--- title: "Privacy" description: "What Supcoflow collects, why, where it goes and how long it keeps it, for people and agents." canonical: "https://supcoflow.dev/privacy/" --- # Privacy > What Supcoflow collects, why, where it goes and how long we keep it. It covers this website, the Supcoflow console at app.supcoflow.dev, and the support chat that apps install with Supcoflow. Last updated: November 11, 2026. Supcoflow is run by German Flores, an individual (there is no company), in Rosario, Santa Fe, Argentina. Postal address on request: write to ger@supcoflow.dev. **Supcoflow is in beta.** It's run by one person and it changes often. This page describes what it does today. When that changes, this page changes first. ## The short version - This website uses no analytics and no tracking cookies. - If you have an account, we keep what we need to sign you in and run your projects: your GitHub user or your email, your team, and a record of each run. - If you use a support chat inside someone else’s app, that app’s team decides what is collected, and they can turn most of it off. What you type is always kept. - New screenshots are stored privately and deleted after 90 days. A small number of earlier screenshots, all from Supcoflow’s own test project, are still in an older public store and will be removed. - Our main servers are in the United States and Canada. Some services we use may process data in other countries. - We don't sell your data and we don't use it for advertising. ## Who is responsible for your data - **This website and Supcoflow accounts:** German Flores, who runs Supcoflow, decides how this data is used and is responsible for it. - **A support chat inside someone else's app:** that app's team is responsible for your data. Supcoflow handles it on their behalf, following their settings, and doesn't use it for anything else. ## This website supcoflow.dev uses no analytics and no tracking cookies, and loads no third-party scripts. The fonts are served from our own domain. The forms on the page don't send anything to a server: they open your own email app with the message filled in, and you decide whether to send it. Vercel, which hosts the site, keeps technical access logs, such as your IP address and the pages requested, to operate the service. ## If you have a Supcoflow account - **Sign-in.** With GitHub or with an email address and a password, handled by Supabase. If you use GitHub, Supabase receives your public GitHub profile: username, name, profile picture link and email. Supcoflow's own tables keep only your GitHub numeric id and username, or your email. Your password is never stored in Supcoflow's own tables. - **Staying signed in.** Supabase session cookies keep you signed in with an access token that lasts an hour and renews itself, so your session stays open until you sign out. - **Your team.** Which teams you belong to, your role, and who invited you. If you asked for access with email, we keep the request and when you made it. - **Terminal sign-ins.** When you connect the Supcoflow terminal, we record the IP address, browser and machine name, so you can see where your account was used. That history is kept for 365 days. - **Keys.** Supcoflow API keys are stored only as a one-way hash. Your AI key (your Vercel AI Gateway key) is stored encrypted with AES-256-GCM; we show only its last four characters, and the encrypted copy is erased when you replace or remove it. - **Emails.** We send account emails through Resend: your account is ready, a new terminal sign-in, setup reminders (with a link to unsubscribe), and alerts about your AI account. - **Other cookies in the console.** Two short-lived cookies (15 minutes) while you install the GitHub App, and one that remembers light or dark theme for a year. ## Your code Supcoflow reads your repository through a GitHub App that you install. For reports it asks GitHub for two permissions only: read code and write issues. The agent works on a copy of your code inside a short-lived virtual machine that keeps no snapshot and is stopped when the run ends. From inside, it can reach only GitHub, the npm registry and the Vercel AI Gateway. The agent sends the parts of your code it reads to the AI model your project chose in its Agents tab, through your own Vercel AI Gateway key, under your Vercel account and its terms. That list includes models from providers other than Anthropic. The Gateway setting that asks providers not to keep your data is off by default, so whether a provider keeps it depends on the model and that setting. What we keep from your repository: the product guide you publish (`.supcoflow/guide.md`), the guide drafts our agent writes, a context file if you choose to sync one (`CLAUDE.md` or `soul.md`), and the record of each run: its plan, the list of files it touched, short excerpts of what the agent did (with secrets-like patterns removed), the model, tokens and cost. ## If you use a support chat built with Supcoflow Many apps install the Supcoflow chat to take support questions and problem reports. In that case the app's team chose Supcoflow and decides, in their settings, which of the following we keep and pass to the investigating agent. Those settings don't apply to what you type. | What | When | |---|---| | Your messages, and the chat’s replies | Always. Deleted from our database 30 days after the conversation’s last activity. The chat software also keeps its own copy of each session with our hosting provider, Vercel. That copy can be read for 7 days after the session ends and is deleted no later than 96 days after it ends; this period is set by Vercel and is different from the 30 days that apply to our database. | | The page you’re on (without the part after `?` or `#`) and your browser | Unless the app turned it off. | | An id, role or other details about your account in that app | Only what the app chooses to pass. If the app gives the chat your name, it's used only to greet you and never leaves your browser. | | A screenshot | Only if you take one. Hidden image metadata is stripped. New screenshots are stored privately and deleted after 90 days (see the short version above for earlier ones). | | An element you point at on the page | Only if you point at one: its text, its place in the page and its HTML. Deleted after 90 days. | | Your email address | Only if the app asks for it so you can hear back. We send one confirmation email, through Resend, and delete the address after 30 days. | Please don’t type or capture sensitive information in the chat, such as health details, passwords or card numbers. A screenshot shows whatever is on your screen, including other people’s information, so check it before you send it. The chat sets no cookies. It keeps a session marker in your browser's session storage, which is cleared when you close the tab. Its replies are written by Anthropic's Claude, through the Vercel AI Gateway. If you report a problem, the report is kept so the app's team can see it, and it may become an issue in their GitHub repository: your description, the page and the element you pointed at, and the number of screenshots, but never the images themselves or your account details. That issue lives in their repository, under their control. For questions about your data in that app, contact that app's team first. If you write to us, we'll pass your request to that team and help them answer within the legal deadlines. ## Why we use your data - **To run the service you signed up for:** your account, your projects, the runs and the account emails. Without that data the service can't work. - **To keep accounts safe:** the terminal sign-in history, so you and we can spot access you don’t recognize. - **Setup reminders:** to help you finish setting up. You can unsubscribe from them at any time. - **For the support chat:** on behalf of the app’s team, for the support and problem reports they set up, and for nothing else. - **When the law requires it.** ## Who else handles it - **Vercel:** hosting, the virtual machines that read your code, file storage, scheduled jobs and the AI Gateway. - **Supabase:** sign-in and our database. - **GitHub:** your repository and the issues we open in it. - **AI providers, through the Vercel AI Gateway:** Anthropic for the chat, and the provider of the model each project chooses for the investigating agent. - **Resend:** the emails we send. We don't use analytics or error-tracking services. We only give data to anyone else when the law requires it, for example a court order. If Supcoflow is ever transferred to someone else, this page still applies to the data we already hold, and we'll tell account holders by email first. ## Where it's processed Our main servers are in the United States and Canada: the console, the chat and this website's servers run in Vercel's Washington, D.C. region, in the United States, and our database (Supabase) is in Canada. The website's pages are served from Vercel's global network. GitHub, Resend and the AI providers process data where they operate, which can include other countries. ## How long we keep it | | | |---|---| | Chat messages | 30 days after the last activity in our database. The chat software’s own copy, with Vercel, can be read for 7 days after the session ends and is deleted no later than 96 days after it ends. | | Email addresses given in the chat | 30 days | | Screenshots and pointed elements | 90 days (earlier screenshots: see the short version above) | | Terminal sign-in history | 365 days | | Your account, reports and run records | While your account exists, or until you ask us to delete them | ## How we protect it Connections use HTTPS. Keys are stored hashed or encrypted, and new screenshots are kept in private storage. No system is perfectly secure. If a security problem exposes your data, we'll tell you by email as soon as we know what happened. ## Your rights Email ger@supcoflow.dev to ask what we hold about you, to correct it, or to delete it. There is no delete button in the console yet, so we handle these requests by hand. We reply within 10 calendar days to requests to see your data, and within 5 business days to requests to correct or delete it. If a request needs more checking, we'll tell you within those times. Seeing your data is free. If you're the owner of a project, you can change at any time what the chat keeps about your users; that applies from then on and doesn't erase what was already stored. Supcoflow is run from Argentina, so Argentina's Personal Data Protection Law (Law 25.326) applies. You have the right to access, correct, update and delete your personal data. If you believe we haven't handled your data properly, you can complain to the Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP), the authority that enforces that law. In Spanish, as Argentine rules require: > El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley N° 25.326. La Agencia de Acceso a la Información Pública, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales. If you are in the European Union or the United Kingdom, you can also ask for a copy of your data in a portable format, object to or ask us to limit how we use it, and complain to the data protection authority where you live. Because we don't track you across sites, browser signals such as Do Not Track or Global Privacy Control don't change anything here: there is no tracking to turn off. ## Children Supcoflow accounts are for people 18 or older. We don't knowingly collect data from children under 13. If you think a child gave us personal data, write to us and we'll delete it. ## Changes If this page changes, the date at the top changes with it. If a change is significant, we'll tell account holders by email before it applies. If Supcoflow shuts down, we'll tell account holders by email at least 30 days before, and then delete the data we hold. ## Contact [ger@supcoflow.dev](mailto:ger@supcoflow.dev) · German Flores · Rosario, Santa Fe, Argentina · Postal address on request.