Privacy Policy

This policy describes what Bandicot actually collects. It is not a claim of GDPR certification, SOC 2, or a DPA we have not signed with you. Native Bandicot is local-first. This website is a separate account and billing surface.

1. Two surfaces

Native app (desktop, terminal, local RPC)

The native host owns sessions, transcripts, tools, artifacts, checkpoints, and memory on your machine. Credentials default to owner-only files (mode 0600); macOS Keychain is an explicit option. The host talks to model providers you configure. We do not receive those session files unless you copy them somewhere else.

Untrusted project config (skills, hooks, prompt packs) is not loaded until you trust the project. That is a security boundary, not telemetry.

This website (https://bandicot.app)

If you create an account, we store records in a hosted LibSQL/Turso database used by this Next.js app: profile fields, password hash, OAuth account links, plan, Stripe customer id, subscription status, device-link codes, and password-reset tokens.

2. Data we collect on the website

• Account. Email, optional name, bcrypt password hash (credentials sign-in), email-verification timestamp.
• OAuth. If GitHub or Google sign-in is configured, the provider’s account id and tokens as stored by Auth.js (access/refresh tokens, expiry, scope). We do not request more scopes than the provider integration needs to sign you in.
• Billing. Plan id, Stripe customer and subscription ids, period end, status. Card numbers go to Stripe, not our database.
• Device linking. Short-lived device codes so the native app can bind to the website account after you approve in the browser. Codes expire; they are not session transcripts.
• Email. Verification and password-reset messages via Resend when RESEND_API_KEY is set. If mail is not configured, the app may show you the action link directly so the flow still works; that link is a secret, treat it like a password.

We do not run advertising pixels, analytics SDKs, or product telemetry beacons on this marketing site in the current codebase. Server logs from the host (Vercel or similar) may still include IP, user-agent, and URL as part of ordinary HTTP hosting. We do not sell that.

3. What we do not collect

• Native session JSONL, prompts, or memory stores as a cloud backup (unless you build that yourself).
• Payment card PAN/CVC (Stripe).
• SOC 2 audit evidence we do not have.

4. Model providers

When you run a turn against a cloud or local model, that provider processes the prompt and tools you allowed. Bandicot’s privacy routing (trust → privacy → budget, fail-closed) lives in the host. This website does not sit in that path.

5. Cookies and local storage

See Cookies. Auth.js uses cookies for the website session (JWT strategy). The docs theme preference and a legacy bandicot:session key may live in localStorage. These are functional, not advertising.

6. Sharing

We share website account data only with:

• Stripe, to charge a plan you requested
• Resend, to deliver verify/reset mail when configured
• GitHub or Google, if you choose those sign-in buttons
• The database and app host (Turso, Vercel or equivalents) as processors
• Authorities when required by law

We do not sell personal information.

7. Retention

Account rows remain until you ask us to delete them or we close the account. Password-reset tokens last one hour and are deleted on use. Device codes expire as implemented in the native linking flow. Stripe retains payment records under Stripe’s policy.

8. Your requests

Email hi@apparatdynamics.com to access, correct, or delete website account data. We will need enough information to locate the account (usually the email). Native local files are yours to delete on disk; we cannot reach them.

If you are in a region with statutory privacy rights, we will honor requests the law actually grants. We are not claiming a completed GDPR Article 27 representative or a UK ICO registration on this page.

9. Children

The website account is not directed at children under 16. Do not create an account for a child if you cannot consent where you live.

10. Security

Passwords are hashed with bcrypt. RPC to the native host uses an owner-only Unix socket. Website transport is HTTPS on the deployed origin. No method is perfect; report issues to hi@apparatdynamics.com. Do not send exploits or stolen secrets in that inbox.

11. International

Processors may store data in the US or EU depending on Turso/Vercel/Stripe/Resend regions. We have not published a specific subprocessors list with DPA links; ask if you need one before sending regulated data through the website account.

12. Changes

The date at the top is the current version. Material changes will be reflected here.