1. Overview
AWO Commander ("the Service") is a local-first AI agent management platform. By design, virtually all user data stays on your device. We do not operate a central database of user activity, sessions, or prompts. This policy describes the narrow set of data we do handle and your rights over it.
2. What Stays On Your Device — 100% Local
The following data is stored exclusively in your browser's localStorage and never transmitted to AWO servers:
| Data | Storage | Location |
|---|---|---|
| API keys (OpenAI, Anthropic, Gemini, etc.) | localStorage | ● LOCAL ONLY |
| Agent fleet configuration & memory | localStorage | ● LOCAL ONLY |
| Session logs & mission history | localStorage | ● LOCAL ONLY |
| Knowledge graph & discoveries | localStorage | ● LOCAL ONLY |
| Coding Supervisor sessions | localStorage | ● LOCAL ONLY |
| License key you received | localStorage | ● LOCAL ONLY |
| App preferences & theme | localStorage | ● LOCAL ONLY |
Clearing your browser's localStorage removes all of the above permanently. AWO has no copy.
3. What We Hold Server-Side
3.1 License Records — When you purchase AWO Commander via PayPal, our server receives an IPN from PayPal containing: your email, name, amount paid, and PayPal transaction ID. This data is stored solely to issue and validate your license key. It is not shared, sold, or used for any other purpose. Retention: for the duration of your subscription.
3.2 Admin API Keys — API keys assigned to agents by an AWO administrator are stored server-side only. They are never accessible via the browser.
3.3 Coding Supervisor Files — Files generated and saved via /api/save-coding-file are written to the coding_output/ directory on your own server instance. AWO's hosted service does not retain these files.
3.4 Server Logs — Standard HTTP request logs (timestamp, path, status code — no request bodies) are retained for 30 days for debugging, then purged automatically.
4. LLM Proxy
When agents call external AI models, your prompts pass through our CORS proxy to reach providers like OpenAI, Anthropic, or Google. AWO:
| Action | Status |
|---|---|
| Log or store prompt content | ✕ Never |
| DLP filter on all responses | ✓ Always — scrubs emails, card numbers, credentials, SSNs |
| See your API keys | ✕ Never — keys injected server-side, never returned to browser |
5. Your Rights (GDPR / CCPA)
Email privacy@awocommander.com with your purchase email to receive a copy of your license record within 30 days.
Request deletion at any time. We erase within 72 hours and confirm by email. Note: erasing your license record deactivates your key.
Export all browser-local data via AWO Commander → Export Session (downloads a JSON file directly to your device).
Revoke AWO's Google OAuth access at any time via myaccount.google.com/permissions.
Self-service erasure endpoint:
curl -X POST https://awo-commander-636344114282.us-east1.run.app/api/license/delete \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com"}'6. Security
| Measure | Implementation |
|---|---|
| API key encryption | AES-256-GCM, PBKDF2 (100,000 iterations), browser-only |
| Transport | TLS 1.2+ enforced via Cloud Run / Cloudflare |
| Authentication | Google OAuth 2.0 PKCE + Identity-Aware Proxy |
| DLP | Regex scrubbing of PII from all proxied LLM responses |
| Security headers | HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy |
7. Third-Party Services
| Service | Purpose | Their Privacy Policy |
|---|---|---|
| Google OAuth | Authentication | policies.google.com/privacy |
| PayPal | Payment processing | paypal.com/privacy |
| OpenAI / Anthropic / Google | LLM inference (your keys) | Per provider |
| localhost.run | Optional SSH tunnel (no account, no data stored) | localhost.run |
AWO does not sell data to any of these parties. We are a data processor, not a data broker.
8. Children
The Service is not directed to individuals under 18. We do not knowingly collect data from minors.
9. Changes to This Policy
Material changes will be communicated to your registered email address at least 30 days before taking effect. The "Effective Date" at the top of this page reflects the most recent revision.
10. Contact
Privacy Officer: privacy@awocommander.com
Response time: within 72 hours for erasure requests · within 30 days for access requests
Mailing address: AWO Commander · awocommander.com