Privacy Policy

DashClaw is an open-source governance runtime. How your data is handled depends on which of the two deployment models you use:

• Self-hosted (the default). You deploy DashClaw on your own infrastructure with your own database. Everything your agents record — actions, decisions, sessions, approvals — is stored in the database you control. The software does not send telemetry, usage data, or any other information to us. We never see it.
• Hosted trial (dashclaw.io). If you sign in on our hosted instance, we operate the infrastructure and this policy describes what we collect and why.

• Account data. Signing in with Google gives us your email address and display name. We use them to create and identify your workspace. We do not access your contacts, files, or anything else in your Google account.
• Governance records your agents send. The product's purpose is to record what your AI agents do: action records, guard decisions, sessions, assumptions, approvals, messages, and spend records. These are scoped to your workspace and visible only to your workspace.
• Credentials. API keys and OAuth access tokens are stored as SHA-256 hashes, never in plaintext.
• Marketing analytics. Public marketing pages (landing, docs, get-started) record anonymous page-view events so we can tell which documentation works. Operational surfaces are not tracked.

The hosted instance runs on a small set of infrastructure providers:

• Vercel — application hosting
• Neon — Postgres database
• Google — sign-in (OAuth)
• Cloudflare Turnstile — bot protection on signup

Self-hosted instances use whatever infrastructure you choose; none of the above applies unless you pick the same providers.

• We do not sell your data.
• We do not train models on your data.
• We do not share workspace contents with anyone outside your workspace.
• DashClaw never requires an LLM API key — the governance runtime does not call language models on your behalf.

Hosted-trial workspaces and everything in them are deleted on request — email us from the address you signed in with. Self-hosted data lives in your database; deleting it is a query you run, not a request you make.

Material changes are recorded in the project's public changelog and reflected in the date at the top of this page.

Questions or deletion requests: team@dashclaw.io.