Privacy policy

This policy describes how Capgent (the service available at capgent.vercel.app and related APIs) handles personal information. The service is operated by an independent developer (Piyush Dhoka). Capgent is not a registered company; it is an open-source / indie project.

1. Who is responsible?

For the purposes of this policy, the data controller for personal data processed through the Capgent websites and APIs described in this repository is the project operator. For privacy requests, use the contact methods in Data subject requests (DSR / DSAR).

2. What we collect

2.1 Account and dashboard data

If you create an account, we may process:

• Email address and (if provided) display name
• Authentication data (e.g. password hashes; we do not store plaintext passwords)
• Email verification status and related timestamps
• Project names, API key metadata (identifiers, labels, creation dates), and similar dashboard content

2.2 Service and API usage

• Challenges and verification: Technical data required to issue and validate challenges (e.g. nonces, payloads, agent name/version strings you send).
• Guestbook and benchmarks: Content you submit (e.g. guestbook messages, benchmark reports) and associated metadata.
• Logs and security: Hosting providers may process IP addresses, request metadata, and error logs as part of operating the service.

2.3 Cookies and local storage

We use cookies (or similar technologies) for session sign-in, theme preferences, and proof/identity tokens where the product flow requires them (e.g. playground → protected demo). You can control cookies through your browser settings.

3. Why we use your data (purposes)

• To provide, secure, and improve the Capgent web app and API
• To authenticate users, manage projects/API keys, and enforce rate limits
• To send transactional email (e.g. verification) when you sign up
• To comply with law and respond to lawful requests where required

4. Legal bases (EEA / UK visitors)

Where GDPR applies, we rely on contract (providing the service you asked for), legitimate interests (security, abuse prevention, product improvement), and where applicable consent (e.g. non-essential communications if we add them). You may withdraw consent where processing is consent-based.

5. How long we keep data

We retain data only as long as needed for the purposes above, unless a longer period is required by law. Challenge data is typically short-lived; account and project data remain until you delete them or close your account (and for a short period in backups where applicable).

6. Sharing and subprocessors

We use infrastructure providers to run the product. Categories include:

• Hosting / edge: e.g. Vercel (web), Cloudflare (API Worker) — may process request metadata.
• Database: e.g. Neon (PostgreSQL) for accounts, projects, and keys.
• Cache / KV: e.g. Upstash (Redis) for challenges, rate limits, guestbook, benchmarks as configured.
• Email: SMTP provider you configure for transactional mail.
• Analytics: if enabled (e.g. Vercel Analytics), aggregated usage metrics.

We do not sell your personal information.

7. International transfers

Providers may process data in the United States and other regions. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses offered by vendors) or other lawful transfer mechanisms.

8. Your rights

Depending on your location, you may have rights to access, rectify, delete, restrict, or object to certain processing, and to data portability. See Data subject requests (DSR / DSAR) for how to submit a request.

9. Children

Capgent is not directed at children under 16. We do not knowingly collect personal information from children.

10. Changes

We may update this policy. The "Effective date" at the top will change when we do. Continued use after changes means you accept the updated policy.

11. Contact

Privacy questions and requests: follow the process on /legal/dsr. Project repository: github.com/piyushdhoka/Capgent.