Privacy Policy

FlockTab is operated by Hanamori Labs LLC, a Delaware limited liability company ("Hanamori Labs", "we", "us"). This policy covers flocktab.com, the console at console.flocktab.com, the hosted proxy at proxy.flocktab.com, the tab command-line tool and the self-hosted proxy (together, the "Service").

For your account, billing and the website, we decide how personal data is used: we are the controller. For the data your agents send through the Service on your behalf, we act on your instructions: you are the controller and we are your processor (a "service provider" under California law).

• We record decisions, not conversations: which Agent made a call, the model, token counts, cost, what was allowed or refused and why. We never store the text of prompts or replies.
• Self-hosted, prompts, replies and your provider keys never reach our servers at all; only the numbers needed to keep the tab do.
• Hosted, prompts pass through our proxy in memory on their way to your provider and are never stored or logged. Provider keys are stored encrypted and can only be opened with an unlock secret your agent sends and we never store.
• We do not sell or rent personal data, and do not use your data or your agents' traffic to train AI models. Your account, the console and your agents' traffic are never shared with advertisers.
• flocktab.com's public pages (never the console) run Google Analytics and the advertising pixels of X, TikTok and Meta to measure our site and ads, only after you accept them in the EEA, the UK and Switzerland; the ad pixels never run when your browser sends Global Privacy Control. See Advertising on our public pages.
• The public leaderboard shows rounded usage totals under "Anonymous" unless you hide it in Settings; your name and a public page appear only if you choose a display name.

Account and team

• Your name, email address and profile picture from the sign-in you choose (email and password, Google or GitHub), and a user identifier from our authentication provider.
• For teams: members, their roles, invitations and invited email addresses, and the flock's settings, including single sign-on and SCIM configuration.
• Security records: passkeys (public keys only), authenticator-app secrets (encrypted), recovery codes (hashed) and your sign-in sessions.

What you set up

• Agents, tabs, caps, policies, projects, alerts (including the webhook addresses you give us) and the other configuration you create.
• Provider API keys you store with us for the hosted proxy, as AES-256-GCM ciphertext that we cannot decrypt without the unlock secret your agent sends with each call. The unlock secret is never stored.
• Credentials for outside-spend connectors you link (for example a vendor's billing API key or OAuth grant), encrypted at rest, and the billing and usage data those vendors return.
• Virtual keys (ft_live_ and ft_test_), stored only as a hash.

What happens when your agents run

• For each call: the Agent, model, token counts, estimated and settled cost, timing, tool names, the decision and its reason. This is the ledger.
• For subscription Agents (your own Claude, ChatGPT, Grok or Kimi login): the account identifier, email and plan the vendor reports, and the quota windows it reports, so usage is filed under the right account. The login itself is not stored.
• Where an Agent runs: the working folder path, git remote and harness, so the console can tell your projects apart.
• Only if you turn them on: for Agent Guard, each tool call your agent is about to run (the command and its arguments, including text being written to a file) is sent to us and to TypeSafe, which provides the judgment model, to be judged. Keys, tokens and passwords are removed first, and we keep only a summary of up to 200 characters. For the loop watch, a one-line summary of recent tool calls, whether they failed and when they ran. Tool output is never sent.

Billing, support and the website

• Your plan, subscription status and billing history. Card details are collected and held by Stripe; we never see or store them.
• Messages you send us through the Support widget or by email: your name, email address, message and the page you were on, plus a one-way hash of your network address used only to limit abuse.
• Technical records our hosting provider keeps when you reach our servers: IP address, time, path, response code and user agent.

flocktab.com/leaderboard ranks flocks on four boards: the list-price value of calls through subscription logins, spend on their own provider keys, risky tool calls Agent Guard stopped, and the most calls made in one minute, over the last 7 days and all time. It shows a rank and a rounded figure (for example $1.2k), never exact amounts, models, flock names, email addresses or keys. Only flocks whose owner has a verified email are ranked.

• By default a flock is listed as "Anonymous": no name, no link and nothing that ties the row to you. Flocks that existed before this update start being listed 30 days after it took effect, and the console shows each of them the date first.
• Hide me from the leaderboard completely in the console's Settings takes your flock off every board on the next read.
• A display name is your choice. It lists you under that name and gives you a public page at flocktab.com/u/<name> to share. Before it is shown, TypeSafe's judgment model checks it is not offensive; only the name is sent. A name that is refused is not stored. You can change it three times a day or remove it at any time.

To see how people find FlockTab and which of our ads bring them here, flocktab.com's public pages load Google Tag Manager, and through it Google Analytics and the advertising pixels of X (X Corp.), TikTok andMeta. They never run on the console, sign-up, sign-in, checkout or account pages.

• What they send to Google and the ad networks: the page you visited and where you came from, whether you clicked a button to start signing up, your IP address and browser details, and their own cookie identifiers. Google Analytics counts visits and how the site is used; the ad networks count which ads led to visits and sign-ups, and may use it to show our ads to people who visited.
• In the European Economic Area, the United Kingdom or Switzerland, nothing loads until you choose: a banner asks, Accept and Reject are equal, and Reject loads nothing. Your answer is kept for 12 months.
• Everywhere else, the pixels load after the page has finished, and you can turn them all off with Your privacy choices at the bottom of every page. If your browser sends Global Privacy Control, we treat it as an opt-out from advertising automatically: the X, TikTok and Meta pixels stay off, and Google Analytics still counts visits unless you turn it off too.
• Change your mind at any time with Cookie settings at the bottom of every page.

• The content of prompts or replies. Hosted, they pass through memory only; self-hosted, they never reach us.
• Your unlock secret, or your provider keys in readable form.
• Your subscription logins' passwords or session tokens.
• Card numbers, which go to Stripe directly.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Agent Guard's judgments apply to your agents' tool calls, under settings you control.

We use a small number of service providers (subprocessors), each bound by contract to use the data only to provide their service to us:

At your direction. Your agents' calls go to the model providers you choose (for example Anthropic, OpenAI, xAI or Moonshot) under your own account with them. Connectors you link read billing data from the vendors you name, and alerts go to the webhook addresses you set. Those providers handle the data under their own terms and privacy policies.

Within your team. Members of your flock see flock data according to their role.

For legal reasons. We disclose information if the law requires it, to protect the rights, property or safety of our users or others, or to enforce our Terms. Where allowed, we tell you first.

If the business changes hands. In a merger, acquisition or sale of assets, data may transfer to the new owner, who must honour this policy or tell you before it changes.

We are based in the United States and our service providers process data there and elsewhere. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on another lawful transfer mechanism, and on our providers' own safeguards.

• Account, flock configuration and ledger records: for as long as your account or flock exists. How far back the console shows the ledger depends on your plan.
• When you close a flock, everything in it is deleted at once: its Agents, tabs, keys, policies and ledger; its projects, alerts and outside spend; its connected accounts and subscription logins; its machine logins; its members, invites and roles; its security, single sign-on and SCIM settings; its public leaderboard entry; and its own audit trail. Support tickets are kept so we can still answer them, no longer linked to the flock. Your sign-in, passkeys and two-factor settings belong to you, not the flock, so they stay until you remove them or ask us to delete them. Billing records are kept as described below. Copies may remain in our hosting provider's database backups until those backups expire.
• Billing records: as long as tax and accounting law requires (typically up to seven years).
• Support messages: while they are needed to answer you and handle follow-ups. Ask us and we will delete them sooner.
• Technical access records at our hosting provider: for their short rolling retention period.

• Provider keys and connector credentials are encrypted at rest with AES-256-GCM; provider keys can only be opened with an unlock secret we never store.
• Virtual keys and recovery codes are stored as hashes. Every console page, action and API checks the caller's permission.
• Passkeys and two-factor authentication are available on every plan, and a flock can require them.
• Traffic is encrypted in transit (HTTPS). The Service fails closed: if our ledger cannot be reached, calls are refused rather than let through.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires. You can report a security issue to hello@flocktab.com.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to our use of it, and withdraw consent where we rely on it.

• Much of this you can do yourself: edit your name and settings in the console, hide your flock from the public leaderboard or remove its display name, export ledger and attribution data as CSV, and close your flock to delete its data.
• For anything else, email hello@flocktab.com from the address on your account. We answer within 30 days (45 days for California requests), and may need to verify it is you.
• For data your organisation's agents send through the Service, we act for your organisation: we will pass your request to them and help them answer it.
• In the EU or UK you can also complain to your data protection authority.

California residents. Under the CCPA as amended by the CPRA, you have the rights to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell personal information. The advertising pixels on flocktab.com's public pages may count as "sharing" for cross-context behavioural advertising: opt out with Your privacy choices at the bottom of every page, or by sending Global Privacy Control, which we honour automatically. We do not use sensitive personal information to infer characteristics about you. The categories we collect are identifiers, commercial information, internet or network activity and professional information, described above. We will not discriminate against you for exercising your rights. An authorised agent may make a request for you with your written permission.

The console uses only first-party cookies and browser storage that the Service needs. On flocktab.com's public pages, an advertising network's pixel may also set its own cookies, only under the consent rules in Advertising on our public pages.

Blocking the console's cookies will stop the console from working. Blocking the advertising cookies changes nothing on flocktab.com.

The Service is for businesses and professionals and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We will post any change here with a new date. If a change materially affects how we use your personal data, we will tell account holders by email or in the console at least 30 days before it takes effect.

Hanamori Labs LLC, 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States · hello@flocktab.com. See also our Terms of Service and the security page for how the proxy handles your data.