Privacy Policy

1. Who is responsible

The data controller is Absolutely Right AB, org. no. 559577-8233, Ofg 773b Billo, 106 46 Stockholm, Sweden, the company behind supaclank. Privacy questions: privacy@supaclank.com.

2. What this policy covers

It covers the supaclank cloud service, the clank mobile app, and our websites. It does not cover self-hosted clank: if you run clank on your own infrastructure, your projects and prompts stay between your devices, your machines, and the AI provider you use; none of it reaches us.

3. How your data flows

Your work lives on your sandbox: your code, project files, and the agent's session transcripts sit on a machine dedicated to you, not in a shared database. Credentials you connect (your AI provider sign-in, git hosting tokens) are stored there too, so the agent can act on your behalf. Our gateway authenticates you, enforces billing, and routes your traffic to your sandbox; our central systems hold only account, billing, and operational records (your sandbox registration, push token, and active preview links). The main exception: images you attach to prompts are stored in our object storage.

The AI exchange starts and ends at your sandbox. clank runs a coding agent there (by default, Anthropic's Claude Code CLI), connected to your own provider account: we start the provider's device-authorization flow, and the credential lands on your sandbox. When you prompt the agent, your prompt and relevant project context go from your sandbox directly to that provider, under that provider's terms and privacy policy. We do not send your content to AI providers ourselves.

Treat prompts accordingly: don't paste secrets or personal data you don't want transmitted to your provider.

4. What we collect

• Account data. Your email address and, if you sign in with GitHub, the basic profile information GitHub shares (username, avatar). Passwords are handled by our auth provider, Supabase; we never see them.
• Billing data. Payments are processed by Stripe. Stripe holds your card details; we never receive them. We store your subscription status and billing history.
• Sandbox contents. Your code, project files, the working history of your agent sessions (transcripts), and the credentials you connect, all stored on your sandbox (see §3).
• Images and uploads. Images you attach to prompts are stored in our object storage (Tigris).
• Push tokens. If you enable notifications, a device push token, so we can deliver them.
• Technical data. Standard server logs (IP address, request metadata, timestamps), used for security, debugging, and abuse prevention.
• Website analytics. How our websites are used in aggregate: pages visited, referrer, country, browser and device type, plus anonymous conversion events such as a checkout being started. On public marketing and sign-up pages, we also collect sampled interaction recordings and click/scroll heatmaps to understand confusing journeys. Form controls are excluded, typed values are masked, and account, OAuth, repository, and workspace pages are never recorded. Recordings expire after 30 days. Umami uses no cookies or browser storage for replay, no identifier lasts beyond the day or follows you to other sites, and your browser only contacts our website (data is relayed to our self-hosted Umami instance). Websites only: there is none of this in the mobile app or on your sandbox.
• Communications. Emails you send us, and messages submitted through forms on our sites (stored in Google Sheets via Google Apps Script).

We use no advertising SDKs anywhere, and no analytics of any kind in the mobile app.

5. Why we process it (legal bases)

• To provide the service (contract, GDPR art. 6.1 b): running your sandbox, storing your projects, delivering notifications, billing.
• To keep the service safe and working (legitimate interest, art. 6.1 f): security monitoring, abuse prevention, debugging from server logs, and measuring how our websites perform through cookieless analytics.
• To meet legal obligations (art. 6.1 c): bookkeeping, tax, responding to lawful requests.

We do not sell personal data. We do not use your code, files, or transcripts to train AI models. And we do not track how you use clank: what you build, prompt, or run on your sandbox is never measured or reported back to us. The product metrics we watch are operational (uptime, machine health, latency, error rates), and the website analytics above covers our website, including its sign-up and checkout pages, but never reaches the mobile app or your sandbox.

6. Who can access your sandbox

Your sandbox runs on cloud infrastructure we administer, and we hold administrative credentials to it. Concretely:

• Automated processes access sandboxes to run the service: provisioning, updating the agent CLI, health checks, sleep and wake.
• People at supaclank access the contents of a sandbox (your files, your transcripts) only (a) to debug a problem you asked us to look at, (b) to investigate abuse, fraud, or a security incident, or (c) when we are legally compelled to.

We do not volunteer your data to anyone, authorities included. We disclose it only in response to a valid legal order, no more than the order compels, and we will tell you before complying unless we are legally prohibited from doing so.

7. Who we share data with

Only processors that run the service for us:

• Supabase: authentication and database.
• Stripe: payments and subscription billing.
• Fly.io: the cloud infrastructure your sandbox runs on.
• Tigris: object storage for images you upload.
• Expo: push-notification delivery, relayed onward through Google's Firebase Cloud Messaging.
• Google: Firebase Cloud Messaging (the push relay above); Google Sheets for contact-form submissions.
• Proton: our email.

Some of these are outside the EU/EEA (mainly in the United States). Where they are, transfers rely on adequacy decisions such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses. Beyond processors, we disclose data only if the law requires it (see §6), or as part of a merger or acquisition, in which case this policy continues to apply to your data and we will notify you.

8. How long we keep it

• Account and sandbox data. For as long as you have an account. When your subscription ends, your sandbox is suspended, not deleted; we may remove sandboxes that stay inactive, but never sooner than 30 days after the subscription ends.
• Account deletion. Deleting your account destroys your sandbox and its contents immediately, and any remaining account records within 30 days.
• Bookkeeping records. Kept for 7 years, as the Swedish Bookkeeping Act requires.
• Uploaded images. Deleted from our object storage automatically within 48 hours of upload. Your sandbox fetches them within minutes of you sending the message, so there is no reason to keep them longer.
• Server logs. Up to 90 days.
• Backups. Deleted data can persist in backups for up to 30 days before being purged.

9. Your rights

Under the GDPR you can ask us to:

• show you the personal data we hold about you (access), and give you a copy (portability);
• correct it (rectification) or delete it (erasure);
• restrict or object to processing based on legitimate interest.

Delete your account directly in the app, on the web at supaclank.com/delete-account, or email privacy@supaclank.com for this or any other request; we respond within 30 days. If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.

10. Security

Traffic is encrypted in transit, each user's sandbox is an isolated environment, and access to production systems is restricted (see §6). On your side: keep your account credentials safe, and keep real secrets out of prompts. If a security incident affecting your data comes to our attention, we will tell you promptly.

11. Children

The service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, contact us and we will delete it.

12. Cookies and local storage

Our sites store only what's needed to keep you signed in (an authentication session, in your browser's local storage) and to remember the setup choices you make (build targets, devices, and local or cloud usage). Setup choices contain no account identifier and remain in your browser until you change them or clear your browser data. We use no advertising cookies and no cross-site trackers, and our analytics is cookieless and stores nothing on your device. That is why you don't see a cookie banner here.

13. Changes

When this policy changes materially, we will notify you by email at least 30 days before the change takes effect. The current version always lives at this page; its history is public in our repository.

14. Contact

privacy@supaclank.com for privacy matters, support@supaclank.com for everything else.