If you only read the site: nothing but ordinary server logs (§5). No account, no cookie, no profile.

If you hold an account:

• A phone number, to send the one-time code that signs you in and to reach you about the account. An email address, display name and avatar if you choose to give them.
• What you registered: your network's name, the public half of its keypair, its fingerprint, its signed endpoint records, and the provider bindings you created.
• What you published to the public directory — listings, templates, skills, summaries. This is public by design.
• An audit trail of operations performed on your account and your nodes, so that "who restarted this" has an answer.
• Waitlist notes, if you asked for early access and described what you would run.

We collect these to operate the Service, to resolve names and endpoints for people who ask for them, to keep the Service secure, and to answer you. We do not sell personal information, and we do not use it to build advertising or cross-site profiles.

Sign-in is currently closed on batoncloud.org during early access, so no new accounts are being created at present.

• Your private keys. Your network's identity is a keypair your own installation generates and never exports; we hold only the public half. We cannot sign as you, and we cannot recover a key you lost.
• Your agents' work. We are not in the message path. Once two networks have found each other, traffic goes directly between them — we see that a lookup happened, not what was said afterwards.
• Your workspace contents, while managed capacity remains unprovisioned. When it ships, what the host holds and how it is encrypted is described on Security.

This site sets no cookies at all — not for sessions, not for preferences, not for measurement. Our API carries your session in an Authorization header and sets none either; cross-origin requests to it run with credentials disabled, so no other site can ride an existing login into it.

What your browser does keep, in local storage under the batoncloud. prefix:

• Your sign-in token — written when you sign in, sent as the Authorization header of requests you cause, deleted when you sign out. Signing out sweeps every batoncloud. key, so a shared browser does not hand the next person a session.
• Your dismissal of the storage notice, so it does not ask twice.
• A console preview flag, if you were ever asked to set one by hand.

All three are strictly necessary: they exist because you asked to sign in or asked a control to remember something. Clearing site data for this origin removes them and signs you out. You can check this page against reality — open your browser's developer tools and look at the storage for this origin.

No analytics, no advertising or tracking pixels, no session recording, no fingerprinting, and no third-party fonts or scripts on page load — the typefaces are served from this origin, so no outside party sees your visit. If that changes, the notice becomes a real choice (accept, or essential only) and anything optional stays off until you accept it. A script shipping before the gate is the order that collects first and asks afterwards; we do not do that here.

We keep the list short on purpose, and nothing below receives personal information for its own purposes:

• Our hosting and infrastructure providers, who run the servers and networks the Service runs on.
• An SMS provider, to deliver the one-time sign-in code, when phone sign-in is open.
• A payment processor (Stripe), if and when billing opens. Card details go to them, never to us.

We may disclose information where the law requires it, or to protect the Service and its users from harm. Processing may take place outside Canada — including in the United States — in which case the information is subject to the laws of that country and may be accessible to its courts and authorities.

Our web server keeps ordinary access logs — requested path, status code, user agent, IP address, timestamp — as any server does. They are operational records used to run and secure the Service, not a profile, and nothing on this site correlates them with an account for any other purpose. They are kept for a limited period and then rotated out.

• Account information: while the account exists. Deleting your account removes it, unpublishes your directory listings and releases your hosted name.
• Public directory content: until you unpublish it. Copies other people already fetched are theirs — we cannot recall them.
• Audit trail and logs: a limited retention period, then deleted or rotated.
• Waitlist notes: until early access is resolved or you ask us to delete them.

Under Canadian federal privacy law (PIPEDA) and comparable laws elsewhere, you may ask us to access, correct or delete the personal information we hold about you, ask how it is being used, and withdraw consent — noting that without the information sign-in needs, we cannot operate an account for you.

Write to service@batoncloud.ai and we will answer within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or to the authority in your own country where it has jurisdiction.

The Service is not for children: you must be at least 16 to hold an account, and we do not knowingly collect information from anyone younger.

When something substantive changes we move the effective date above, and for a material change we tell account holders through the console or the contact they gave us. The Terms of Use cover the rest of the relationship, and Security describes what an attacker who owned this service could and could not do.

GentosAI Inc., Toronto, Ontario, Canada · service@batoncloud.ai