Privacy

Plain-English summary of how Agentics handles your data.

What we collect

Account info: name, email, organization
Receipts: agent metadata, prompts and outputs you choose to send (redaction is on by default)
Usage telemetry: page views, feature usage, API performance
Billing info: handled by Stripe; we don't store card data

What we don't do

We don't sell personal data, ever
We don't train foundation models on your prompts
We don't share customer prompts with third parties for advertising
We don't keep deleted data past 30 days outside disaster-recovery backups

Your rights

Wherever you live, you have the right to request a copy of your data and to ask us to delete it. Use the DSAR endpoint at /api/rtbf or email privacy@agentics.you. We respond within 30 days.

Browser extension addendum

The Agentics browser extension (/extension/) captures conversation turns from LLM-chat surfaces (claude.ai and chatgpt.com today; gemini.google.com and others as opt-in). This addendum is what the Chrome Web Store / Microsoft Edge Add-ons / Firefox AMO reviewers point at.

What the extension collects

Account info you provide: handle, email, account type, display name.
Captured conversation turns, after client-side Tier-1 PII redaction (emails, phones, SSNs, cards, IPs, IBANs, API keys, bearer tokens, optional strict-mode long tokens). Originals stay encrypted in chrome.storage.local for 30 days then expire.
Conversation metadata: platform, conversation UUID from the URL path, turn UUID, model name, timestamps, token counts.
Device key: Ed25519 public key (ECDSA P-256 fallback) of the device-bound signing key. Private key never leaves the device; encrypted at rest under a passphrase-derived key.
Telemetry: install / error / capture-count events. PII-scrubbed payloads only.

What the extension does not collect

Cookies, passwords, session tokens, or any other auth state from claude.ai / chatgpt.com / etc. We never read the LLM-site's storage.
Voice-mode audio. Only the transcript text is captured, and only when explicitly opted in.
GPS coordinates, IP-based location, or any other location data.
Anything outside of the host permissions listed in manifest.json.

How data flows

The content script captures a turn after both halves of a (user → assistant) exchange land in the DOM.
The redactor replaces matched PII with placeholder tokens client-side.
The service worker canonicalizes the receipt body (RFC 8785 / JCS) and signs it with the device's Ed25519 key.
The signed body is POSTed over HTTPS to https://agentics.you/v1/receipts/extension with the user's session JWT.
The backend writes the row to ledger_events with capture_source='extension'. The existing five-minute Merkle anchor job posts the batch root to Solana mainnet via the public anchor wallet CR6sxx8d9jR4AF4hvyQy3bbcAghGyS7gd4sGQvDmMqq4.
The receipt becomes verifiable at https://agentics.you/ledger/tx/<receipt_id> permanently.

Permissions justifications (the Chrome Web Store-required list)

Permission	Why we need it
`storage`	Persist the signed-in user, the device key, the in-flight receipt queue, and user preferences locally. Nothing is read or written outside our own keys.
`alarms`	Schedule a 60-second background sync that drains queued receipts to the ledger plus a 5-minute Trust-Inbox poll.
`identity`	Used only when you choose Google or X sign-in inside the extension via `chrome.identity.launchWebAuthFlow`. We never touch your LLM-site credentials.
`sidePanel`	Render the live-transcript side panel beside the LLM chat.
`scripting`	Inject the receipt-capture script into the LLM-site tabs declared in `host_permissions`, plus register optional content scripts at runtime once you grant the matching permission.
`notifications`	Surface severity=high Trust-Inbox alerts (incidents, drift, tier downgrades) as system notifications when the extension is closed. Optional in Settings → Notifications.
`host_permissions` — claude.ai, chatgpt.com, agentics.you	Minimum set required for the capture script to attach to supported chat surfaces and for the extension to talk to its own backend.
`optional_host_permissions` — gemini, grok, perplexity, copilot	Granted only on explicit user opt-in from Settings → Linked sites.

Storage, retention, deletion

Captured conversation original text: kept locally inside the extension for 30 days, then expired automatically. Never transmitted to our servers in original form.
Anchored hash + receipt metadata: kept in our database for the life of the account; on-chain hashes remain immutable (immutability is the product).
Telemetry: 13 months.
Account deletion: tombstones the row immediately, purges the local DB copy after 30 days, on-chain hashes resolve to "deleted by user" in our UI.
Export: Settings → Privacy → "Export all my data" returns a JSONL bundle of everything we hold.

Sub-processors used by the extension data path

Neon.tech — Postgres, encrypted at rest, EU + US regions. EU users automatically route to the EU region.
Solana mainnet — Public verifiable ledger (anchor hashes only, never receipt content).
Circle Mint — Programmable Wallets / USDC settlement. Only invoked when an operator opts into paid contracts.
Resend — Email verification + digest emails.

Full sub-processor list at /security/subprocessors.html. The extension does not send anything to advertising networks, model training pipelines, or any party not on that list.