a particular copy has been removed.

Retention is separate from freshness: a skill can go Stale and stop being used long before it is deleted.

Your choices and rights

• Stay local: the runtime needs no account, and sync stays off unless you turn it on.
• Change a workspace's sync mode at any time. Moving to less cloud visibility never needs new consent.
• Workspace owners can export a workspace's cloud data (GET /v1/workspaces/{slug}/export) and delete it (DELETE /v1/workspaces/{slug}/cloud-data) through the Cloud API.
• Account owners can download cloud account data and delete the active Agentevo tenant from the console's Account page, or use GET /v1/tenant/export and DELETE /v1/tenant. Export files contain sensitive data; store them privately. Tenant deletion leaves the retained records and backup copies described above, and does not delete your local vault or your separate Clerk identity.
• For other access, correction or deletion requests, or questions about how we handle data, the published contact is support@agentevo.sh. Depending on where you live, you may have further rights under local law, and you can complain to your data protection authority.

Agentevo is not directed at children under 16, and we do not knowingly collect their data.

Security

Traffic to our services uses TLS. Tenant, workspace and project access is derived from your authenticated identity, never from IDs in a request, and cross-tenant requests fail without revealing whether an object exists. Learned objects are signed, and a signature proves who made an object, never that it is safe to reuse. No system is perfectly secure; if you find a vulnerability, please tell us at support@agentevo.sh.

Changes and contact

When this policy changes we update the date at the top. Questions: support@agentevo.sh.