Privacy policy
Draft for the owner and a lawyer to complete before more people are invited. The facts below come from how clawhq is built today (2026-10-25). The operator's name and address, the contact for privacy requests, the governing law and the retention periods still need to be filled in. Version 2026-10-25.
Who runs clawhq
[Operator's legal name, address and contact e-mail for privacy requests.]
What we keep
- Your account: your name and e-mail from the sign-in service, when you joined, your time zone, and when you agreed to this policy.
- Your assistant: your agents, their memory and files, your conversations, schedules and the channels you connect live in your own isolated copy on our server.
- Usage counts: for every model call, the tokens used, the model, the time and whether it worked. We never log the words of your prompts or the replies in these records.
- Keys you give us: model provider keys and Telegram bot tokens are kept sealed (encrypted) on our server and never shown again.
- A log of changes you make to your setup (an agent added, a plugin switched on) and of your sign-ins, without secrets. Each line notes where it came from (the clawhq page, the desktop app or the site's owner), the network address it came from and, for a sign-in, your browser's name. The address is removed after 90 days.
- Crash reports: when the clawhq page breaks in your browser, it tells us what broke (the error, the page address without its query, the app and assistant versions), tied to your account only to count how many people it affected. Never your messages or files. Kept 30 days.
- Outbound connection metadata: if the owner enables abuse tracing, the destination IP address and port, time and copy bridge for a new connection. It never contains a URL, request content or reply. [Owner: publish the retention and abuse contact before enabling it.]
Who sees your words
To answer you, your messages and what your agents read and write are sent to the services below. Which ones depends on what you use.
| Service | When | What it receives |
|---|---|---|
| Hostinger (our server) | always | everything clawhq stores, on a server we run |
| The clawhq accounts service | signing in | your name, e-mail and password (it is the same operator's sign-in service) |
| "ClawHQ Free" models, routed through our model router to OpenCode's free contributor models | when your agent uses ClawHQ Free | your conversation and what the agent reads, for each reply. [Owner: confirm these models' data terms: retention and training.] |
| Anthropic | only if we set up our own Anthropic key | the same, for each reply |
| OpenAI (ChatGPT / Codex) or Anthropic (Claude) | if you sign in with your own plan in clawhq | the conversations of the agents you give that plan, under your own account with them |
| Your own model providers | if you add your own key | the conversations of the agents you give that provider, under your own account with them |
| DuckDuckGo | when an agent searches the web | the search words, from our server's address |
| Telegram | if you connect a bot | the messages you and your agent exchange there |
| ClawHub (OpenClaw's plugin catalog) | when you browse or install plugins | your search words |
| [Backup storage provider] | every night | an encrypted copy of our database and your assistant; we hold the only key |
Your agents also do work in the background on the same model service, for example tidying their memory at night and learning reusable skills from your conversations. Web pages your agents open are fetched from our server. The memory search model and the backup fallback model run on our own server and send nothing out. Neither your assistant nor the desktop app checks with OpenClaw for updates: we update them ourselves. clawhq loads no fonts, scripts or trackers from other companies.
Your computer
If you install the desktop app and join your computer, your agents can do there only what you switch on for that device (run commands, see the screen, use the browser…). Every switch starts off.
How long we keep it
Your account and your assistant are kept while you use them. Inside your assistant, a conversation you delete or start over leaves an archived copy that is removed after 30 days, and each agent's conversation history is kept within a fixed amount of space, oldest first out, never from the last 7 days. [Owner: confirm once the retention check on the test copy shows the archived copy also leaves the assistant's database.] The count of model calls (no words, only who, which model and how many tokens) is kept 13 months, and the change log 12 months (the network addresses in it 90 days); then they are deleted. [Owner: confirm these, and whether accounts nobody uses are closed after a time.] Deleted data leaves our backups when they expire, about 60 days later.
Your choices
You can delete your account and everything in it yourself: Delete my data in the account menu. Your assistant, its agents, files and memory, your schedules, keys, sign-ins and connections go at once, from our server and from the backups on it; copies in our off-site backups go when those expire. Your sign-in at the shared accounts stays. For a copy of your data, write to [contact].
Changes
When this policy changes we ask you to agree again before you go on.