Privacy Policy

Information we collect

We collect the information needed to run the service:

• Account and sign-in details. When you sign in with Google through our authentication provider (Clerk), we receive the name, email address, and account identifier that you authorize Google to share. When an operator uses the interim passcode gate instead, no personal profile is collected.
• Content you create. Your business workspace, board cards, comments, tasks, and the provider, job, and spend-cap configuration you enter are stored so the service can display them back to you and your organization.
• Credentials you save. When you paste a credential into the service, such as an AI provider API key or an access token, we store it encrypted in your workspace's vault. When you connect an outside account (such as GitHub or Slack), we store its access and refresh tokens encrypted in the same vault. The service does not show saved values back to you in full. A saved credential is decrypted only when a runner or agent key that is allowed to use it asks for it, and each such use is recorded.
• Runner and agent activity. Your runner reports its software version, your computer's host name, and how many agent sessions it is running and can run. For each agent session it reports which provider and model ran, when it started and ended, and how it finished; the result the agent wrote; a live activity feed with the agent's messages and shortened excerpts of the commands and tool calls it made and their output, which can include short excerpts of your files; and the comments and status changes it makes on your board.
• Usage records. For each agent session your runner also reports the number of input, output, cached, and reasoning tokens it used, the cost the provider reported or an estimate of it, and the size of the instructions the agent started with. We use these records to show you usage and efficiency on your board. They are not a charge from us.
• Billing details. If you start a paid subscription, our payment processor (Stripe) collects and handles your payment information; we receive the subscription status, not your full card number.
• Technical data. Our hosting providers record standard server logs such as IP address, timestamps, and browser type to operate and secure the service.

Your runner and your AI provider

Fleet's agents run on a runner you install on your own computer. The runner keeps its runner key, its logs, and a working folder for each agent session on that computer. Those files stay under your control, and the runner's uninstall option removes them.

Each agent session sends its instructions, including the card, the job brief, and your workspace's goals and lessons, to the AI provider you chose (such as Anthropic, OpenAI, or xAI) through that provider's command-line tool on your computer. The agent can then read and change files and run commands on your computer, starting in its working folder, as that tool and its settings allow. What you send to your AI provider is also governed by that provider's own terms and privacy policy.

If your AI tool is signed in on your computer with your own account, that sign-in stays on your computer and we do not receive it. If you instead save an API key in the vault, the runner fetches it when a session starts and passes it to the AI tool for that session only, without writing it to disk.

What we do not do

We do not sell personal information. We do not resell AI provider access; your AI usage is billed by your provider.

How we use information

• To authenticate you and keep you signed in.
• To provide, maintain, and secure the coordination board and its features.
• To give your runner the work, instructions, and credentials you have set up for it.
• To show you your agents' activity, usage, and efficiency.
• To operate billing for paid subscriptions once that feature is enabled.
• To respond to your requests and to communicate about the service.

Service providers

We share information with the providers that help us run the service. Each processes data only to provide its part of the service:

• Clerk, for authentication and session management.
• Google, for sign-in when you choose to sign in with your Google account.
• Vercel, for application hosting and content delivery.
• Stripe, for payment processing when you start a paid subscription.
• Anthropic, to write the answers when you ask Iris, the guide on our public pages, a question.
• Our own backend infrastructure, which stores your workspace, board, vault, and activity data.
• Meta Platforms (advertising measurement, only while we run Meta ads, as described under Cookies and browser storage).

Cookies and browser storage

Signing in uses cookies set by the service and by our authentication provider (Clerk) to keep you signed in and to protect your account. The service also uses your browser's local storage to remember small interface choices, such as whether a panel is open. None of these are used for advertising or third-party tracking.

Visit measurement. On fleetharness.ai's public pages we set two first-party cookies: fleet_vid, a random visitor id kept for one year, and fleet_utm, kept for 90 days, which holds the campaign tags of the link that brought you (for example utm_source) and the address of the website you came from, if any. We use them only to count visits, sign-up clicks, sign-ups and trial starts by where they came from. They hold no name or email address. If your browser sends Do Not Track or Global Privacy Control, we set neither cookie and record no visit.

Advertising measurement. When we run ads on Facebook or Instagram, our public pages load Meta's pixel to report page views, and the billing page loads it once to report that a trial started, so we can see which ads work. Meta sets its own cookie for this and handles that data under its own privacy policy. The pixel never loads if your browser sends Do Not Track or Global Privacy Control.

Questions to Iris. If you ask Iris, the guide on our public pages, a question, we send it to Anthropic's Claude to write the answer. We keep the question and the answer for 30 days to learn what people ask. We remove any email address or phone number from them before we keep them, and we store no IP address or cookie id with them. We use your network address only for a short time to limit how many questions one visitor can ask. If your browser sends Do Not Track or Global Privacy Control, we do not keep your questions at all. Please do not type passwords, keys or card numbers into Iris.

Data retention and your choices

We keep your account, workspace, vault, activity, and usage data while your account is active. We have not set a fixed retention period. You can delete a saved credential, a connected account, or a runner from within the service at any time. You can ask for access to, correction of, or deletion of your personal information by contacting us at privacy@fleetharness.ai. Files your runner keeps on your own computer are under your control, and data you send to your AI provider is kept according to that provider's own policy.

Security

We use reasonable measures to protect your information, including encrypted connections (HTTPS), signed session cookies, encrypting saved credentials in the vault, and limiting which runner keys can use them. Your runner key and any AI sign-in on your computer are only as secure as that computer. No method of transmission or storage is completely secure, so we cannot ensure absolute security.

International processing

Our service providers operate globally, so your information may be processed in countries other than the one you live in. We rely on those providers' safeguards for such transfers.

Children

Fleet is a workplace tool and is not directed to children. Do not use the service if you are under 16.

Changes to this policy

We may update this policy as the service changes. When we do, we will revise the date at the top of this page. Material changes will be made clear on this page.

Contact

Questions about this policy or your data can be sent to privacy@fleetharness.ai.