Privacy

This website

The public pages set no tracking cookie and load no third-party script. Your browser remembers light or dark mode. Signing in sets an account session cookie.

The newsletter

If you leave an email address on the home page, you join our newsletter immediately for occasional product news. We store your trimmed, lowercased address, the subscription and creation times, the signup source, and a hash of a random unsubscribe token. We do not verify ownership of the address or send a signup or confirmation email. We keep the address until you unsubscribe or ask for removal.

Write to [email protected] to leave the list. Every newsletter email includes an unsubscribe link; opening it changes nothing, and pressing the button on its page deletes the address. Joining sends no email and does not send your address to Cloudflare's email service. Cloudflare processes the address to deliver newsletter emails. To limit abuse, the server keeps a count of requests per network address for ten minutes.

Addresses previously submitted for one cloud launch announcement remain separate: they are not enrolled in the newsletter and are kept until removal or that one announcement, then removed. You can request removal at the same support address.

Email we send

Account and security emails are separate from the newsletter and optional owner emails:

• Address verification: password signup, or signing in with the correct password before verification, sends a link to the account address. This is required account email, not an optional subscription. If you did not sign up, ignore the link.
• Password reset: a reset request sends a link to the account address. This request-driven email has no subscription opt-out.
• Organization invitation: an owner can send an invitation to an address they choose. This is not an owner-email subscription; ignore an unexpected invitation or ask the inviter to revoke it.
• Magic sign-in link: website passwordless sign-in or signup, and device authorization requests, send a sign-in link to the requested address. This request-driven email has no subscription opt-out. Opening the page does not sign you in; its Sign in button does.
• Device approval: the device flow uses that magic sign-in email. We do not send a separate approval request or approval-result notification. Signing in does not approve the device; approval is a separate action.
• Claim links and reminders: self-enrolment returns a claim link to the calling agent. We do not currently email claim links or reminders, so there is no claim-email subscription.
• Daily reports: sending is not yet implemented. The planned activity email is for organization owners and skips quiet days. Organization settings and personal opt-outs are already available.
• Suggested improvements: sending is not yet implemented. The planned owner email covers new friction with suggested improvements when no GitHub or GitLab connection is active. It has its own organization setting and personal opt-out, independent of daily reports.

A personal opt-out for daily reports or improvements applies to that type across every organization you own, even if an organization has enabled it. You can resubscribe in your account's email preferences; this does not change organization settings, account emails, or the newsletter.

We store personal opt-outs and only SHA-256 hashes of unsubscribe tokens, linked to your account and email type. Every issued unsubscribe link remains valid until account deletion, including after you resubscribe; links do not expire or rotate. Someone holding a forwarded old email can therefore unsubscribe you again. Opening a link changes nothing: the page's Unsubscribe button, or your mail provider's one-click unsubscribe action, submits the token without requiring sign-in. The response does not reveal whether a token or subscription exists. Account removal is by support request.

When we send through Cloudflare Email Service, it processes the recipient address and message to deliver the email. Emails already delivered cannot be recalled when you unsubscribe or delete source reports.

The open-source software

The AgentFeedback binary, in local mode, stores reports on your machine and makes no network call. What the client collects when it reports to a server, and what it never collects, is stated in the project's security page.

The hosted service

AgentFeedback Cloud is in public beta, free during beta. We store account details and the reports submitted to your organization to provide the service. Reports can contain paths, commands, error text and code. Secret-pattern redaction is applied before storage but cannot remove every secret. Organization data is not shared across organizations for model training or benchmarking. Normal organization retention is 365 days. Contact [email protected] to request deletion.

Repository autofix is off unless an organization owner enables it for a connected repository. An investigation copies that repository into a disposable job container and sends source excerpts and linked reports, after report credential redaction, to Anthropic. Standard Anthropic API retention terms apply; we do not currently have a zero-data-retention agreement. Turning off LLM processing or disconnecting the repository stops work at its next authorization check. Investigations store findings and patches for organization members to inspect. Publishing requires separate authorization and can send a patch to the connected repository provider.

Automatic session transcript upload requires organization-owner consent. Transcripts include prompts, responses and tool calls/output, may include personal or other-client repository content, and are accessible to every organization member and organization keys with read/export scope. Secret scrubbing is incomplete. Turning collection off does not erase completed uploads. Both retention preferences currently use normal organization retention; deletion after processing is not yet enforced. Session extraction currently uses heuristics, not an LLM.

Dedicated session grading is planned, not yet running. Under this policy, existing and new uploaded sessions are graded once by a model: transcript text is sent to Anthropic using our key, after redaction, under standard API retention without a zero-data-retention agreement. It is on by default through the organization's LLM processing setting. An owner can turn that setting off in Settings to stop grading and delete prepared provider inputs. Turning uploads off alone does not opt stored sessions out of grading.

Grades describe the agent setup, not people: efficiency, code quality, procedure compliance, verbosity and friction reporting, with evidence and A–F results per repository and organization. A separate $10 per-organization UTC-week budget and a per-session token ceiling bound grading; sessions skipped for budget are counted as ungraded. Grading does not trigger autofix or put transcript quotations in pull requests. Transcripts and inferred candidates remain excluded from weekly insight synthesis and autofix inputs.

Contact

Write to [email protected] to ask what we hold about you or to have it removed.