detachbox
Menu

Features

Browser terminalProjectsTerminals modeNotificationsPhone and voiceVoice and assistantsLimits boardRotationAgentsDockerPreviewsFiles and imagesVault

Use cases

Overnight refactorsParallel agentsPR factoryAgencies and freelancersLong-running jobsAgents from your phoneTeam subscription limitsStudents and indie hackersDocker services
DocsSecurityEnterprisePricingLog in
Get my Compute

Privacy Policy

Last updated: October 14, 2026

This policy explains what personal data detachbox collects, what we use it for and how you control it. The service is operated by AppMaster Inc, DBA DetachBox. Write to support@detachbox.com with any privacy question or request.

Operator
AppMaster Inc, DBA DetachBox
Registered address
111 Pier Ave STE 100, Hermosa Beach, CA 90254, United States
Governing law
State of California, USA; courts of Los Angeles County

1. What we collect

  • Account data: your email address and name; your Google account picture if you sign in with Google; the public key of your passkey if you use one; a hash of your password if you sign in with email and a password.
  • Billing data: your Stripe customer and subscription identifiers, plan, payment status and invoices. Card details go to Stripe and never reach our servers.
  • Compute data: your Compute's name, plan, status and resource usage (CPU, memory, disk, network); your projects' names and folders; and for each open terminal, its project, agent, the account it runs on, status and the time it started.
  • Connected accounts and keys: for each Codex or Claude account you connect, the provider's account ID, email, plan name, OAuth tokens and readings of your usage limits; for each API key you add, its provider and the key, encrypted.
  • Notification data, if you turn notifications on: the browser push subscriptions you register, your Telegram chat if you link it, your quiet hours, and the notifications we send. A notification about an agent carries the project and tab names and a line of that tab's terminal output.
  • Vault data, if you connect Sallyport Cloud: the connection's tokens, the Sallyport agent we create for each project and that agent's token.
  • Technical data: IP addresses and the approximate location our CDN derives from them (country, region, city), your browser's user agent and time zone, a random identifier your browser keeps for detachbox (it tells your sign-ins apart and lets us check an invite sent from the inviter's own browser), request and terminal connection logs, and error reports.
  • Messages you send us, for example to support or abuse.

2. Your Codex and Claude tokens

When you connect a Codex (ChatGPT) or Claude account in the dashboard, OpenAI or Anthropic issues OAuth tokens for it: an access token and a refresh token. We store both encrypted in our database, with a key held only by our server.

We use them for two purposes. First, to read your usage limits from the provider and show them on your limits board. Second, to put a current access token into the projects whose agents run on the account, so the command-line tools on your Compute can work. Our server renews the access token with the refresh token before it expires.

The refresh token never leaves our server and is never written onto your Compute. Anyone with access to your Compute, including an agent running there with sudo, can read the access token on it, so give access to your Compute only to software you control.

You can disconnect an account at any time. We then delete its tokens and usage history from our database and remove the credential files from your Compute; we do not revoke the tokens with the provider, so sign out there to end the provider's session as well. Deleting your detachbox account does the same for all your connected accounts.

3. What is on your Compute

Files, databases, projects and programs on your Compute are your content. Our staff do not browse them. We access a Compute's contents only when you ask for help, when we investigate a security incident or abuse, or when the law requires it.

4. Assistants you connect

You can connect an AI assistant, such as ChatGPT, Claude or Grok, to your detachbox account. You do it yourself: the assistant asks, and you approve it on a detachbox page that lists everything it will be able to do. You can also create an MCP key for an assistant that signs in with a key instead.

What the assistant receives

When the assistant works with detachbox for you, it receives what its requests return:

  • the names of your projects and terminals, their states and how long they have been in them;
  • what your coding agents are doing: the questions they ask with their choices, their last messages and their recent steps, such as a command they ran or a file they edited;
  • the last lines shown on a terminal's screen, and the addresses of its previews;
  • the labels of the provider accounts your agents run on (an account's email address when it has no label), how much of each usage limit is used and when it resets;
  • the contents of any file you ask it to read;
  • events about your agents: an agent waits for you, finished its turn or stopped, with its question or the last thing it said.

Screens and files

What a terminal shows and what a file holds is whatever your programs and agents wrote there. The assistant receives a file's contents when it is asked to read the file, or when the file is shown on a terminal's screen. What the assistant reads is not recorded in your activity log.

Who processes it

This data goes to the assistant you connected and to its provider, for example OpenAI, Anthropic or xAI, which handles it under its own terms and privacy policy. The assistant acts as you: what it does in your terminals is done under your account.

What we keep

  • For each connection: the app's name, website and logo as the app states them, the address it returns you to after you approve it, when you connected it and when it last worked. For an app that registered itself with us, we also keep its registration and the network address it registered from.
  • Access tokens, refresh tokens and MCP keys only as one-way fingerprints, never the tokens or keys themselves; for an MCP key, also its last four characters, so you can tell your keys apart.
  • In your activity log: each change an assistant makes, as yours, with the app it came through, the terminal and the kind of action. The text of the messages and tasks it sends is not recorded, only its length; for the keys it types, the log keeps the names of keys such as Enter or Escape and a mask in place of any text.
  • A journal of your agents' events (an agent waits, finished or stopped, with its question or last line).
  • For an assistant that subscribes to those events: the address its platform gave us to deliver them to, a signing secret stored encrypted, and the state of its deliveries.
  • The emails we send you when an assistant is connected or an MCP key is created, in our email log.

How long we keep it

  • Access tokens last 1 hour and refresh tokens 30 days, each refresh replacing the one used; their fingerprints are deleted a day after they end.
  • A connection's record is deleted 30 days after you disconnect it or it runs out.
  • A request to connect lasts 10 minutes and is deleted a day after it expires. An app registration that never completes a sign-in is deleted after a day; one in use is kept.
  • The event journal keeps 7 days.
  • An event subscription is deleted a day after it expires, after 3 days of failed deliveries, or as soon as its connection ends.
  • Activity log entries are kept 2 years, like the rest of the activity log, and the email log 90 days.

Your controls

  • Disconnect an app or revoke a key on the Assistants page of the dashboard: its access and its event subscriptions end at once.
  • Changing or resetting your password, or signing out your other devices, closes every connection and key.
  • We email you each time an assistant is connected or an MCP key is created, with the app's address or the key's last characters and the time, so you can spot one you did not make.
  • Deleting your detachbox account deletes its connections with their tokens, its keys, its event journal and its subscriptions. An app's registration with us belongs to the app, not to an account, and is kept or deleted as described above.

5. Why we use your data

  • To provide the service you signed up for: run your Compute, sign you in, show your limits and bill you (performance of our contract with you).
  • To keep the service secure and stop abuse, using resource and network statistics and logs (our legitimate interest).
  • To send you service emails: Compute created, payment problems, planned maintenance, a reset limit, a dead connected account (performance of contract).
  • To keep accounting records (legal obligation).

6. Who processes it for us

  • Stripe: payments and invoices.
  • Google: sign-in with Google.
  • Amazon Web Services: delivery of our emails.
  • Cloudflare: DNS and the network edge in front of our website and dashboard.
  • Sentry: error reports from our software.
  • OpenAI and Anthropic: when you connect an account, we exchange and refresh tokens with them and read your usage on your behalf.
  • Telegram, if you link it: delivery of your notifications.
  • Your browser's push service (for example Google, Apple, Mozilla or Microsoft), if you turn on browser notifications: delivery of push notifications.
  • Sallyport Cloud, if you connect it: the agent and token for each project, and the services your agents call through it.
  • Google Analytics, when enabled on the website: aggregated visit statistics.
  • The AI assistant you connect, and its provider: the data described in section 4, when the assistant works with detachbox for you.

7. Where it is stored

We host our servers and your Compute where we choose. The processors above may handle data in other countries under their own safeguards.

8. How long we keep it

Account data is kept while your account exists. Your projects and home folder stay on your account disk while your Compute exists. A terminal's own environment, with the packages, services, Docker data and processes in it, is deleted when the terminal ends, together with its preview addresses and shared file links. Deleting your Compute, or leaving a failed payment unpaid until day 14, erases the account disk with every project and home folder on it. Connected-account tokens and API keys are deleted when you disconnect them or delete your detachbox account. Billing records are kept as long as accounting law requires. Logs are kept only as long as we need them for security and troubleshooting. Sign-in records — IP address, approximate location, browser and device identifier — are kept while the sign-in is active and 30 days after it ends.

Assistant connections, tokens, events and event subscriptions are kept as section 4 describes.

9. Cookies

The dashboard uses a session cookie to keep you signed in. The marketing website sets no cookies of its own; Google Analytics, when enabled, sets its own. The dashboard also keeps the random device identifier described in section 1 in your browser's local storage; clearing the site's data removes it.

10. Your rights

You can ask us for a copy of your data, to correct it, to delete it or to export it. You can also object to processing based on our legitimate interest. Write to support@detachbox.com; we answer within 30 days. You can also complain to your local data protection authority.

11. Changes

We will post changes here and email you about significant ones before they take effect.