Who we are
[Company name], [Company address], is responsible for the personal data this policy describes (“we”, “us”). Write to us at contact@anvil.foo.
In short
Your work stays on your computers. Our servers keep what it takes to run your account: who you are, your devices, your plan, and how your devices find each other. We don’t sell data or show ads, and there is no analytics or tracking in Anvil or on this site.
What stays on your devices
Your projects and files; your sessions, their transcripts and diffs; your terminals and their output; your settings and your agents’ configuration; your Claude and ChatGPT accounts and their tokens; and each device’s private key. They travel only between your own devices, over links encrypted end to end and bound to the two devices’ keys, and we never receive them.
What our servers keep, and for how long
| What | Why | Kept |
|---|---|---|
| Your email address, name and picture | Your account, receipts and your activity list | While your account exists |
| Connections: GitHub, Google or Apple, and their id for you | Signing in with them | Until you remove one |
| Sign-in codes on their way, from the email or another device | Proving a sign-in | As a keyed hash, until used or for 10 minutes |
| Your authenticator app’s secret, if you turn one on | Checking its codes | Encrypted, until you turn it off |
| Your devices: their id, public key, kind, name, system and app version, when each was added and last seen | Your list of devices | Until a device is removed, then 30 days |
| Your account’s device log | Which devices are in your account | While your account exists |
| The device authority’s record of what it signed | Checking it later | 1 year |
| The addresses your devices connect from, and how long they take to reach our servers | Setting links up, choosing the nearest server and relay, and the approximate place a sign-in shows | 30 days |
| Security events: sign-ins and sign-outs with how they were made, connections and authenticators added or removed, recoveries | Your activity list, and stopping abuse | 1 year; their address and place 30 days |
| Your phones’ notification subscriptions | Delivering notifications | Until the phone is removed |
| Your plan and its state | What your plan allows | While your account exists |
| Our servers’ logs: what was asked of them and when, never its contents | Running and securing the service | 30 days |
Paddle keeps your invoices as tax law requires. Our backups are encrypted, and each is deleted after 30 days.
What we never have
Your code, prompts, transcripts and diffs; the names of your files, projects and sessions; your terminals’ output; what your notifications say; anything a relay carries, in a form we can read; and your Claude and ChatGPT sign-ins, which stay on the computer that holds them.
How the parts that reach us work
- Links between your devices. To set a link up, your devices exchange their network addresses through our servers, which keep none of them. A relay carries a link only when there is no direct path, and cannot read it.
- Notifications. Your computer encrypts each notification for your phone itself. We pass it on to your phone’s push service (Apple’s, Google’s or your browser maker’s) without being able to read it, and see only that one went, how large it was and when.
- Where a sign-in comes from. We look up the approximate place of an address, a city and never closer, in a database on our own servers, so a sign-in request and a code’s email can say where they come from. No address is sent to anyone for this.
Who processes data for us
- Paddle sells the subscription as our merchant of record. It takes your payment details, billing address and tax information itself, keeps your invoices, and handles them under its own privacy policy. We receive the state of your subscription, never your card.
- Resend sends the emails with your sign-in codes. It receives your email address and the email itself: the code, and the device and approximate place that asked.
- Vultr hosts our servers, our database and its encrypted backups, in the United States (New Jersey), and our servers for links and relays in other regions, Frankfurt in Germany among them.
- Cloudflare runs our domain’s addresses and forwards the mail you send us.
- GitHub hosts the app’s installers and its updates. Your computer downloads them from GitHub, which sees its address as any site you visit does, under its own privacy policy.
- GitHub, Google and Apple, if you sign in with one of them, tell us your id with them, your username or email address and your picture, under their own privacy policies.
Why we may keep it
We process this data to give you the service you signed up for, to keep it secure and stop abuse, which is our legitimate interest, and to meet legal duties such as keeping tax records. Where data leaves the European Economic Area or the United Kingdom, as it does for our servers in the United States, it is protected by the safeguards the law provides, such as the European Commission’s standard contractual clauses.
Your rights
Export data, in your account on this site or in the app’s Settings, Account, downloads everything we keep about your account, and Delete account is beside it. The app’s Settings, Account changes your name and your address. You may also ask us to access, correct, delete or restrict your data, to hand it to you in a portable form, or to stop processing it, by writing to contact@anvil.foo; and you may complain to your data protection authority.
Deleting your account
Delete account, which you confirm with a code sent to your address, cancels your plan at once, signs out every device and erases your account from our servers within 30 days, as the backups that hold it are deleted. Nothing on your computers is touched. Paddle keeps your invoices as tax law requires.
This website
This site sets no cookies and runs no analytics or tracking. Your account on this site keeps its own key and its sign-in in your browser’s storage, for this site alone. The checkout page runs Paddle’s script in a sandbox that keeps it away from that storage, and Paddle’s checkout is Paddle’s, under its privacy policy.
The phone app and the share page
The phone app, at app.anvil.foo, keeps its own key and its sign-in in your browser’s storage, for its address alone. When you choose the Preview channel in its settings, it sets one cookie, anvil-channel, which tells our servers to send that channel’s version of the app. A guest’s share page, at share.anvil.foo, sets the same cookie when the computer it reaches is on the Preview channel. The cookie says nothing else, goes only to the address that set it and lasts up to 400 days; choosing Stable removes it.
Children
Anvil is not meant for anyone under 16, and we don’t knowingly keep data about children.
Changes
When this policy changes, the date at the top of this page changes with it, and we tell you by email before a change that matters to you takes effect.