Privacy Policy

Who we are

AlchemyLab is operated by [legal entity], [registered address]. For anything in this policy, write to [privacy contact address].

Where your work actually lives

The work runs on your computer. Your repository, your files and the agents' edits stay on the computer that runs your projects, and they are not stored on our servers. The words of the work stay on that computer too: the text of your requests and their acceptance criteria, the messages you exchange with agents, the decisions you make, the documents you create in the app and their names, the results of the work, and the commands agents write.

Our servers store the structure of the work: the identifiers, states, times, counts and costs the system records itself. They store the settings you chose: the commands you save, with their names and command lines, and the configuration of your checks, environments and workflows, including any text in it. They store the names of your projects, computers and areas (a computer's own hostname and the name you give it; an area is a label requests are sorted by, such as checkout), and file paths inside your projects where a record needs them, such as the files a request changed. Our servers also store what you keep across projects: your agents, recipes and hooks, and guidance about how you work.

To do its work, for example to put together what an agent is told or to show a page when you open the app on another device, the service reads words from your computer, processes them in memory and does not store them. Seeing those words from another device therefore depends on that computer being on and connected.

The model provider you choose

Agents run against the model provider you connect, such as Anthropic, OpenAI or GitHub Copilot. To do the work, the prompt and the file content an agent reads or writes are sent from your computer to that provider under your own account and that provider's terms. We do not sit in the middle of those calls, and we do not keep a copy of them.

Your account

To sign in we store your email address, a hash of your password if you set one, and your Google account identifier if you sign in with Google. We send you email for two reasons only: to verify your address, and to reset your password.

Cookies and local storage

A session token keeps you signed in. The app keeps small preferences in your browser's own storage, such as the theme and which panels you left open. There is no advertising, no third-party tracker and no analytics on this site.

Server logs

Our servers keep operational logs of requests they receive, which include an IP address and a timestamp, so that faults can be diagnosed and abuse stopped.

Sharing

We do not sell your data and we do not share it for advertising. It reaches other companies only where they run part of the service for us: our hosting provider, and the email provider that sends the two messages above. Your model provider receives what is described in the section about model calls.

Keeping and deleting

What our servers store about your projects is kept for as long as your account exists, or until you delete the project. Deleting a project removes what our servers store for it; the words kept on your computer are removed by that computer the next time it connects. Backups of our servers hold only what the servers store, and are kept for 14 days.

Ask at [privacy contact address] and we will delete your account and what we store for it. You can also ask for a copy of what we hold, or for a correction. A copy from us contains what our servers store; the words of your work are on your computer.

Changes

If this policy changes we will post the new version here and change the date at the top.