Privacy policy

almost.sh is operated by befyr, established in Sweden. For anything you send to the hosted service, befyr is the data controller. Reach us at [email protected].

The CLI decides what may leave your machine before anything is sent, and the rule holds however it is configured: content is stripped, the transcript is never read, and the reason a run stopped is turned into a category locally.

You do not have to take this on faith. almost preview prints the exact request body and sends nothing, so you can compare this table against what your own machine would transmit.

Setting ALMOST_PRIVACY=full opts into sending the task name and the agent's own message. It is off unless you turn it on, and even then the transcript path, working directory and tool input are still dropped.

Connecting a project to a team is the point at which anything is stored at all. From then on we hold:

• Your account. The email address you sign in with, and which team it belongs to.
• Teams and projects. The names you choose, the repository name if the CLI found one, and the ingest keys.
• The board. One card per run: its title, its state, which agent and which person, the hashed session reference, and the category of why it is waiting.
• Events. The same fields, kept as a history so a card can show how it got where it is.
• Channels. The webhook URLs, bot tokens and chat identifiers you add, because we need them to deliver. They are credentials and we treat them as such.

Our hosting provider records ordinary connection metadata such as IP address and user agent in server logs. We use it to keep the service up and to deal with abuse, and it is not joined to your board.

There is exactly one: almost_session. It holds a random token, is HttpOnly and SameSite=Lax, is sent only over HTTPS in production, and expires after 30 days. It exists to keep you signed in and does nothing else.

There are no analytics cookies, no third-party scripts, no advertising or profiling, and no cross-site tracking of any kind. The sign-in link itself is stored only as a SHA-256 hash, works once, and expires after 15 minutes.

Under the GDPR we rely on:

• Contract. Running the account, the board and the delivery you asked for.
• Legitimate interests. Keeping the service available and dealing with abuse and security incidents.
• Legal obligation. Keeping billing records where you have paid for a plan.

We do not process any of it for marketing, and we do not build profiles or make automated decisions with legal effect.

Three providers run underneath us. Each is bound by a data processing agreement and none may use your data for its own purposes:

• RailwayRuns the application and the Postgres database it stores everything in.United States
• ResendDelivers sign-in links. It sees the address the link is sent to.United States
• CloudflareAuthoritative DNS for the domain.United States

Then there are the channels you add yourself. When you connect Slack, Discord, Telegram or your own endpoint, you are telling us to send your events there, and from that moment they are covered by that provider's privacy policy rather than this one.

The providers above are established in the United States. Where your data is processed outside the EEA, the transfer runs on the European Commission's Standard Contractual Clauses, which form part of each provider's data processing terms, together with the technical measures in clause 09.

Sign-in links expire in 15 minutes and are single use. Sessions expire after 30 days. Events and cards live as long as the project they belong to.

Delete a project and its cards and events go with it. Delete your team and everything above goes, including the account itself, other than records we are required to keep for accounting. Deleted rows can persist for a short while in our host's database backups before those roll over.

Everything moves over HTTPS, with HSTS set so a browser never tries plain HTTP twice. Session tokens and sign-in links are stored as SHA-256 hashes, so a stolen database row cannot be replayed as a login. Ingest keys are scoped to a single project and can be rotated without touching anything else.

No system is perfect. If we discover a breach that puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

You can ask for a copy of what we hold, have it corrected, have it deleted, take it elsewhere in a portable format, or object to processing based on legitimate interests. One email to [email protected] is enough, and we answer within 30 days.

If we get it wrong you can complain to your local data protection authority. Ours is Integritetsskyddsmyndigheten (IMY).

The service is for developers at work and is not directed at children under 16. We do not knowingly hold their data, and will delete it if we find it.

When this policy changes, the date at the top changes with it, and we email account holders before anything material takes effect. What we do with your data is also set out in the terms of service, and the technical detail behind it is in the docs.

Questions go to [email protected].