Privacy

Last updated 3 November 2026

AgentFirstStack is a free, open-source service run by StartGlobal at agentfirststack.com. This page says what we store, why we store it, and how to delete it. The source code is public, so you can check every word.

Agents don't need an account

Most use never involves a person. An agent creates a project with one request and gets an API key. For that we store:

• the project: an id, and a name or email address only if the agent sends one (we never verify or contact it);
• its API keys as SHA-256 hashes (never the keys themselves), with their names, scope, and when they were created and last used;
• a truncated hash of the network a signup came from, for 24 hours, to limit abuse.

If you sign in with Google

Signing in is optional. It lets you see the projects your agents created, manage their keys and teammates, and connect chat apps. We ask Google only for your basic profile (the openid, email and profile scopes) and store:

• your Google account id, email address, name and the address of your profile picture (we never load the picture);
• which projects you belong to, and whether you're the owner or a member;
• your sign-in sessions, as hashes of the cookie, until 30 days after you last use them;
• the apps you connect over OAuth (for example Claude or ChatGPT): which app, which project, the access you gave and when it was last used. Their tokens are stored as hashes; access tokens last 8 hours and refresh tokens 30 days;
• claim and invite links, as hashes, until they're used or expire after 7 days.

We use this only to sign you in and show you your projects. We don't sell it, share it with advertisers or use it for marketing, and we don't send you email.

Cookies

These pages set one cookie, afs_session, to keep you signed in, and a short-lived one (10 minutes) while you sign in with Google. There are no analytics or advertising cookies on them.

What's in a project

The data agents put into a project (sites and their visit statistics, tag containers and their event logs, inboxes and their mail, and the ad-platform credentials you choose to add) is stored to provide those services, and kept as each service's manual describes. For example, mail on shared @agentfirststack.com addresses is deleted after 30 days, and third-party credentials are encrypted and never shown again.

Where it's stored

On Cloudflare (Workers, D1, Durable Objects and R2), which runs the service for us. Google handles the sign-in itself under its own privacy policy.

Deleting your data

• Your account: Account > Delete my account removes your user record, memberships, sessions, connected apps and every token they issued, at once. Projects stay, because they belong to the project and not to you: their agent keys keep working, and a project with no members left becomes unclaimed again.
• A project's contents: delete sites, containers and inboxes through the API or ask your agent to, and revoke keys in the dashboard.
• Backups: the database keeps point-in-time recovery for up to 30 days, after which deleted data is gone for good.

Questions

Email privacy@agentfirststack.com. If we change this policy, we update this page and the date at the top.