AgentOpt Privacy Notice
Last updated: [07/24/2026]
AgentOpt is a research prototype for pre-deployment analysis of AI agents. It is free, in active development, and offered to a limited group of testers — not a commercial product. This page explains what we collect and why.
What we collect
Account information. When you sign in with Google, we receive and store your name and email address. We use this to run your account (so you can generate API keys, revoke them, and see your own usage) and to attribute feedback. This is required to use AgentOpt — there is no anonymous account.
Usage logs. We record which endpoints you call, when, and how long they took, tied to your account. This is operational (debugging, abuse prevention, capacity planning) — not shared outside the project.
What you upload or submit. Agent graphs, PDFs, traces, and free-text feedback you submit through the app or API. See "Where your content goes" below.
Claude Code session recordings, only if you send one. The recorder that captures
a Claude Code session runs entirely on your machine and uploads nothing by itself.
A recording reaches us only when you choose to send it — by using the app's "Claude
Code session" tab or the CI Action. Recordings are scrubbed on your machine before
they are written to disk: prompt text, code, and file paths are replaced with
[scrubbed], leaving event names, session ids, model and tool names, token counts,
costs, and timings. If you deliberately record with --no-scrub, that file keeps
your prompt content — don't send us one.
Downloading the recorder from /download/recorder.py requires no account and tells
us nothing about your session; it is an ordinary file download. The recorder is a
single readable file so you can check those scrubbing rules yourself before running
it, rather than taking this notice's word for it.
Research data — separately, and only with your consent. With a setting you control (on by default, off anytime), we may use de-identified artifacts — agent graphs, calibration records, model weights fitted from feedback — for research and to improve the tool, including in an academic paper. These records are stored and analyzed under an internal ID only. We do not attach your name or email to any research artifact or export. Turning this off does not affect your ability to use AgentOpt; it only stops these specific records from being retained for research.
Where your content goes
- Uploaded files (agent graphs, PDFs) are processed on our server and held only in temporary storage — never on the persistent disk that survives a deploy — for a bounded window (currently 6 hours) so a file you upload once can still be reused across a few follow-up calls before it's automatically deleted. Nothing about the raw file itself is retained past that window, deploy or no deploy.
- Trace exports (LangSmith, Langfuse, or similar third-party run exports) are held to a stricter rule that governs this feature whether or not it's live yet at the time you're reading this: a raw trace/span payload is never written to our persistent storage in any form. When you upload a trace bundle, we compute aggregate statistics from it (counts, means, token totals — never prompt text, tool arguments, or retrieved content) and discard the original payload; only that aggregate is ever retained (plus the research data below, if you've left that setting on, and always keyed to an opaque internal id, never your content). Unlike our own Claude Code recorder, a third-party trace export isn't scrubbed before it reaches us — this rule is what keeps that content from being retained regardless.
- If you use the audit feature with an LLM provider (OpenAI, Groq, your own Ollama instance, etc.), your content is sent to that provider using your own API key. We don't see or store that traffic beyond what you configure. You are subject to that provider's own privacy policy for that request.
- We do not sell your data. We do not share it with third parties other than the LLM provider you choose to use, and infrastructure providers (currently Render.com for hosting).
Your choices
- Delete your account: email [vatsal.maru.25@gmail.com] and we'll remove your account and associated operational data.
- Opt out of research use: toggle it off in the app's settings at any time.
- Revoke an API key: from the Keys panel in the app, instantly.
Changes
This is a test product under active development; this notice may change as the product does. Material changes will be reflected here with an updated date.
Contact
Questions about this notice: [vatsal.maru.25@gmail.com]