Privacy Policy

1. Who we are

Agent Cohort is operated by B. Dol Technical Consulting, LLC, a limited liability company organised in the Commonwealth of Virginia, United States, trading as “Agent Cohort” (referred to in this policy as “we”, “us”, or “our”).

We are the controller of your personal information for the purposes of this policy. You can reach our privacy contact at [email protected].

2. Scope of this policy

This policy applies to:

• The Agent Cohort marketing website at wrenix.ai and its environment subdomains.
• The Agent Cohort account portal at account.wrenix.ai (and its environment subdomains).
• The Agent Cohort desktop application for Windows, macOS, and Linux, including the backend services it calls on our wrenix.dev domains (for example our API endpoints and the telemetry ingest endpoint named in §3.6).
• Email and other communications you have with us.

It does not apply to third-party agent CLIs, plugins, or services you install or connect through Agent Cohort. Those are governed by the privacy policies of their respective providers (for example, Anthropic for Claude Code, OpenAI for Codex, or the publisher of any plugin you install).

3. Information we collect

3.1 Information you give us

• Account profile. When you sign in, we receive your name, email address, and profile picture from your identity provider (currently Google). We use this to identify your account and personalise the app.
• Workspace and team information. If you create or join a team workspace, we store your role within that workspace and the workspace metadata you provide (workspace name, seat allocations, member invitations).
• Billing details. Payment is processed by Stripe, Inc. We do not receive or store your full card number, CVC, or bank credentials. We do receive transaction metadata (the last four digits, card brand, country, billing email, plan, status, and invoice history) so we can show your subscription state and respond to billing support.
• Support and enquiries. When you contact support, fill out the enterprise contact form, or open a bug report, we receive whatever you choose to send us, including your name, email, message contents, and any attachments.

3.2 Information we receive automatically

• Authentication metadata. When you sign in we record session IDs, device identifiers (bound to your installation), a device name (described in the next bullet), IP address, user-agent, and timestamps. These are used for security, abuse prevention, and to let you review and revoke active sessions.
• Device name. When the desktop app signs in it also sends us the name your operating system reports for that machine. That is normally the hostname set on the device by you or by your employer, so it may contain your name, your organisation's name, or both (for example, jane-smith-mbp or acme-corp-laptop-14). We store it with your account record, truncated to 80 characters, and show it in the Account tab so your devices are listed under names you recognise rather than opaque identifiers. That is what makes it practical to spot a session you do not recognise and revoke it. You can rename a device from the Account tab at any time; the name you set replaces the reported one in your device record, and later sign-ins do not overwrite it. Renaming does not change what the app sends, so the reported name still reaches our authentication logs at each sign-in and is retained under §7.
• Service operational data. When the desktop app or account portal calls our backend we log the request method, route, response code, latency, and a coarse error category. These logs are used to diagnose outages and protect the service from abuse, and are retained for a short period (see §7).
• Subscription and entitlement state. We store your plan, status (active, trialing, past-due, canceled, etc.), trial expiry, and a record of plugin entitlements that gate paid features.

3.3 What we deliberately do not collect

• We do not see the contents of your prompts, terminal output, source code, or files on your machine. The desktop app is a local terminal multiplexer; everything you type into Claude Code, OpenAI Codex, or any other agent CLI travels directly between that CLI and its provider.
• We do not run session replays, behavioural-profile analytics, or cross-site tracking on the marketing site or account portal. That is a statement about our web surfaces; for what the desktop app can send, and only if you switch it on, see §3.6. The marketing site loads Google Ads conversion measurement on every page, but the default behaviour depends on your region. For visitors located in the EEA, the United Kingdom, or Switzerland, Google's Consent Mode v2 is set to denied by default; no cookies are written and any ping is fully redacted (no identifiers, no personal data) until you click Accept. For visitors elsewhere, the default is granted; you can opt out via the consent banner. See §11 for the full description.
• We do not sell your personal information.
• We do not use your personal information to train AI models.

3.4 Crash reports and bug reports

If you opt in to send a crash report or open a bug report from inside the app, the contents are uploaded to private GitHub repositories (BenDol/Agent-Cohort-Crashes and BenDol/Agent-Cohort-Reports) that only our team can access, where we triage them. Crash reports include stack traces, app version, OS, and the diagnostic information you elected to attach. Submission is always your choice. Private means access is restricted to our team and to GitHub as our hosting provider; it does not mean the contents are encrypted or held in confidence indefinitely. Whatever you include still leaves your machine, is stored on GitHub, is read by our staff during triage, and is retained under §7, so do not paste credentials, customer data, or sensitive paths into a crash or bug report.

3.5 Cloud Sync

Cloud Sync is an optional feature, off by default, available on paid plans. It backs up your Agent Cohort configuration so that signing in on a new machine restores your environment. It stores settings only: your application preferences, your per-project dock settings, and your project profiles. It does not upload your source code, the files in your projects, your terminal output, or your agent conversations.

What it does store is end-to-end encrypted on your own device using a sync passphrase that we never receive and cannot recover. We hold ciphertext plus opaque metadata (the scope type, a revision number, a byte size, and a timestamp); the project names attached to each entry are themselves encrypted. Recognised credentials, tokens, and API keys are stripped out before encryption, so they do not leave your machine at all. Settings you author yourself as free text (for example, project notes or a custom agent command) are part of your configuration and are backed up with it, encrypted. Because the encryption keys are yours alone, we are structurally unable to read the contents of a Cloud Sync backup, and if you lose your passphrase we cannot restore it for you.

You can turn Cloud Sync off at any time in the desktop app, and your local settings always remain authoritative. To have a stored backup erased, contact us at [email protected].

3.6 Product telemetry

The desktop app can send us product telemetry. It is strictly opt-in and off by default: nothing is transmitted unless you turn it on and give consent inside the app, and if you never do, the app sends us no telemetry at all. You can switch it back off at any time.

When it is enabled, a telemetry record describes how the app ran, not what you did in it. It contains a random device identifier generated for your installation, a session identifier, the app version, build identifier, and release channel, your operating system platform, architecture, and version, how long the session lasted, counts of crashes and the category of each, on/off flags and counters for which features were used, the identifiers of the plugins you have enabled or disabled together with how often each was opened, update events (versions offered, downloaded, and installed, and which plugins were updated), how many terminals and docks were open, and bounded numeric summaries covering agent usage, interface usage, reliability, and performance. This is pseudonymous rather than anonymous data: the identifiers are randomly generated and are not your name or your account, but they are stable enough to group one installation's records together.

The telemetry payload does not contain your IP address, your username, your machine's hostname, any file or directory path, any terminal content, or any information about your git repositories. It carries counts, fixed labels, and identifiers of our own components. That statement is scoped to the telemetry channel. Signing in is a separate request to a separate endpoint, and it does send us the device name your operating system reports, which on most machines is the hostname (see §3.2). Both are accurate: telemetry uploads carry no device name, and the device name we hold from sign-in is not part of any telemetry record. As with any network request, the address an upload arrives from is visible to our ingest endpoint and its network provider at the transport layer.

We use telemetry to understand which features are actually used, to spot reliability, crash, and performance problems across releases, and to decide what to build and fix next. Uploads go to ingest.wrenix.dev and are stored in a private GitHub repository (BenDol/Agent-Cohort-Telemetry) that only our team can access. As with crash reports, private means access is restricted to our team and to GitHub as our hosting provider; see §7 for how long we keep it.

4. How we use information

We use the information we collect to:

• Provide, maintain, and improve the service (authentication, subscription management, plugin entitlement, and, where you have enabled it, Cloud Sync backup of your settings as described in §3.5).
• Understand which features are actually used, spot reliability, crash, and performance problems across releases, and decide what to build and fix next (only where you have switched on product telemetry as described in §3.6).
• Process payments and send invoices and renewal notices via Stripe.
• Communicate with you about your account, security events, service incidents, billing, and material changes to the service.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Comply with our legal obligations and enforce our Terms of Service.
• Send you optional product updates and announcements (only if you have opted in; you can opt out at any time).

5. Legal bases for processing

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract. To provide the service you signed up for, including authentication, subscription, and support.
• Legitimate interests. To secure the service, prevent abuse, debug operational issues, and improve features. This also covers identifying your devices and securing your sessions: we store the device name your operating system reports (see §3.2) so that your device list is recognisable and you can revoke a session that is not yours. We rely on legitimate interests here rather than consent because the device list is part of how accounts are kept secure, and because the value stays under your control: the initial value is whatever name your operating system reports for that machine, set on the device itself and not by us, and you can replace it from the Account tab. We weigh these interests against your rights and only proceed where the impact on you is proportionate.
• Legal obligation. To meet tax, accounting, and other regulatory requirements.
• Consent. Where required by law (for example, optional marketing emails, and opt-in product telemetry as described in §3.6). You can withdraw consent at any time.

6. How we share information

We share personal information only with the parties below, and only as needed to operate the service. We do not sell personal information.

• Service providers (data processors).
  • Stripe, Inc. for payment processing and subscription billing.
  • Google LLC as the identity provider for sign-in (OAuth), as the web-font provider (Google Fonts), and, when you consent on the marketing site, as the advertising-conversion measurement provider (Google Ads gtag.js) used to count waitlist sign-ups in aggregate.
  • Cloudflare, Inc. for hosting our auth and API services (Workers, KV, R2), DNS, and edge protection.
  • Email delivery providers for transactional email (account notices, billing, support replies).
  • GitHub, Inc. for hosting our private crash-report, bug-report, and product-telemetry repositories, which are accessible only to our team (only data you opt in to upload).
• Team administrators. If you join a team workspace, the team owner can see your name, email, role, and seat assignment within that workspace.
• Legal and safety. We may disclose information if required by law (subpoena, court order, valid legal process), to protect the safety of any person, or to investigate suspected violations of our Terms.
• Successors. If we are acquired, merged, or our assets transferred, your information may transfer with the business. We will notify you and give you reasonable notice before any change in controller.

7. How long we keep information

We keep personal information only as long as we need it for the purposes set out in this policy, unless a longer period is required by law (for example, tax or accounting records).

• Account profile. While your account is active, and for up to 30 days after deletion to handle reversals and complete in-flight operations.
• Subscription and billing records. Retained for the period required by applicable tax and accounting law (typically 7 years in the United States).
• Session and authentication logs. Up to 90 days, except where retained longer for an active security investigation.
• Device records. The 90-day period above covers the session and authentication log, not the device list itself. A device record, including the device name your operating system reports (see §3.2), is kept while the device is registered to your account. Revoking a single device from the Account tab ends that device's access, but the record, including the stored device name, is retained indefinitely for security and abuse investigation; we do not currently run an automatic purge over revoked device records. Deleting your account is different: it erases your device records outright, including the stored names. You can ask us to erase a revoked device record at any time by emailing [email protected], and we will do so on reasonable request.
• Support correspondence. Up to 3 years from the last interaction, then deleted or anonymised.
• Cloud Sync backups. Retained as ciphertext while you use the feature. Turning Cloud Sync off in the app stops further backups but keeps the existing copy so you can restore later; email [email protected] to have it erased.
• Crash and bug reports. Retained in the private GitHub repositories indefinitely (or until removed by us or by you on request); we will redact or remove a report on reasonable request.
• Product telemetry. Retained in the private GitHub repository indefinitely (or until removed by us or by you on request); we will remove the records associated with your installation on reasonable request. Turning telemetry off in the app stops further uploads but does not by itself erase records already sent.

8. International data transfers

We are based in the United States, and our service providers (Stripe, Google, Cloudflare, GitHub) operate globally. When you use Agent Cohort from outside the United States, your information is transferred to and processed in the United States and other countries where our providers operate.

Where required, we rely on the EU Standard Contractual Clauses, UK International Data Transfer Addendum, or equivalent safeguards to protect data transferred out of the EEA, UK, or Switzerland. Copies are available on request.

9. Your rights and choices

You have rights over your personal information. The exact rights vary by jurisdiction. To exercise any of them, email [email protected]. We will respond within the timeframe required by the applicable law (typically 30 to 45 days).

9.1 Everyone

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to fix information that is inaccurate or out of date.
• Deletion: ask us to delete your account and the personal information associated with it, or a narrower item such as a single revoked device record (see §7).
• Export: request your data in a portable, machine-readable format.
• Communication preferences: opt out of optional marketing email at any time using the unsubscribe link.

9.2 Residents of Virginia (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the right to access, correct, delete, and obtain a portable copy of personal data we hold about you, and to opt out of targeted advertising, sale of personal data, and certain profiling. We do not sell personal data and we do not engage in targeted advertising or profiling that produces legal or similarly significant effects. You may also appeal a denied request by replying to our response email.

9.3 Residents of California (CCPA/CPRA)

California residents have the right to know what categories of personal information we collect and the sources, purposes, and recipients of that information, to request access, correction, and deletion of their personal information, and to opt out of any “sale” or “sharing” (as those terms are defined under the CCPA). We do not sell or share personal information as defined by the CCPA. We will not discriminate against you for exercising any of these rights.

9.4 Residents of the EEA, United Kingdom, or Switzerland (GDPR / UK GDPR)

You have the rights of access, rectification, erasure, restriction of processing, data portability, and to object to processing. You may also lodge a complaint with your local data protection authority. You can withdraw consent at any time where we rely on consent as the legal basis.

10. Email communications and waitlist consent

We send a small number of email types. Each one has a different lawful basis and a different way for you to opt out. This section is the single place that describes them.

10.1 What we send

• Transactional and service email. Sign-in confirmations, security alerts, billing receipts, subscription state changes, plugin entitlement updates, and replies to messages you send us. These are sent on the basis of contract (we cannot run the service without them) and you cannot opt out while your account is active.
• The launch email (waitlist). One email when Agent Cohort becomes generally available. Sent only to addresses on the waitlist (see §10.2). Sent on the basis of consent, captured at the moment you joined the waitlist.
• Material policy or security updates. Advance notice of changes to this Privacy Policy or the Terms of Service that materially affect you. Sent on the basis of legal obligation + legitimate interest; you cannot opt out while your account is active.
• Optional product updates and announcements. Occasional news about new features, plugins, or behaviour changes. Sent only if you have explicitly opted in inside the account portal. Every such message carries a one-click unsubscribe link; unsubscribing turns off all marketing communications and does not affect the categories above.

10.2 The waitlist signup

The Join-waitlist form on wrenix.ai captures only your email address. Before we can persist the row our server requires an explicit consent signal:

• The submit button is disabled until you tick the “I agree to receive email communications from Agent Cohort” checkbox.
• The browser POSTs a privacy_accepted: true flag alongside the address.
• The server independently rejects any submission without that flag (HTTP 400). A hand-crafted request cannot bypass the gate.
• On a successful submission the server stamps the moment of consent and stores it alongside the row so we can answer “when did this user agree” without inference.

We use the waitlist row to send one email at launch, plus, if material, a single advance notice that we are about to send the launch email. We do not send marketing, surveys, or newsletters to waitlist-only addresses. We do not sell, share, or rent the list.

10.3 Withdrawing consent

You can withdraw consent for the launch email or any optional marketing email at any time:

• Unsubscribe link. Every marketing email (including the launch email when it eventually ships) carries a one-click unsubscribe footer that removes you from future sends.
• Email us. Send a note to [email protected] from the subscribed address and we will remove the row.
• Account portal. Once you have an account, the communication preferences screen lets you opt out of optional categories. Transactional / security email remains active while the account is active (see §10.1).

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We retain the consent timestamp on the original row as the audit signal that consent was given, even after the email itself is unsubscribed or the row is deleted on request.

10.4 Retention

Waitlist rows are retained until the launch notification batch completes, then archived to a notified-only table. You can ask us to delete the row at any time by emailing [email protected]; we will confirm deletion within 30 days. Transactional email logs follow the retention schedule in §7.

11. Cookies and similar technologies

The account portal sets a small number of cookies that are strictly necessary for the service to function, including:

• A secure, HttpOnly session cookie issued after sign-in to keep you logged in.
• A CSRF / state cookie used during the OAuth handshake.
• Lightweight preference cookies (for example, your selected environment) stored locally in your browser.

The marketing site loads two pieces of third-party content. One is fully consent-gated; the other loads on every visit but operates in a privacy-preserving default mode until you consent. On a fresh visit, before you interact with the banner, the site sets no cookies:

• Google Fonts (consent-gated). The Inter and JetBrains Mono web fonts. The stylesheet request is only issued after you click Accept; Essential only means we never call fonts.googleapis.com from your browser. When loaded, it transmits your IP address to Google.
• Google Ads conversion measurement (gtag.js, Consent Mode v2 with regional defaults). Loaded eagerly from googletagmanager.com on every page. Eager loading is required for Google's tag verifier to recognise the conversion action; refusing it would silently disable conversion reporting for our ads. While running, gtag.js may also call sibling Google hosts (google-analytics.com, googleadservices.com, google.com/pagead, the attribution host googleads.g.doubleclick.net, and the page-view measurement host pagead2.googlesyndication.com) for measurement beacons. The default consent state depends on the region Google's servers resolve your IP to:
  • EEA member states (all 27), the United Kingdom, Switzerland, Norway, Iceland, and Liechtenstein: every measurement scope (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage) starts denied, and ads_data_redaction is set to true. In that state:
    • No Google Ads cookies (e.g. _gcl_*) are written to your browser.
    • No identifiers are sent in conversion pings.
    • Ad-click parameters (gclid, dclid) are redacted from URLs.
    • Only a single redacted, cookieless beacon may be sent for modelled-attribution purposes; Google receives no personal data from it and cannot link it across sessions or properties.
  • Visitors elsewhere (including the United States, Canada, Australia, Japan, and the rest of the world): every measurement scope starts granted, so Google Ads conversion tracking runs in its standard mode from the moment the page loads. Google Ads may write _gcl_* attribution cookies and record conversion pings tied to your session. You can opt out at any time by clicking Essential only on the consent banner; your choice is remembered locally for return visits.
  We chose this split because the regulated regions above have ePrivacy / GDPR / revFADP requirements that require consent before measurement runs, while other jurisdictions either do not have such requirements or allow opt-out instead of opt-in. The script also calls gtag('set', 'url_passthrough', true) in both modes so that, if a regulated visitor later accepts, attribution from the original ad click survives the navigation.

On your first visit a small footer banner is shown to every visitor, regardless of region, so the opt-out and the opt-in paths use the same UI:

• Accept grants every consent scope (loads Google Fonts and turns on full Google Ads conversion tracking; from that point Google Ads may set the _gcl_* attribution cookies). Your preference is stored locally under agent-cohort:cookie-consent in your browser and replaces the regional default on return visits.
• Essential only sets every consent scope to denied. Google Fonts is not requested; the system font stack is used. The Google Ads script stays in its redacted, cookieless mode for the rest of the visit and on every future visit.
• You can revise your choice at any time by clearing the browser's site data for wrenix.ai; the banner will reappear on your next visit, and the consent scopes will revert to your regional default until you choose again.

We use Google Ads conversion data in aggregate only, to evaluate ad campaigns. We do not run remarketing, audience-building, behavioural-profile features, session replays, or cross-site tracking on either the marketing site or the account portal. The account portal does not load Google Ads at all. Cloudflare Turnstile is loaded only when you open the waitlist or enterprise contact form, as a proof-of-humanity check; it is a strictly-necessary anti-abuse measure and is not used for any other purpose.

12. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information, including encrypted transport (TLS) for all traffic, encryption of credentials at rest, scoped service-account credentials, automated dependency scanning, and routine review of access logs. Cloud Sync goes further: its contents are end-to-end encrypted on your device before upload, so we store ciphertext we have no key to decrypt (see §3.5). No system is perfectly secure: if you suspect your account has been compromised, contact us at [email protected] immediately. Security-research disclosures are welcomed at the same address; see our security.txt for our coordinated-disclosure policy.

13. Children

Agent Cohort is intended for use by professional and student developers and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. For material changes that reduce your rights or change the purposes for which we process your information, we will give you advance notice through the account portal or by email before the change takes effect.

15. Contact us

Questions, requests, or complaints about this Privacy Policy or our handling of your data:

• Email: [email protected]
• Security disclosures: [email protected]
• Postal: B. Dol Technical Consulting, LLC, Commonwealth of Virginia, United States. (Postal address available on request for verified inquiries.)

If you are an EEA, UK, or Swiss resident and we have not satisfactorily addressed your complaint, you have the right to contact your local supervisory authority.