Privacy Policy

Last updated: 24 July 2026

9th Protocol ("we", "us") provides an agentic coding tool (CLI, VS Code extension, and web dashboard). This policy explains what we collect, why, and what we never touch.

What we collect

• Account data: email, name, hashed password, or your OAuth identity (Google, GitHub, or LinkedIn) if you sign in that way. We receive only your basic profile (name, email, avatar), never your contacts, repositories, or posts.
• Usage metering: per-request token counts, model used, and computed cost, recorded to operate billing and rate limits.
• Connector tokens: if you connect GitHub or Vercel, we store those tokens encrypted (AES-256-GCM) and release them only to your own authenticated agent sessions.

What passes through (but is not kept)

When your agent works, prompts (which may include code excerpts and file contents from the project you point it at) are relayed through our API to the model provider you selected (via OpenRouter). We do not store prompt or completion content; only the token counts described above are retained.

What never leaves your device

• Your project files and repositories, since the agent runs locally.
• Your Obsidian-style memory vault, 9P.md files, skills, and MCP configuration.
• On the BYOK plan, your OpenRouter API key, since calls go directly from your machine.

Third parties

Model requests are fulfilled by OpenRouter and its upstream model providers under their own terms. Payments (when enabled) are processed by Stripe and Dubu Pay, so we never see full card details. We do not sell personal data, run ads, or share data with brokers.

Retention & deletion

Account and metering data are kept while your account exists. You can delete your account and all associated data at any time. See data deletion.

Security

Passwords are bcrypt-hashed, refresh tokens are stored hashed, connector tokens are encrypted at rest, and all traffic uses TLS.

Contact

Privacy questions: support@9thprotocol.com.