Privacy Policy

1. What We Collect

teamrc collects minimal data necessary to operate the Service:

Authentication Tokens : Ed25519 public keys generated locally on your machine. Private keys never leave your device.

Team Configurations : Agent definitions, skill assignments, and team metadata you choose to sync through the relay server.

Account Information : If you sign in via email or OAuth (GitHub, Google): your email address, stored alongside your machine token associations for machine management and recovery.

Machine Hostnames : When you link an account via teamrc login, your machine hostname is stored to help you identify machines on the dashboard. This hostname may contain personal information (e.g. john-macbook). Machines that have not linked an account do not have hostnames stored.

Invite Codes : Ephemeral codes generated for team invitations, automatically expired after use or TTL.

2. What We Don't Collect

Your source code or project files
AI conversation history or prompts
File contents from your repositories
Analytics, tracking, or telemetry data
Cookies for advertising or cross-site tracking

3. Cookies

We use strictly necessary cookies for authentication. When you sign in, session cookies (_teamrc_key) are set to maintain your authenticated session. We do not use tracking, analytics, or advertising cookies.

4. How We Use Your Data

Data is used solely to provide the Service:

Authenticating your CLI requests via signed tokens
Syncing team configurations between your machines
Managing team membership and invitations
Associating machines with your user account

5. Data Storage and Retention

Team configurations and account data are stored on the relay server. Data is processed and stored in the United States. You should maintain local backups of your team configurations via teamrc export or your .teamrc.yaml files.

Team data is retained as long as at least one active machine token is associated with the team. Orphaned teams (with no active token associations) may be purged after 90 days. Revoked tokens are retained for audit purposes for 30 days, then permanently deleted.

6. Data Sharing

We do not sell, rent, or share your data with third parties. Team configurations are shared only with other members of your team who have joined via invite code or clone token.

7. Third-Party Services

The Service integrates with:

GitHub OAuth: Optional sign-in provider. When you sign in with GitHub, your GitHub user ID and email address are stored in our database. Subject to GitHub's Privacy Statement.
Google OAuth: Optional sign-in provider. When you sign in with Google, your Google user ID and email address are stored in our database. Subject to Google's Privacy Policy.

8. Your Rights

For signed-in users:

You can delete your account and all associated data via the dashboard settings page or DELETE /api/account endpoint. This removes your account, all machine-token associations, and team participations.

For machine-token-only users:

You can erase all server-side data associated with your machine by running teamrc delete from that machine. This removes all local teamrc files and sends a signed request that deletes all team participations and data associated with that machine's token from the relay. Each machine must trigger erasure independently.

You can also delete your local data at any time by removing ~/.teamrc/ and your .teamrc.yaml files.

Privacy contact: For privacy inquiries, email [email protected]. Do not use public issue trackers for privacy requests.

9. Changes to This Policy

We may update this Privacy Policy as the project evolves. Changes will be reflected in the "Last updated" date above and communicated through the project repository.

10. Contact

For general privacy concerns, open an issue on the teamrc GitHub repository. For personal data requests, email [email protected].