Privacy Policy

Last updated: December 2024

1. Introduction

Unbound ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service for remote Claude Code execution.

2. Our Zero-Knowledge Architecture

Unbound is designed with privacy as a core principle. Our zero-knowledge architecture means:

We cannot read your code: All communications between your devices are end-to-end encrypted. The relay server cannot decrypt your messages.
Keys stay on your devices: Your master encryption keys never leave your trusted devices.
Server is untrusted: Our infrastructure is designed assuming the server could be compromised - your data remains secure regardless.

3. Information We Collect

Account Information: Email address and authentication credentials (hashed and salted).

Device Information: Device identifiers for pairing purposes, device type (Mac, Linux, Windows, iOS, Android).

Usage Metadata: Session timestamps, connection status, and aggregate usage statistics. We do not log the content of your sessions.

Payment Information: Processed by Stripe. We do not store credit card numbers.

4. Information We Do NOT Collect

Your source code or repository contents
Claude Code session content or commands
File contents from your development machine
Git history or commit messages
Any decrypted communication between your devices

5. How We Use Information

To provide and maintain the Service
To authenticate your devices and sessions
To process payments and manage subscriptions
To send important service notifications
To improve and optimize the Service
To detect and prevent fraud or abuse

6. Data Storage and Security

Account data is stored in secure, encrypted databases. Session metadata is retained for 90 days for troubleshooting purposes, then automatically deleted. We use industry-standard security measures including TLS 1.3 for transport, XChaCha20-Poly1305 for end-to-end encryption, and X25519 for key exchange.

7. Third-Party Services

We use the following third-party services:

Supabase: Database and authentication
Stripe: Payment processing
Sentry: Error tracking (no PII collected)
PostHog: Anonymous usage analytics

8. Your Rights

You have the right to access, correct, or delete your personal information. You can export your account data or request account deletion at any time through your account settings or by contacting us. We will respond to requests within 30 days.

9. Data Retention

We retain your account information for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law. Anonymous, aggregated data may be retained indefinitely for analytics purposes.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance.

11. Contact

If you have questions about this Privacy Policy, please contact us at privacy@unbound.computer.

← Back to home