Privacy policy
Last updated 7 October 2026
What we collect
Account data
Your name, email address, a scrypt hash of your password, and if you enable two-factor, a TOTP secret and hashes of your recovery codes. Sign-in times and the IP address and user agent of each session, for the audit log.
Evidence from your machines
Whatever the checks you or the analyst run return. This can include process names and command lines, listening ports and connection endpoints, local account names, logon times, autorun entries, installed packages, browser extension names, browsing history and download metadata, cookie hosts (never values), file paths and hashes, and the contents of a small allowlist of forensic configuration files.
Much of this is personal data about whoever uses the machine. Deciding to collect it is your decision as the controller; we process it on your instruction.
Usage data
For each model call: which model, token counts, latency, what it cost us and what we charged you. This is what makes your bill explainable.
What we do not collect
- File contents outside the forensic allowlist.
- Private keys,
.envfiles,.netrc, credential stores or certificate bundles containing keys — these are on a deny list that overrides the allowlist. - Cookie or password values.
- Raw snapshot collections — only a digest of each snapshot is stored.
- Third-party analytics or advertising identifiers. There are none on this site.
Who we share it with
Evidence needed to answer a question is sent to the model provider you selected for that conversation — Anthropic, OpenAI, Google, or another provider we have enabled — and nowhere else. We do not use it to train models.
Payment details are handled by PayPal and never reach our servers. Account email — verification, password resets, invitations — is delivered by SendGrid. Every third party involved is listed on our sub-processors page.
How long we keep it
We keep conversations, tool results, snapshot digests and findings while your workspace exists. To have a workspace and its data deleted, email privacy@guardyn.dev and we will do it within 30 days. The credit ledger and the audit log are kept as financial and security records.
Cookies and local storage
One cookie keeps you signed in. Platform operators also get a short-lived cookie that records a recent two-factor check for the admin console. Your theme and table-view preferences are kept in your browser’s local storage. There are no tracking or advertising cookies.
Your rights
Export, correction and deletion on request to privacy@guardyn.dev. If you are in the UK, EU or a comparable jurisdiction you also have the right to object, to restrict processing, and to complain to your supervisory authority.
Security
Every session token, enrolment token and API key we issue is stored only as a hash. The model-provider keys we use are encrypted at rest with AES-256-GCM. Traffic is TLS-only. The agent refuses to send anything over plain HTTP to a non-loopback host. Details in our security model.