{% extends "base.html" %}
{% block title %}Privacy | {{ app_name }}{% endblock %}
{% block body_class %}landing{% endblock %}
{% block body %}
<header><div class="wrap">
  <a class="brand" href="/"><span class="brand-mark" aria-hidden="true"></span>{{ app_name }}</a>
  <nav aria-label="Main"><a href="/docs/quickstart">Quickstart</a>{% if session %}<a class="btn" href="/app">Open dashboard</a>{% else %}<a href="/login">Log in</a>{% endif %}</nav>
</div></header>
<main class="wrap prose doc">
  <h1>Privacy</h1>
  <p class="muted">What {{ app_name }} stores, why, and how to delete it.</p>

  <h2>What the SDK sends</h2>
  <ul>
    <li>Model name and token counts for each model call.</li>
    <li>Test IDs and which ones failed, plus a code revision ID you choose (for example a git hash).</li>
    <li>Tool names, whether they succeeded, and fingerprints of their arguments and errors. A fingerprint is a keyed hash: it shows two errors were the same without revealing what they said.</li>
    <li>Task names you give each task, and an optional outcome.</li>
  </ul>

  <h2>What it never sends</h2>
  <p>Your prompts, the model's replies, your source code, file contents, or your model provider API keys. Your agent calls the model provider directly.</p>

  <h2>What we store about you</h2>
  <p>Your email address and a scrypt hash of your password. API keys and login sessions are stored only as SHA-256 hashes, so they can't be read back out of the database.</p>

  <h2>How long it's kept</h2>
  <p>Run data and unexpected server-error records are deleted after {{ retention_days }} days. Error records contain an exception type, route pattern, stack locations, and occurrence times and counts; they exclude exception messages and request contents. Account details stay until you delete your account.</p>

  <h2>Deleting your data</h2>
  <p>Settings, then Delete account, removes your workspace, every run and event, your API keys and your login immediately.</p>

  <h2>Who processes it</h2>
  <p>Data is stored with this service's hosting and database provider. Run alerts go to the Slack webhook and email address you set. New server-error alerts go to the site operator's configured Slack webhook and email address.</p>
</main>
{% endblock %}