Privacy

What Agent Supra stores, why, and how to delete it.

What the SDK sends

• Model name and token counts for each model call.
• Test IDs and which ones failed, plus a code revision ID you choose (for example a git hash).
• Tool names, whether they succeeded, and fingerprints of their arguments and errors. A fingerprint is a keyed hash: it shows two errors were the same without revealing what they said.
• Task names you give each task, short progress notes, and an optional outcome.

What it never sends

The SDK does not automatically send your prompts, the model's replies, source code, file contents, or model provider API keys. Your agent calls the model provider directly. Do not put secrets or private content in task names, progress notes, test IDs, or other fields you supply: those fields are sent as written.

What we store about you

Your email address and a scrypt hash of your password. API keys and login sessions are stored only as SHA-256 hashes, so they can't be read back out of the database.

How long it's kept

Run data and unexpected server-error records are removed from the active database after 30 days. Error records contain an exception type, route pattern, stack locations, and occurrence times and counts; they exclude exception messages and request contents. Account details stay in the active database until you delete your account.

Encrypted database backups are retained in GitHub Actions for up to 30 days. Neon recovery snapshots and isolated restored branches can retain older copies until they are deleted. Data removed from the active database can therefore remain in these recovery copies.

Deleting your data

Settings, then Delete account, removes your workspace, runs, events, API keys, and login from the active database. Historical recovery copies are not changed immediately. Contact us to request help with data in retained backups or restored branches.

Who processes it

The website runs on Vercel and its active database is hosted by Neon. Encrypted database backups are stored in GitHub Actions. Run alerts go to the Slack webhook and email address you set; email delivery uses Resend. New server-error alerts go to the site operator's configured Slack webhook and email address.