Privacy Policy

The only personal information we collect and store is what you give us when you sign up: a username, an email address, a password and, if you give one, a display name. The password is held by the account directory as a hash; we never see or store it in plain text. Your account also records which version of the Terms of Service you agreed to when you signed up, and when. Nothing else you do on the site adds personal information to your account — no profiling, no enrichment, no purchase of data about you.

If you sign up or sign in with another account (Google, GitHub, Microsoft, Facebook, Discord, Slack or GitLab), that provider tells us your account's identifier there, your name, your email address and, for Google, GitHub, Discord, Slack and GitLab, whether it has confirmed that address. We keep the identifier, so we recognise you next time, and your name and email address, as we would from the sign-up form; you still choose your username. We do not keep your profile picture, your contacts or anything else from the provider, and we do not keep the provider's access tokens. An account created this way has no password until you add one in Settings.

Like any web service, our servers keep short-lived operational logs (including IP addresses) for security, abuse prevention, and rate limiting. They are used for nothing else and age out on a fixed schedule. Each version you publish also records a keyed hash of the address it was submitted from — the key rotates monthly and the address cannot be recovered from the value — so the scanner can notice many accounts publishing from one place, which is how supply-chain floods are staged.

To operate your account: signing you in, confirming your email address, resetting your password, and sending the messages the service requires — email confirmation, password reset, and security or review notices about content you published. We do not send marketing email.

QuickAgents you publish publicly — their content, security reports, version history, and your username as the publisher — are public. That is the product. Publishing is always an explicit act; nothing becomes public as a side effect.

We use only strictly necessary cookies: your session, a CSRF token, the short-lived state of a sign-in in progress, the one that remembers you dismissed the cookie notice, and one that remembers, until you next sign in, that you dismissed the reminder to set up two-factor authentication. There are no advertising, analytics, or cross-site tracking cookies of any kind.

We run the Service on rented cloud infrastructure, and a few other companies do part of the work for us. Each processes personal data only to do that work, under a contract with us; the full list, with what each receives and where, is under Subprocessors below. In short: our hosting provider holds everything the Service stores; our network provider carries every request to the site; our email provider delivers the messages above; our payment provider (Stripe) processes your email address, your name if you give it, and your payment details if you buy a Pro subscription or credits, or your organization holds a Business or Enterprise one, and the payment page is theirs, so your card details never reach our infrastructure; and AI Review, the Drafter and hosted runs send the content they read (a QuickAgent you submit, a description you give the Drafter, a document in a knowledge pack you build, a task and the files you give a hosted run) to the AI model providers that run them, so any personal data you put in that content reaches them too.

If you sign in with another account, that provider sees that you signed in to us, as it does for any service you use it with; it is not our subprocessor, and its own privacy policy applies. The same is true of the services a QuickAgent reaches because you told it to: an MCP server, an account you connect, a website it fetches, or a model provider whose key you give it. We do not sell or share personal data with anyone else, and we disclose it only if the law compels us to.

The companies that process personal data for the Service. We add a new one to this list at least 30 days before it starts, and say when that is. If you use Agentry for an organization, or put other people's personal data into it, our Data Processing Agreement covers how we process that data for you, and this list is its Annex III.

You can access and correct your account details in Settings, and delete your account at any time. Deletion removes your personal information from the registry and deletes your sign-in account in our directory service in the same step; if you published public QuickAgents, you choose whether they are withdrawn or transferred, and the published records are pseudonymized rather than erased — installed copies depend on their integrity. Depending on where you live you may have additional rights (access, portability, erasure, complaint to a supervisory authority); write to us and we will honour them.

To delete your account and the personal information we hold about you, sign in and go to Settings, then Profile, and choose Delete account at the bottom of the page. This removes your account from the registry and then deletes your sign-in account in our directory service, with any link to Google, GitHub, Microsoft, Facebook, Discord, Slack or GitLab; if the directory does not answer, we keep trying until it does, and if it never does, we delete it by hand. It does not delete your account at that provider. If you cannot sign in, write to hello@secureagentry.net from the email address on the account and we will delete it for you.

Account information lives as long as your account. Operational logs and audit records are kept for a bounded period for security, then purged. Published public content persists, pseudonymized, for the reasons above.

If this policy changes in a way that matters, we will say so on the site before it takes effect. The date at the top is the honest record.