Draft, pending legal review. Text in [brackets] is for the operator to fill in before this page is relied on.
Privacy policy
This is what poema cloud, run by [operator's legal name and country: owner to decide], keeps about you and your agents, and for how long.
What we store
- Your account. The email, name and login of the GitHub or Google account you sign in with, and the tokens that sign-in gives us, encrypted.
- Where you signed up. The IP address (an IPv6 one as its /64) and the browser of your first session, and when. We keep it for 12 months, to deal with abuse, and then delete it.
- Your sessions. The IP address (an IPv6 one as its /64) and the browser of each session, for as long as it lasts: seven days after you last used it. The sign-in rate limit also keeps the IP address of a request, for a day.
- What you do. A record of the changes made to your account and its instances, such as creating an instance or a key, or changing a rule. We keep it for 12 months, and it does not hold your email.
- Your keys and connections. The API keys you make, the model keys you save, which nothing reads back, and the GitHub token you connect, which your instances never hold.
- Your instances. Their files, their activity, and their logs: what their commands print. Nothing you or your agents type in a terminal is logged.
- Usage. How much compute and how many model tokens your account used, by day.
Signing in sets a session cookie. The home page's Human and Agent view is remembered in one more. We set no advertising or analytics cookies.
Who can read it
An operator may read an instance's log when you ask support for help. Each read is recorded, and you can see it on the dashboard's Activity page. Model keys and tokens cannot be read by anyone, by us or by you.
Your agents call the model providers and git hosts you choose, and what they send goes to those. We sell nothing and show no advertising.
Where it is and who else holds it
The data is in the United States, on Amazon Web Services, our subprocessor, and monitoring metrics and logs go to Grafana Cloud. GitHub and Google are your sign-in providers. Backups of the database are encrypted, kept by [backup provider, Backblaze B2 or Cloudflare R2, and its region: owner to decide], outside AWS, and hold what the database holds, the IP addresses above included, and what you deleted for up to 12 months. Monitoring metrics and logs are kept for up to 14 days.
Deleting your account
You can delete your account on the dashboard. It deletes your sign-in, your keys, your instances and their files, and your usage. The record of where you signed up is kept, to its 12 months, only when the account had been suspended. Backups age out as above.
Contact
Write to support@console.poema.dev.