privacy policy

1. introduction

Tridant Inc., a Delaware corporation ("Tridant," "we," "our," or "us"), operates owlette, a cloud-connected process management and remote deployment system. this privacy policy explains how we collect, use, disclose, and safeguard your information when you use our service.

owlette is an operations tool: you install an agent on machines you own or administer, and we process data from those machines so you can monitor and control them. this policy covers both the information you give us about yourself and the information the agent reports from your machines.

by using owlette, you agree to the collection and use of information in accordance with this policy.

2. information we collect

account and authentication information

when you create an account or secure it, we collect:

• email address
• name (first and last)
• password (stored securely using industry-standard hashing, managed by Firebase Authentication)
• two-factor authentication secrets (encrypted at rest) and backup codes (hashed)
• passkey / WebAuthn credentials (public key, credential ID, and device metadata — we never receive your biometrics or device PIN)
• API keys you create (stored as a hash plus a short non-secret prefix so you can identify them)
• device-trust records when you choose to remember a device for two-factor authentication

machine data

when you install the owlette agent on a machine, we collect:

• machine hostname and unique identifiers
• operating system and hardware information (CPU model, GPU, disk, memory)
• system metrics (CPU, memory, disk usage, GPU temperature)
• process information (names, paths, command lines, running status)
• agent heartbeat and online/offline status
• agent and application log output that you or the agent send to us for diagnostics

screenshots

owlette can capture screenshots of a managed machine's desktop, either when you request one from the dashboard or as part of a diagnostic workflow. these images are uploaded to our cloud storage and shown to users who have access to that machine's site.

a screenshot captures whatever is on that desktop at that moment, which may include content unrelated to owlette. you are responsible for ensuring that capturing screenshots of your machines is lawful and appropriate in your environment — including notifying anyone who uses those machines. screenshot capture is initiated by you or your team, never by us.

hoot (AI assistant) data

if you use hoot, our AI assistant, we collect and store:

• your chat messages and the assistant's responses
• the machine and site context attached to a conversation
• records of tool calls the assistant made and their results
• your LLM provider API key, encrypted at rest (see section 8)

deployment content

when you distribute projects to your machines, we store the files and manifests you upload. we treat this content as yours; we do not inspect it except as required to operate the service (for example, computing content hashes for deduplication).

usage and technical data

we automatically collect:

• actions performed (process starts, stops, deployments, configuration changes)
• audit and activity records identifying which user performed a privileged action
• event logs (errors, crashes, status changes)
• IP addresses and request metadata, used for session management, rate limiting, and abuse prevention
• error and performance diagnostics, including stack traces, collected via our monitoring provider
• timestamps of activities

3. how we use your information

we use the collected information to:

• provide and maintain the owlette service
• monitor machine health and process status
• execute remote commands and deployments
• send alerts and notifications
• authenticate users and secure accounts
• detect, investigate, and prevent abuse, fraud, and security incidents
• maintain audit records of privileged actions
• improve and optimize our service
• respond to support requests
• comply with legal obligations

we do not sell your personal information, and we do not use your data or your machines' data to train machine learning models.

4. legal bases for processing (EEA/UK)

if you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases under the GDPR / UK GDPR:

• performance of a contract (Art. 6(1)(b)) — to provide the service you signed up for: account management, machine monitoring, command execution, and deployments.
• legitimate interests (Art. 6(1)(f)) — to keep the service secure and reliable: abuse prevention, rate limiting, audit logging, and error diagnostics. we balance these interests against your rights and limit the data used accordingly.
• consent (Art. 6(1)(a)) — for optional features you switch on, such as hoot and screenshot capture. you can withdraw consent at any time by disabling the feature.
• legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with applicable law.

where you use owlette to manage machines used by other people (for example, your employees or contractors), you are the data controller for that personal data and we act as your processor. you are responsible for having a lawful basis for that processing and for informing those individuals.

5. data storage, location, and security

owlette is operated from the United States. our primary database (Google Cloud Firestore) is hosted in the nam5 multi-region, which spans data centers in the United States. application hosting, object storage, caching, and monitoring are likewise operated in or from the United States. content delivery and DNS are provided by a global network, which may cache non-personal static assets closer to you.

we implement security measures including:

• encryption in transit (TLS/HTTPS, with HSTS enforced)
• encryption at rest (AES-256) for stored data
• application-level encryption for particularly sensitive fields, including two-factor secrets and stored LLM API keys
• encrypted, HTTP-only session cookies and server-side route protection
• optional two-factor authentication and passkey sign-in
• secure authentication tokens with automatic expiration
• machine-specific encryption keys for agent credentials stored on your machines
• role-based access controls and database-level authorization rules
• a content security policy and related browser hardening headers

while we strive to protect your information, no method of transmission over the internet is 100% secure. we cannot guarantee absolute security.

6. data retention

we retain data as follows:

• account data: for as long as your account is active. when an account is deleted we immediately revoke its API keys, transfer any owned sites to a successor, clear its pending machine commands, and mark the account deleted so it can no longer sign in or reach your data. the underlying user record is then retained in a deleted state for audit and security purposes rather than erased outright — if you want the record itself erased, ask us and we will process it as an erasure request (see section 9).
• screenshots: automatically deleted 30 days after capture. the agent additionally keeps only the most recent 20 captures per machine in its history.
• queued machine commands: pending commands expire after 1 hour; completed command records are removed after 24 hours.
• machine metrics: automatically deleted 400 days after collection.
• event logs: automatically deleted 400 days after the logged event.
• process and configuration data: until the machine is removed from your account.
• hoot conversations: until you delete them. deleting a conversation removes it from every listing and hides it from the interface; the underlying record is retained in a deleted state. ask us if you need it erased.
• deployment content: until you delete the associated release or roost.
• audit and security logs: retained for as long as needed to investigate incidents and meet legal obligations.

you may request deletion of your data at any time — see section 9.

7. third-party services and subprocessors

we use the following providers to operate owlette. each processes data only as needed to provide its function, and each is bound by its own data processing terms.

we may update this list as our infrastructure changes. material changes will be reflected here along with an updated "last updated" date.

8. AI features and your LLM provider

hoot is optional and off unless enabled for your site. hoot uses your own API key for an AI provider (currently Anthropic or OpenAI) — we do not provide a shared key and we do not send your data to any AI provider unless you have supplied a key and enabled the feature.

when hoot is enabled and you send a message:

• your key is stored encrypted at rest and decrypted server-side only to make the request
• your message, the conversation history, and relevant machine context (such as system metrics, process lists, and command output) are transmitted from our servers to your chosen AI provider
• the provider processes that data under your account and its own terms — your agreement with that provider governs how they retain and use it
• you may optionally provision your key down to a machine so hoot can run locally on that machine; in that case the key is re-encrypted with a machine-bound key on your hardware

you can remove your stored key or disable hoot at any time from settings. doing so stops all further transmission to the AI provider; data already sent is subject to that provider's retention policy, not ours.

9. your rights

all users

regardless of where you live, you can:

• access your account data through the dashboard
• update or correct your information
• delete your account and associated data
• export your data — contact us and we will provide it in a portable format

EEA and UK residents (GDPR / UK GDPR)

you have the right to:

• access the personal data we hold about you
• rectify inaccurate or incomplete data
• erasure of your data ("right to be forgotten")
• restrict or object to processing, including processing based on legitimate interests
• data portability — receive your data in a structured, machine-readable format
• withdraw consent at any time, without affecting processing carried out before withdrawal
• lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office)

we are not subject to automated decision-making or profiling that produces legal effects concerning you.

California residents (CCPA/CPRA)

you have the right to:

• know what personal information is collected, used, and disclosed
• request deletion of your personal information
• correct inaccurate personal information
• opt out of the sale or sharing of personal information (we do not sell or share your data)
• limit the use of sensitive personal information
• non-discrimination for exercising your privacy rights

how to exercise your rights

email support@owlette.app from the address on your account, or contact us as described in section 15. we respond to requests within 30 days. we may need to verify your identity before acting, and we will tell you if we need an extension permitted by law.

10. international data transfers

owlette is operated from the United States. if you access the service from the EEA, the UK, or elsewhere outside the United States, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures such as encryption in transit and at rest. our providers listed in section 7 are engaged under equivalent terms. you can request further information about these safeguards using the contact details in section 15.

11. cookies and tracking

owlette uses cookies and similar technologies for authentication and session management. these are essential for the service to function and cannot be disabled while using owlette.

we use Firebase Authentication together with an encrypted session cookie to maintain your login. if you choose to remember a device for two-factor authentication, we set an additional cookie for that purpose. we do not use tracking cookies for advertising and we do not run third-party advertising or analytics trackers.

12. security incident notification

if we become aware of a personal data breach affecting your information, we will notify you without undue delay and, where required, within the timeframes set by applicable law — including notifying the relevant supervisory authority within 72 hours where the GDPR requires it. our notice will describe what happened, the data involved, and the steps we are taking.

to report a suspected vulnerability or security issue, email support@owlette.app with "security" in the subject line.

13. children's privacy

owlette is not intended for use by anyone under the age of 16. we do not knowingly collect personal information from children. if you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

14. changes to this policy

we may update this privacy policy from time to time. we will notify you of any changes by posting the new privacy policy on this page and updating the "last updated" date. for material changes, we will also notify account holders by email.

we encourage you to review this privacy policy periodically for any changes.

15. contact us

if you have any questions about this privacy policy or our data practices, please contact us at:

email: support@owlette.app

company: Tridant Inc., a Delaware corporation

principal place of business: California, USA