---
title: "Privacy and data handling"
description: "What AgentTwin discovery, execution, accounts and website analytics process."
canonical: "https://agenttwin.si/privacy/"
---

# Privacy and data handling

This page describes the implemented data flows as reviewed on October 22, 2026. It is not a claim of certified compliance or a guaranteed deletion deadline. Review the actual files and evidence before sharing them.

## Repository discovery and accounts

Discovery runs locally. Connecting and syncing sends detected service names, workflow metadata, Git metadata and available test evidence to the configured API account. The discovery sync does not upload application source or credentials. Account sign-in processes identity information; password hashes, session records and token hashes are stored by the API. Authentication providers process their own sign-in requests.

## Execution and evidence

Local runs execute on your computer with access to its filesystem and network. Optional cloud execution uploads explicitly selected workflow files, fixtures and configuration to E2B. Receipts can contain application output, recorded events and initial/final state; these can include sensitive data if your application or fixtures include it. Use synthetic fixtures and review receipts before syncing.

Cloud sandbox termination is attempted after execution. Cleanup can fail and configured expiration is the backstop. Gateway receipt pruning runs on startup and new run submission for records older than 30 days, with a cap of 1,000 receipts per account. There is no verified scheduled deletion deadline or self-service erasure pipeline; account revocation alone does not erase history. Locally saved evidence remains on your computer until removed.

## Website analytics and contact

The website includes Plausible, PostHog and Google Analytics scripts, which can process page visits and interaction information. Sign-in and account features use cookies and browser storage. Google/GitHub sign-in, email delivery, E2B execution, analytics and call booking involve their respective service providers when used. For questions about account data or sensitive concerns, [arrange a private discussion](/contact/). Do not post credentials or private records in public issues.

See [safety boundaries](/docs/safety/) for further technical limits.