Community stays local. Connect stores only what it needs to connect people.
Community Edition and Connect have different boundaries. The open-source product has no Agents City account or product telemetry. The optional Connect public beta runs a hosted reception, control plane, and encrypted relay, so this notice describes that service separately and precisely.
Last updated: 31 August 2026Operator and contact
BLUEBELL BUSINESS S.A. operates the Connect public beta and acts as controller for its account and service data. Use hello@arkatai.com for privacy requests, security reports, or questions about this notice. Enterprise work by Arkatai is a separate engagement whose contracting entity and processing roles must be agreed before customer data is handled.
Aggregate page analytics
Every public page loads GoatCounter from gc.zgo.at and sends its path to agentscity.goatcounter.com. The current site configuration stores separate aggregate counts for paths and time, referrers, browser and operating system, screen size, country, and limited region data. Individual pageview storage is disabled. GoatCounter uses no cookies, localStorage, cache identifier, or persistent tracker id. To estimate sessions it may hold the site, IP address, and full user agent together in memory for up to eight hours; neither the raw IP nor full user agent is written to its database. The hosted GoatCounter service is operated from Ireland and stores service data on Hetzner servers in Finland and Germany. Site search runs against a static index in the browser. Its term stays in the URL fragment, which is not sent in the page request or the GoatCounter count.
First-party site counts
The site may record one closed event name when somebody opens documentation or GitHub, starts installation, switches language, or copies a command. A D1 row contains only language, route, a bounded source label, a random row id, and server time. It has no IP, user agent, cookie, browser id, name, email, or free text, cannot link visits, and is removed after 90 days. If measurement fails, the site keeps working and the event is discarded.
Community Edition and self-hosting
Repositories, documents, prompts, model-provider credentials, agent state, city configuration, knowledge, committee acts, and local-road history stay on the owner’s computer. Community Edition has no Agents City account, licence server, or telemetry endpoint. The Apache 2.0 repository also includes a relay that a company, client, or community can deploy in its own Cloudflare account. That operator sets its access, jurisdiction, and retention. Its current default logs no message body and holds up to 200 offline messages per city for no more than 72 hours; BLUEBELL BUSINESS S.A. does not receive traffic from a relay you self-host.
What hosted Connect stores
Creating a Connect space stores a public alias, opaque account id, passkey public credential and metadata, one-way recovery-code and session-token hashes, device and machine labels, device public keys and thumbprints, city addresses and state, invitations, person-to-person relationships, plan state, security events, and Stripe test object ids. It asks for no password, email address, legal name, contact list, public city directory, introduction text, or rejection reason. A signed-in browser uses one essential HttpOnly session cookie for up to 30 days. Private device keys remain encrypted on the owner’s computer and never reach the service.
Messages and network metadata
Connection requests carry identity and consent state only. Message bodies begin later on the encrypted Road from one owner’s computer to the other. The control plane has no message-body column. The relay holds end-to-end ciphertext and the delivery data needed to route it; it deletes ciphertext when the receiving client confirms durable local receipt, and undelivered ciphertext expires within one hour. Cloudflare can still process source IP, destination, timing, and padded traffic size as infrastructure metadata. End-to-end encryption does not make that metadata anonymous.
Abuse prevention and service providers
Cloudflare provides Pages, Workers, D1, Durable Objects, Turnstile, and network security. Turnstile receives the registration response and source IP to distinguish people from automated abuse. Connect also stores a one-way rate-limit bucket derived from the source address for no more than two days. GoatCounter provides aggregate site analytics, and Stripe provides the simulated checkout described below. These providers process data under their own service terms and subprocessors. Connect is not offered in this beta as a processor for uploaded customer datasets or special-category data.
Stripe is simulated during the public beta
The Company button opens BLUEBELL BUSINESS S.A.’s Stripe account in test mode. Checkout, portal, subscription events, upgrade, cancellation, and downgrade are functional simulations, but no real card can be charged and no real subscription or tax invoice is created. Use Stripe test card details and fictitious billing data only. Stripe may retain test objects separately from Agents City; deleting a Connect account removes its control-plane links and cancels the test subscription but does not promise deletion of Stripe’s own test records. Real billing will require a new notice and an explicit switch to Stripe live mode.
Retention, export, and deletion
Active account, passkey, device, city, relationship, and plan state remains while the space is in use. Expired challenges and sessions are pruned; rate-limit buckets last no more than two days; abandoned device authorisations and spent invitations are removed on bounded schedules; security events and processed Stripe event ids last no more than 90 days. From the account panel you can download the service data linked to your account and request deletion. Deletion revokes Roads and devices, confirms ciphertext purge, cancels test subscriptions, and removes the account rows. Identifying key-transparency history is retained for 90 days after revocation, then only one-way map and log commitments remain so erased key history cannot be silently rewritten.
Purposes, legal bases, and your rights
Account and connection state is processed to provide the Connect service requested under the public beta conditions. Security, rate limiting, key transparency, and minimal measurement support the legitimate interests of preventing abuse, proving key history, and improving the service without collecting message content. Where data-protection law applies, you may request access, correction, erasure, restriction, portability, or object, and may complain to your supervisory authority. The in-product export and deletion controls are the fastest route; hello@arkatai.com is available when those controls are insufficient.