What this site knows about you.

Guaca runs on your machine and needs no account. An install that never signs in never contacts guaca.bot at all. One that does talks to it for a single thing: asking for an access token for a service you authorized here.

Nothing you or your agents type is ever sent here, and the model you point the app at is your arrangement with whoever runs that model. Everything below is about this website and the account you can choose to make on it.

The marketing page is a file. It ships no JavaScript, sets no cookie, embeds nothing from another origin, and carries no analytics of any kind. Asking for it tells Cloudflare, who serve this domain, what any web request tells a server: your IP address, the path you asked for, and your browser's user-agent string. Nothing is added to that here, and nothing is kept from it here.

An account exists only if you asked this site for a sign-in code. It is a row and the grants hanging off it:

• Your email address. That is the identity: there is no username, no display name, no profile and no password anywhere in this design.
• Sign-in codes, stored hashed. A code is six digits, expires in ten minutes and works once, and the stored form cannot be turned back into a working code.
• A session while you are signed in: a random token, the IP address the sign-in came from, your browser's user-agent string, and an expiry seven days out.
• One row for each provider you authorize: the account id that provider knows you by, the scopes it granted, and the access and refresh tokens, encrypted at rest.
• An authorization code while a machine is signing in, which expires in ten minutes and works once.
• For each machine you sign in: an access token good for an hour, a refresh token good for thirty days, both stored hashed, and a record of which capabilities you agreed to give it.

There is nothing else. No payment details, because there is nothing to pay. No history of what your agents did, because this origin never sees it.

Authorizing Gmail, or a GitHub repository, stores a grant for it. The refresh token never leaves this origin. A machine you signed in asks for an access token, gets a short-lived one, and calls the provider directly with it. That is the whole reason this origin exists: an app you downloaded cannot hold an OAuth client, and a registered origin can.

Your mail, your calendar, your files and your repositories do not pass through here. This site brokers the credential; your agents use it on your machine. What they read and what they send is between them, you, and the provider.

Guaca's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely: data from a Google API is never sold, never used for advertising, never used to train a model, and never read by a human here. It does not reach this site at all, because the machine you signed in calls Google directly.

What that machine then does with it is yours to decide, and it will include sending the part your agents are working on to the model provider you chose. Pick that provider knowing it, or run a model locally, which Guaca also supports.

Two, both necessary, neither able to follow you anywhere:

• a session cookie, set when a code is accepted and cleared when you sign out;
• a signed cookie holding the address you asked for a code with, scoped to the sign-in pages and expiring with the code, so the second step knows where the code went without putting your address in a URL.

No analytics cookie, no advertising cookie, nothing set by another origin. That is why this site has no banner asking you to accept anything.

• Cloudflare, who host all of it: the page, the Worker, the database the account lives in, and the mail that carries your sign-in code. Your address passes through them to reach you.
• Google and GitHub, for the connectors you authorize and only after their own consent screen. Their terms and their privacy policies govern what happens on their side.

Nobody else. No analytics service, no advertising network, no data broker, no mailing list. Nothing is sold or shared, and there is no revenue here that could ever depend on changing that.

The Worker records what it did: the path, the outcome, and the error when something fails. Cloudflare keeps that for at most seven days and then it is gone. It is read to find out why something broke, and for nothing else.

• Sign-in codes: ten minutes, or until one is used.
• Authorization codes: ten minutes, or until one is exchanged.
• A signed-in machine: an hour for its access token, thirty days for its refresh token, or until you sign that machine out.
• Sessions: seven days, or until you sign out, whichever is first.
• Provider grants: until you disconnect the provider, or the account is deleted.
• The account: until you ask for it to be deleted.
• Worker logs: at most seven days, at Cloudflare.

Disconnecting a provider on the connectors page hands the token back to that provider and clears it here. If the provider refuses the revocation, nothing is cleared here either and the page says so, rather than claiming a grant is gone while it is still live.

Signing out ends the session immediately.

There is no delete-account button yet. Write to robert@madebywelch.com from the address on the account and it will be deleted, with every grant hanging off it, and you will get a reply saying it is done.

If you are in the UK or the EU, the GDPR gives you the right to a copy of what is held about you, to have it corrected, to have it deleted, and to complain to your data protection authority. Similar rights apply in other places. All of them are honoured here wherever you are, because the entire holding is one row and its grants. Ask at robert@madebywelch.com. There is no charge and no form to fill in.

What is held for an account is held to provide that account, which is the only thing it is for. Logs are kept to keep the service working. Nothing here profiles anyone, scores anyone, or makes an automated decision about anyone.

Cloudflare's network is global and the database is a Cloudflare D1 instance, so a request may be served, and your account may be stored, outside the country you are in. If that is not acceptable to you, do not make an account: the app itself never touches this origin.

Provider tokens are encrypted at rest and sign-in codes are stored hashed, so a leaked copy of the database is not a working sign-in and not a working Gmail token. There is no password to steal. Neither half of this site runs any JavaScript in your browser, which removes most of the ways a page can be talked into giving a credential away.

It is a small service run by one person. It is built carefully and it is not audited. If something goes wrong that affects your data, it will be said here and sent to the address on your account.

The date at the top changes when this text does. If a change alters what is held about you, or who else can see it, it is sent to the address on your account as well as posted here. There are few enough accounts for that to be a promise rather than an intention.

robert@madebywelch.com. Questions about this policy, requests for a copy of what is held, deletions and security reports all go there.