Privacy Policy
Last updated: 29 August 2026
The short version. AgentGuardian runs on your computer. Your repositories, your commits, and your code stay on your machine. We operate no servers that receive your code — the only code that ever leaves your device goes directly to the AI provider you choose, using your API key. The only personal data we hold is the email address you used to buy a licence.
1. Who this covers
This policy covers the AgentGuardian desktop application and the website at agentguardian.app. Throughout, “we” and “us” mean the operator of AgentGuardian, contactable at support@agentguardian.app.
2. What stays on your device
The following is written to the application's data folder on your own computer and is never transmitted to us:
- The file paths of repositories you add
- Commit metadata — hashes, messages, authors, dates
- Review results — risk scores, summaries, flagged issues with file and line references
- Test run results
- Your application settings, including the AI provider API key you enter
- Your licence key and activation state
On Windows this lives under %APPDATA%\AgentGuardian. Deleting that folder erases all of it permanently. We hold no copy and cannot recover it.
About your API key. It is stored in the application's local data folder in plain text, in the same way most desktop developer tools store credentials. Anyone with access to your user account on that computer could read it. Treat it as you would any credential kept on disk, and revoke it with your provider if your machine is lost or shared.
3. What leaves your device, and where it goes
To the AI provider you choose
When AgentGuardian reviews a commit, it sends the commit message and the code diff to the provider you selected in Settings, authenticated with your own API key. Supported providers are OpenAI, Anthropic, Google Gemini, OpenRouter, Groq, or any custom OpenAI-compatible endpoint you configure.
This traffic goes directly from your computer to that provider. It does not pass through us. How that provider handles your code is governed by their privacy policy and your agreement with them, not by this one. If your code is sensitive, review their data-retention and training policies before enabling AI review.
Commits that only touch documentation are skipped automatically and no diff is sent.
To our licence server
When you activate or re-validate a licence, the application contacts api.agentguardian.app and sends:
- Your licence key
- A fixed application identifier, literally the string
agentguardian-desktop
That identifier is the same constant for every installation. It is not a device fingerprint and carries nothing about your hardware, your operating system, or you. No repository names, code, or review data are ever sent to this server.
4. What we store about you
| Data | Why |
|---|---|
| Email address | To send your licence key and answer support requests |
| Licence key | To validate your activation |
| Stripe checkout session ID, amount, currency | To match a licence to a purchase and handle refunds |
| Activation and last-seen timestamps | To detect abuse of a single licence across many installations |
That is the entire record. There is no analytics, no telemetry, no crash reporting, no advertising identifier, and no tracking of how you use the application.
5. Third parties involved
| Who | What they handle |
|---|---|
| Stripe | Payment processing. Your card details go to Stripe directly and are never seen by or transmitted through us. |
| Resend | Delivers your licence key email. Receives your email address and the message content. |
| Cloudflare | Hosts this website and the licence server, and forwards email sent to our support address. |
| Your AI provider | Receives code diffs as described in section 3. You choose which, and you hold the account. |
6. How long we keep it
Licence records are retained for as long as the licence exists, since a lifetime licence has to remain verifiable. Support emails are kept while they are useful for answering follow-up questions and are deleted periodically after that.
7. Your rights
You may ask us to show you what we hold about you, correct it, delete it, or provide a copy. Email support@agentguardian.app and we will respond within 30 days.
Deleting your licence record means the licence can no longer be validated and the software will revert to the free tier. We will make that consequence clear before acting on any deletion request.
Anything held on your own computer is yours to delete at any time, without asking us.
8. Children
AgentGuardian is a professional developer tool and is not directed at children under 16. We do not knowingly collect data from them.
9. Changes to this policy
If this policy changes materially, the date at the top will be updated. Where the change affects how we handle data belonging to existing customers, we will email licence holders directly rather than relying on you to check this page.
10. Contact
Questions about this policy, or about any data we hold: support@agentguardian.app.