Privacy

Where your data actually sits.

Our three products store data in three different places, so one blanket statement would be useless — or dishonest. This page goes product by product: what is stored, where it is stored, what leaves your device, and what still passes through us.

Last updated 2026-10-10

The one thing that is true across all three: we do not sell your data, we do not use your content to train models, and we do not run advertising.

Beyond that, read the section for the product you use. Where a product routes something through our infrastructure, it says so plainly rather than hiding behind "we care about your privacy".

AgentLoom

desktop app · open source (AGPL-3.0) · nothing of ours in between
API keys
Stored in your operating system's keychain, on your machine.
Conversations
The conversation database stays on your own disk. Message content included in a request to the model is sent to the model provider you chose.
Your code
Agents work directly in your own repositories, in place. AgentLoom's own bookkeeping never touches your working tree.
Our servers
AgentLoom runs no server on the internet. The only listeners it starts are loopback-only helpers on your own machine.
What leaves your device
Requests to the model provider you chose — and, if you turn on web search, your search queries go to the search backend you configured (DuckDuckGo, or Brave/Exa with your own key). Nothing routes through us.

ProtoLens

web service · GitHub is the access boundary
Repository access
Controlled entirely by your own GitHub App installation. You choose which repositories ProtoLens can see, and you can revoke it in GitHub at any time.
Prototype files
Fetched by repository, ref and path — ProtoLens does not clone your repositories or run arbitrary code from them, does not install your dependencies, and does not run your application backends.
Review comments
Stored as Markdown-oriented review data associated with the prototype being reviewed, and exportable as Markdown at any time.
Rendering
HTML review rendering is sandboxed. JavaScript execution and form submission are intentionally constrained.
Review links
A review URL is the sharing boundary. Private prototype files are not republished as open public assets outside that model.

Loomnote

runs in your browser · notes live in your own GitHub repo or S3 bucket
Your notes
Plain Markdown notes live in your own GitHub repository or S3-compatible storage. Hosted publishing can process selected content as described below.
Taking your data with you
Retrieve GitHub files with git clone, or download them using your S3-compatible storage tools.
AI connections
MCP is configured separately. Content sent to an AI provider depends on the client, permissions and tools you use; the production Web AI access panel is disabled.

What still passes through us

  1. The front-end JavaScript is served by us. Whatever we ship, your browser runs — this is not a zero-trust setup.
  2. GitHub note reads and writes go straight from your browser to api.github.com. Only the OAuth token exchange passes through an edge Worker whose response is set to no-store; the application does not persist or actively log the token.
  3. S3-compatible storage is written straight from your browser to the bucket you configure.
  4. Your browser cache holds plaintext — on your own device.
  5. For hosted WeChat operations, article text, images and necessary credentials are processed by our Worker and gateway and sent to WeChat as required. User-owned storage does not mean end-to-end encryption or GDPR certification.

POD Studio

web app on its own subdomain · an invitation code is needed only for AI generation
Cookie
Only after you activate an invitation code, the application subdomain sets a host-only (not shared across subdomains) cookie __Host-pod_session with HttpOnly, Secure and SameSite=Strict, valid for at most 7 days (shorter if the invitation expires sooner). It is used only to keep the invitation session, not for advertising or cross-site tracking.
Content sent to Google
Only when you use an invitation code and confirm your design request does the server send the brief you confirmed (subject, style, palette, exclusions) to the Google Gemini API to generate an image. The fixed samples send nothing to Google.
Image storage
Generated images are stored in private Cloudflare R2 storage with no public link; only a browser holding that invitation’s session can read them.
Retention
Job records (your request text) and generated images are kept for 30 days and then removed. The cleanup is run by hand, about once a week, and is not on an automatic schedule, so content can stay slightly longer than 30 days before it is removed. A content-free record (job id, status, timestamps, the invitation’s usage count) is kept to enforce each invitation’s usage limit and prevent double charging; it cannot be used to reconstruct your request or image.
Other technical records
On failed activation attempts the server log records only a short hash of the IP address; the invitation code itself is not stored in plain text, only its SHA-256.
Deletion
To have your jobs and images deleted earlier, contact panda@myagenthubs.com.

This website

Questions, or a request about your data

Write to panda@myagenthubs.com. For AgentLoom and Loomnote, most of "your data" is already in your own keychain, disk or repository — you can inspect or delete it without asking us. For ProtoLens, revoking the GitHub App installation cuts off access immediately.