Privacy Policy

What we store

Your account. Your name, email address and profile picture (if you sign in with Google or GitHub), your passkeys, and your organizations, members and invitations. For each signed-in session we store the IP address and browser it came from. Sign-in codes are stored only as hashes and expire after 5 minutes. Invitations expire after 7 days.

Connected accounts. When you connect a service such as Google, GitHub, Slack, Atlassian, GitLab, Miro, Zoho CRM or Zendesk, we store the access and refresh tokens that service gives us. For services that use keys, such as AWS or ElevenLabs, we store the keys you enter. They are encrypted (AES-256-GCM) before they are stored and used only to make the requests you or your agents ask for.

Apps and their data. Apps you install can store their own data. Workflows keep their inputs, results and each step's output, encrypted. Events apps send each other are stored encrypted for 3 days.

Model subscriptions. If you connect a model subscription to your pool, its credentials are held by the pool backend, which runs in the EU. We keep daily usage counts per person, provider and model (requests, tokens and cost) for 30 days. Your model requests and responses pass through the pool backend to your provider. The pool backend doesn't keep the content of requests that succeed. To continue some conversations across providers, it can store parts of a response, such as tool-call details, in the pool database for about an hour.

When a request fails, the pool backend currently keeps the provider's error response, which can include content, together with the key that made the request. We are removing these copies.

Feedback. If you or your agent send feedback, we receive the message, the page you were on, recent error codes and any screenshot you choose to attach.

We don't log what your tools read or return. A tool call waiting for your approval is stored encrypted until you answer it, and deleted after it expires if you don't. Otherwise tool data is kept only where you or an app save it, such as a workflow's history.

Why we use it

We use your data to provide the service you signed up for, and, for security, error reports and usage counts, for our legitimate interest in running Signalbox safely and reliably.

Where it is stored

• Database: PlanetScale, in the EU (Frankfurt, eu-central).
• Files and app data: Cloudflare R2 and Durable Objects, restricted to the EU.
• Pool backend: Cloudflare Containers, restricted to the EU.
• Signalbox runs on Cloudflare's network, which handles requests at the location nearest to you.

Who else receives data

• Services you connect. When you or your agent use a connected account, Signalbox sends requests to that service with your access.
• Your AI agent. Results from your tools go to the agent you connected, such as Claude Code, Codex or Cursor, and so to that agent's provider. Model requests through your pool go to the model provider whose subscription you connected.
• Cloudflare hosts Signalbox and sends our emails (sign-in codes, invitations and verification links) from auth.signalbox.run.
• PlanetScale hosts our database (EU).
• Sentry (EU) receives error reports and the feedback you send. Error reports contain an error code, the kind of page or request, and your account ID. They don't contain your content.
• PostHog (US) receives product usage events, such as signing up, connecting an account or calling a tool, with your account ID and, for some events, which app or service was involved. They contain no content, no email address and no IP address.
• Google and GitHub, if you choose them to sign in.

Some of these recipients process data outside Switzerland and the EEA, including in the United States. Those transfers rely on the EU Standard Contractual Clauses. We don't sell your data and don't use it for advertising.

Google user data

Signalbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account, Signalbox uses the Google data you allow (for example Gmail, Calendar, Drive, Docs, Sheets and Slides) only to carry out the requests you and your agents make, and returns the results to you and the agent you connected. We do not:

• use Google user data for advertising, or sell it;
• use it to develop, improve or train generalized AI or machine learning models;
• let people read it, unless you ask us to, it is needed for security, or the law requires it.

Cookies

Signalbox uses only cookies it needs to work: your sign-in session, the organization you last used, your time zone, and whether to show the passkey prompt. There are no advertising or analytics cookies.

How long we keep it

• Your account, organizations and connected accounts: until you remove them or ask us to delete your account.
• Sessions: 7 days, or until you sign out.
• Inactive agent connections: revoked after 30 days.
• Pool usage counts: 30 days.
• Events apps send each other: 3 days.

Disconnecting an account in Signalbox deletes its stored tokens. To also end access at the service, revoke Signalbox in that service's settings, for example your Google Account's third-party access page.

Your choices and rights

You can disconnect accounts, revoke sessions, remove members, and leave or delete an organization in Signalbox. To get a copy of your data, correct it, or delete your account, write to info@signalbox.run. We may need to verify your identity before acting on a request.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where EU law applies, your local supervisory authority.

Changes

If we change this policy in a significant way, we will tell you by email or in the app before the change takes effect.