Privacy

Privacy notice

Dated 2026-10-01

This is version 2. Version 1 (2026-09-28) covered only the early-access form. This version adds the hosted service and Bandwise Gate, and names the companies that process data for us. We will review it again before Bandwise is generally available, and we will change the date above when we do.

This page covers this website, the early-access form, the hosted service at app.bandwise.dev and Bandwise Gate, our Claude Code plugin and connector. The hosted service and Bandwise Gate are open only to our own team for now.

What we store

From the early-access form

When you send the early-access form, we store:

• your email address;
• your name, company, role and what you would like to use it for, if you fill those in;
• the page you signed up from, and the time you signed up;
• a salted hash of your IP address. We use it only to limit how often one network can send the form and to spot abuse. We do not store the address itself.

From the hosted service and Bandwise Gate

When a hook or a tool asks Bandwise a question, such as whether an agent is really done or whether a command needs a person, we receive only the fields that question set names. For the done-check that is your request and the agent's last reply. For the action gate it is the tool name, the command or file path, and its description. Before anything leaves our server we cut each field to the set's length limit and replace text that looks like a secret, such as API keys, tokens, passwords and private keys, with [redacted]. That replacement is best effort, so do not paste secrets into a prompt you would not want checked.

For each run we store:

• the redacted input, unless the set is configured to keep only a hash of it;
• the answers, the confidence band, what it cost and what it saved;
• which account and which token made the call, and when.

We also store your account: your email address, your name, a hash of your password, your two-factor setup and hashes of the tokens you create. We never store a token or a password in plain text.

Why we store it

Early-access details: to invite you, to ask about your use case, and to tell you when the cloud opens.

Run data: to answer the question you asked, to show you what each run cost and saved, and to measure how often the answers are right so the thresholds can be tuned. We do not use it to train any model.

Who can see it

The people who operate Bandwise, and the companies that process data for us. We do not sell it, rent it or share it with advertisers.

Companies that process data for us

• TypeSafe runs the System One models that answer every question. It receives the redacted input for each run and returns the answer. Bandwise is not made or endorsed by TypeSafe.
• Supabase hosts our Postgres database in the United States. Everything we store sits there.
• Vercel hosts this website and app.bandwise.dev, and counts page views (see Analytics).
• Anthropic, only while we test Bandwise Gate on our own team: the same redacted done-check input goes to a Claude model too, so we can compare the two answers. We will update this notice before that comparison covers anyone outside our team.

How long we keep it

Early-access details: until you ask us to remove them, or until early access ends, whichever comes first.

Run data and accounts: until you ask us to delete them. Automatic deletion after a set number of days is not built yet. When it is, this notice will say how many days.

Unsubscribe or delete

Email privacy@bandwise.dev from the address you signed up with and say what you want: stop hearing from us, see what we hold, correct it, or delete it. That covers run data and accounts as well. We will do it and reply to confirm.

Analytics

This site uses Vercel Web Analytics to count page views. It sets no cookies and does not identify you across sites, so there is no cookie banner.

Contact

Questions about this notice go to privacy@bandwise.dev.