Privacy Policy

This policy covers the hosted Clawband service: the website at clawband.io, the dashboard, the API at api.clawband.io, and the MCP endpoint. It applies to anyone who visits the site or holds an account.

It does not cover self-hosted Clawband. If you run the software yourself under the PolyForm Noncommercial License, you are the operator and this policy does not apply to the data on your instance.

It also does not cover the third-party services you connect through Clawband. Stripe, Gmail, GitHub, Slack and every other provider has its own privacy policy that governs what happens on their side.

Account information

Your email address, a hash of your password, whether your email has been verified, and whether two-factor authentication is enabled. We never store your password in a form we can read.

Connected provider credentials

When you connect a provider, we store the OAuth tokens or API keys that provider issues, along with the scopes they carry and the provider account identifier. These are envelope-encrypted at rest: each record is sealed with its own data key, which is itself wrapped by a master key held in AWS KMS. The database alone cannot decrypt them.

Agent keys and grants

We store a hash of every Clawband key you issue, never the key itself, plus the grants attached to it: which capabilities it may call and which parameters are pinned. Security events about grant changes record the policy type and a SHA-256 digest of the policy, not the literal values.

Execution metadata

Every call your agents make through the gateway writes an audit event: a timestamp, the key that made the call, the connected account it was bound to, the provider and capability, the outcome and error code, latency, and the number of billable units. Audit rows record how many top-level parameters a call had and a redaction marker. They do not contain parameter names, parameter values, or responses.

Billing information

If you subscribe to a paid plan, Stripe processes the payment. We store your Stripe customer ID, subscription ID and status, the price you are on, and the current billing period. We never see or store your card number.

Usage analytics

We use PostHog to understand how the site and dashboard are used. It records page views, clicks, and session recordings in which every input field is masked. Autocapture and session recording are switched off entirely on the sign-in, registration, password reset, email verification, API key, and grant pages. PostHog stores an identifier in local storage and a cookie so it can recognise the same browser across visits.

Server logs

Our servers log the IP address, user agent, request path, and timing of each request, together with request and routing identifiers. Application logs do not contain call parameters or provider responses.

Messages you send us

If you email us, we keep the message and our reply so we can help you and refer back to it later.

Clawband is a gateway. The content of the calls your agents make, such as the body of an email, the contents of a repository, or the details of a payment, is relayed to the provider and the response is returned to your agent. We do not persist this content, with two narrow exceptions:

• Replay cache. When a call carries an idempotency key, we keep the encrypted response for ten minutes so a retry returns the same result instead of running the side effect twice. Each cached response has a fresh data encryption key, bound to your user, the API key, and the idempotency key. A cleanup job removes expired payloads every minute. A backlog can keep encrypted, inaccessible payloads a little longer than ten minutes.
• Idempotency tombstones. After the response expires, we keep a permanent record that the idempotency key was used: the opaque key you supplied, your user and API key IDs, timestamps, and status. This is what prevents an old retry from executing a side effect again. Because tombstones are permanent, idempotency keys should be random and must not contain secrets or personal data.

• To authenticate you and keep your account secure.
• To execute calls on your behalf against the providers you have connected, within the grants you have configured.
• To show you what your agents did, through the audit log and usage pages.
• To meter usage against your plan and bill you for it.
• To detect abuse, enforce rate limits, and investigate security incidents.
• To send transactional email: verification links, password resets, and billing notices.
• To understand how the product is used so we can improve it.

We do not sell your data. We do not show advertising. We do not use your data, your agents' calls, or your provider credentials to train machine learning models.

Providers you connect

When your agent calls a capability, we send the call to that provider using the credentials you connected. That is the service. What the provider does with it is governed by their terms and privacy policy, not ours.

Subprocessors

We rely on the following companies to run the service:

• Amazon Web Services for key management (KMS) and infrastructure, United States.
• Vultr for compute, databases, and DNS, United States.
• Stripe for payment processing and subscription management.
• Mailgun for sending transactional email.
• PostHog for product analytics, hosted in the United States.

Legal and safety

We will disclose information if required by law, a court order, or a lawful government request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Clawband, our users, or the public.

Business transfers

If Clawband is acquired or merges with another company, your information may be transferred as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

• Session cookie. Set when you sign in. It identifies your session and is required for the dashboard to work. It is marked secure and HTTP-only in production.
• Analytics. PostHog stores a distinct ID and session state in a cookie and in local storage. You can block these with a content blocker or by disabling cookies for clawband.io. The dashboard works without them.

We do not use advertising or cross-site tracking cookies.

• Account information for as long as your account exists. When we delete an account, it is removed from the live database within 30 days of the request.
• Connected provider credentials until you disconnect the provider or delete your account, at which point the encrypted record is removed. Revoking access on the provider's side also renders our copy useless.
• Agent keys and grants until you revoke them or delete your account.
• Audit events for 90 days, removed by a scheduled cleanup.
• Replay cache for ten minutes after the call is admitted.
• Idempotency tombstones permanently, as described above.
• Billing records for as long as tax and accounting law require, typically seven years.
• Server logs for up to 90 days.
• Analytics events for up to one year.

Encrypted database backups follow their own rotation schedule and may hold a copy of deleted data for a short period after it is removed from the live database.

Provider credentials and cached responses are envelope-encrypted with per-record data keys wrapped by a master key in AWS KMS. Passwords and agent keys are stored as hashes. All traffic to the site and API is encrypted in transit. Agent keys are scoped: each one can only call the capabilities you grant it, with the parameters you pin, so a leaked key is bounded by its grants rather than by your whole account.

No system is perfectly secure. If you believe your account or a key has been compromised, revoke the key from the dashboard and contact us at ops@clawband.io. If you find a vulnerability, please report it to the same address before disclosing it publicly.

From the dashboard you can, at any time:

• Disconnect any provider, which removes its credentials.
• Revoke any agent key and edit or remove its grants.
• View your audit log and usage.
• Change your email or password and enable two-factor auth.
• Cancel a paid subscription.

To delete your account, or to request a copy of the personal data we hold about you, email ops@clawband.io from the address on the account. We will act on the request within 30 days. Self-service account deletion is not available in the dashboard yet.

Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA: to access, correct, delete, or port your data, to object to or restrict certain processing, and to complain to a supervisory authority. We honour these rights for everyone regardless of location. We do not sell personal information and do not discriminate against anyone for exercising their rights.

The service is hosted in the United States and your data is processed there. If you access Clawband from elsewhere, you are transferring your data to the United States, where privacy law may differ from your own jurisdiction. Where a legal transfer mechanism is required, we rely on standard contractual clauses with our subprocessors.

Clawband is not directed at anyone under 18 and we do not knowingly collect personal information from them. If you believe a minor has created an account, contact us and we will delete it.

When we change this policy we will update the effective date at the top. For material changes, such as collecting a new category of data or adding a subprocessor that receives customer data, we will email account holders before the change takes effect. Continued use of the service after that date means you accept the updated policy.

Questions about this policy or about your data go to ops@clawband.io. Our Terms of Service describe the rules for using the service.