Data handling
What a cloud workspace stores, what is never stored, and what deleting your account does. Each line names the code that enforces it.
What we store
| What | Why | How long |
|---|---|---|
| Account email | Sign-in and billing correspondence | Until you delete the account |
| Workspace filesystem | It is the workspace | While the workspace exists, plus the retention period after cancellation shown on the pricing page |
| Sealed transfers (patches and the files you chose) | To restore your work in the workspace and to bring it home | Until the workspace and account they belong to are deleted |
| Usage records (seconds per workspace) | To meter hours and produce an invoice | As long as tax law requires, with your identity removed after deletion |
| Secrets you add on Account → Secrets | So a workspace can clone your repository or reach your own services | Encrypted at rest; until you remove them or delete the account |
| Device list | So you can see and revoke what has access | Until revoked or the account is deleted |
What is never stored
- Your provider API keys. The secrets store refuses names that look like provider keys, and nothing copies an agent’s credentials from your machine. When you sign an agent in inside a workspace, the provider creates that credential on that machine: it never reaches our servers, and the directories holding it are excluded from anything the workspace captures or brings home. Deleting the workspace deletes it.
- Credential files.
.ssh,.aws,.env, key material and the like are refused when a transfer is built. This is not a filter you can turn off. - Prompt text in analytics. Usage counts are counts. The app's telemetry contract lists the fields that may never appear, and a test fails if one does.
- A plaintext copy of a secret. Secrets are decrypted in exactly one place — into a file inside your own workspace, readable only by the workspace user — and are never returned by any API after you save them.
Where the workspace runs
Workspaces run on Freestyle, a virtual-machine provider. Our operator key for that provider never leaves our servers: the desktop app, the terminal client and the workspace itself only ever hold credentials scoped to one workspace and one device, minted by us and revoked by us.
Deleting your account
Account → Delete account. It is irreversible and confirmed by typing your own email address. It is refused, with the fix named, while a subscription is still active (cancel first), a workspace is still running (stop it first) or usage has not settled yet (a few minutes).
Then, in this order: every workspace is destroyed and every scoped credential revoked; your sealed transfers are removed from storage; your devices, sessions, secrets and identity rows are erased; your email and name are cleared from the account row. Billing records survive without your identity for as long as the law requires them.
Local Harmony is unaffected. Nothing on your computer is touched.