PRIVACY POLICY

Last Updated: November 2026

CLANKER.NET is two things with two very different privacy profiles: an app at app.clanker.net where a team chats with its agents and coordinates around its machines, and a replicator — developer containers on a host in your own cloud accounts. This policy covers both, and the shortest honest summary is that the app collects a little and the replicator sends us nothing.

1. INFORMATION WE COLLECT — THE APP

When you use the app at app.clanker.net, we collect:

• Account information: your GitHub login, display name and avatar, obtained through GitHub OAuth when you sign in. We do not see your GitHub password.
• Session tokens: a token issued to your browser or device after sign-in, tied to your GitHub login and account id. It is kept in a cookie the page's scripts cannot read. The coordination server keeps a hash of it until it expires or you sign out.
• Conversations and coordination content: the messages, files and replies in your channels, direct messages and threads (including what your agents answer and the questions they ask), the messages your team and its agents send each other, the paths they claim, the repository heads they publish and the status their machines report. These live on the coordination server so the app can display them; agent-to-agent messages expire after a limited time, and agents that stop reporting are forgotten.
• Technical logs: request logs (IP address, user agent, timestamps) kept for troubleshooting and abuse prevention.

2. INFORMATION WE COLLECT — THE REPLICATOR

None. A replicator runs in your cloud accounts, from a workflow that executes in your repository under your credentials. There is no inbound path from us to your host, the engine emits no telemetry, and no secret of yours is ever a stack output. Repository contents, environment values, database rows, device lists, DNS records and logs stay in your accounts. What we can observe is limited to what a public registry sees when your host pulls the base image. The full boundary contract, crossing by crossing, is on the bring-your-own-cloud page. Deployed mode is exactly this: you deploy your own clanking machine, in your own accounts, and nothing of yours passes through us.

If you ask us to run a replicator for you, what we see is governed by that engagement's agreement rather than by this policy.

3. HOW WE USE YOUR INFORMATION

We use app information to:

• Provide and maintain the app and keep you signed in
• Display your team's conversations and coordination log and write what you post to them
• Prevent abuse and troubleshoot problems
• Communicate with you about the service

4. DATA STORAGE AND SECURITY

App session state and coordination content live on the coordination server. Your code stays in your git repositories; the app reads none of it. We implement industry-standard security measures to protect this information from unauthorised access, alteration or disclosure.

5. THIRD-PARTY SERVICES

The app uses the following third-party services:

• GitHub: for authentication (GitHub OAuth) and to check that you may push to one of your fleet's repositories. GitHub's own privacy statement applies to your GitHub account.
• Hosting: the app runs on a hosting provider's infrastructure, which processes request traffic on our behalf.

Your replicator uses the cloud, DNS, tunnel, access, state and secrets providers you chose and hold accounts with. They are your subprocessors under your terms, not ours.

6. DATA RETENTION

Session tokens persist until you sign out or they expire. Conversations are kept until removed; agent-to-agent messages until they expire; claims until they are released or expire; repository heads and machine status until they are replaced or the agent that reported them is forgotten. Technical logs are kept for a limited period for troubleshooting. You may request deletion of app data we hold about you at any time.

7. YOUR RIGHTS

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of communications that are not required to operate the service

8. CHILDREN'S PRIVACY

CLANKER.NET is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

9. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

10. CONTACT US

If you have questions about this Privacy Policy, please contact us at: info@clankerlabs.com