Skip to main content
AgentWatch

Privacy Policy

AgentWatch (agentwatch.sh) · Last updated 19 September 2026

AgentWatch is a self-hosted tool that monitors terminal sessions on a machine you control and lets you drive them from a web viewer or from your phone. The operator installs the AgentWatch software on their own machine. The service at agentwatch.sh issues each operator a subdomain and a secure tunnel so they can reach their own machine. This policy explains what we collect, why, and how to have it deleted.

Mobile information and SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

1. Who we are

AgentWatch is a service of STEELTIER INC., a corporation registered in the United States, at 1710 Keller Parkway #6248, Keller, TX 76248, United States. The AgentWatch software itself is an open-source project. STEELTIER INC. operates the hosted service at agentwatch.sh described here, and is the sender of the text messages described in section 6. You can reach us at support@agentwatch.sh.

2. What we collect

We keep the smallest set of data the service needs to work:

  • Account identifiers. When you sign in with GitHub we store your GitHub user ID, your GitHub username, and your GitHub avatar URL. We do not receive or store your GitHub password.
  • Tunnel records. The subdomain you reserve, its connection status, the time it was created, and the time it was last seen online.
  • Device binding data. A one-way hash of your machine's fingerprint, and a hash of the device token it uses. These bind a tunnel to one machine so a stolen token cannot be used elsewhere.
  • Mobile phone number. If you turn on the SMS, WhatsApp, or voice-call notification channel, you enter your own mobile number and your own messaging provider credentials. These are stored on your own machine, in the AgentWatch software you installed. We use your number only to deliver the notifications you asked for and to accept your replies.
  • Operational logs. Standard web request logs, kept briefly for security and debugging.

We do not collect the contents of your terminal sessions. Terminal output stays on your own machine and travels encrypted, end to end, between your machine and your browser.

3. Why we collect it

  • To authenticate you and to confirm you are authorized to use the service.
  • To create and maintain your subdomain, DNS record, and tunnel.
  • To stop token theft, by binding a tunnel to the machine that first claimed it.
  • To deliver the notifications you asked for, on the channel you chose.
  • To keep the service secure and to debug faults.

We do not sell your data. We do not use your data for advertising. We do not profile you.

4. Where your data is stored

AgentWatch is mostly self-hosted. Your phone number, your messaging provider credentials, your notification settings, and all terminal content are stored on the machine you operate, under your own control. We never receive them.

The parts we host are the account record and the tunnel record listed in section 2. They are held in a Cloudflare database in the region Cloudflare assigns, and they are the only data we hold about you.

5. Who we share it with

We do not sell, rent, or trade your personal information. We do not share it with affiliates or third parties for their own marketing. We use a small number of service providers purely to run the service:

  • Cloudflare — hosting, DNS, and the encrypted tunnel.
  • GitHub — sign-in only, when you choose to sign in.
  • Your own messaging provider (for example Twilio) — you supply the account, and your AgentWatch installation passes your number to it only to deliver a message you asked for.

We disclose data otherwise only when the law requires it.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6. Our SMS messaging programme

This section describes the text messages AgentWatch sends, and exists so that a carrier compliance reviewer can confirm the programme without signing in. There is one programme and it is transactional.

  • Who sends them. STEELTIER INC., under the name AgentWatch. The AgentWatch software runs on the operator's own machine and sends to the operator's own mobile number. Messages go to the person who installed the software and to nobody else.
  • How consent is given. The operator types their own mobile number into the settings page of their own AgentWatch installation and switches the channel on. That action is the opt-in, and it is the only way a number ever enters the system. We do not buy, rent, import, or accept lists of numbers, and nobody can add a number on somebody else's behalf.
  • What we send. Alerts about the operator's own terminal sessions, questions from a session that is waiting on a decision, and a test message when the operator asks for one. We send no marketing, advertising, or promotional messages of any kind.
  • Message frequency. It varies, because it follows the operator's own work. A typical day is a few messages; a quiet day is none.
  • Cost. Message and data rates may apply. Your mobile carrier sets those rates, not us.
  • Stopping and getting help. Reply STOP to any message to end messages to that number, or HELP for help. Removing the number from the AgentWatch settings page also ends them.

Every message begins with the sender's name, then the name of the session that is speaking. These are the messages this programme sends, in the form they arrive in:

  • AgentWatch [build] The release is blocked and I need a decision.
  • AgentWatch [provisioner] The deploy finished successfully.
  • AgentWatch: test message. Your phone channel works. Reply STOP to end messages.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

7. How long we keep it

  • A reserved subdomain that is never claimed is deleted after 15 minutes.
  • A tunnel with no activity for 30 days is deleted, together with its DNS record.
  • Your account record is kept while your account is open, and is deleted on request.
  • Data held on your own machine is kept, or deleted, entirely by you.

8. Your choices and how to delete your data

  • Stop messages. Reply STOP to any SMS to end messages to that number. Reply HELP for help. You can also remove the number from your AgentWatch settings at any time.
  • Delete a tunnel. Delete it from the dashboard. The subdomain, the DNS record, and the tunnel record are removed.
  • Delete your account. Email support@agentwatch.sh from the address on your GitHub account, or write from the GitHub account itself, and ask us to delete it. We remove your account record and every tunnel it owns within 30 days.
  • Ask what we hold. Email support@agentwatch.sh and we will tell you, and correct anything that is wrong.

9. Security

Traffic to and from your machine runs over an encrypted Cloudflare Tunnel. Device tokens are stored only as hashes, expire, and are rotated. A tunnel is bound to one machine, so a token copied to another machine is refused. No system is perfect, so please report any weakness you find to support@agentwatch.sh.

10. Children

AgentWatch is a developer tool. It is not directed at children under 13, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. The date at the top of this page always shows the current version. Material changes will be announced on the dashboard.

12. Contact

Questions about this policy, or about your data: support@agentwatch.sh.

Privacy Policy · Terms & Conditions