Privacy policy

Last updated 2026-09-02. This is the policy for the Agent Sean software and, when it exists, the hosted control plane at agentsean.com.

Self-host

The daemon runs on a machine you control and binds 127.0.0.1. Page content, GSC queries, CMS credentials, and Google refresh tokens stay on that machine (OS keychain or encrypted file). We cannot see them.

Telemetry

Off until you consent. Never domains, URLs, queries, keys, or IPs. Honor DO_NOT_TRACK=1. Details: telemetry and the repo file TELEMETRY.md.

Google OAuth

If you use the first-party broker, Google shows you the consent screen. The broker is stateless: it encrypts the refresh token with a wrap key your daemon generated and redirects to loopback. The hosted origin never fetches your daemon. BYO Cloud project skips the broker entirely.

Hosted Cloud

If you pay for Cloud, we store account email, Stripe customer id, entitlement, envelope-encrypted secrets, and metered usage. We do not store CMS write credentials. DPA and subprocessors are in the repo (docs/dpa.md, docs/subprocessors.md). Erasure: eraseTenant.

Contact

Agent Sean is maintained by Seziro. Privacy questions: privacy@agentsean.com, or open an issue at github.com/seziro-team/agentsean.