Privacy
Plain words. This is not legal advice. Last updated 25 September 2026.
We don’t hold your keys. They stay on your computer.
Your agent’s key is shown to you once and lives with you and your agent. We keep only a fingerprint of it, which can check a key but can’t become one. On your own domain (coming), the key to your mail lives in a file on your computer too, unless you choose to keep it somewhere else.
The short version
We keep as little as we can. Your agent’s mail is kept for 7 days and read by machines, not people. We don’t sell anything about you, show ads, or use tracking cookies.
What we keep
- Your sign-up: your email address, what you said your agent will use it for (if you did), when you signed up and confirmed, and whether you asked to hear about Pro.
- Confirming it’s you: when you send us an email to confirm, we note only who sent it and whether their mail provider vouched for them. We never keep what it says.
- Your agent’s address: the address, when it was made, and a fingerprint of its key (never the key itself).
- Your agent’s mail: kept for 7 days (free), then deleted automatically. This includes the sender’s address and whatever they wrote. Codes and links are picked out by machine; what reaches your agent follows your settings; you see the rest. Mail from senders you block is not stored at all. Every mail is checked once by automatic moderation on Cloudflare’s own AI service, which keeps none of it. People at devpings do not read it.
- World mode, if you turn it on: for mail from senders you trust, a second automatic reader on the same service turns the request into a short change note (which text to change, and to what), kept with the mail for 7 days. Your own Claude, on your own account, fetches only that note and opens a draft in your repository; we keep the draft’s number and link. We never see your code or your GitHub account.
- Connected apps: when you connect Claude (or another app) to devpings, we keep which app, where it returns to, when you connected it, and fingerprints of its access tokens (never the tokens). You can disconnect it any time.
- Counts: how many emails each address got, how much space they use, how many were dropped, how often your agent called us. Numbers only, never content.
- Server logs kept by our hosting providers, such as IP addresses and times, for security and running the service.
Why
To run devpings, keep it safe from abuse, keep within its limits, and tell you about your setup or Pro if you asked. Nothing else.
Where it is kept
Your sign-up and the counts are stored with Supabase in Sydney, Australia. Your agent’s mail is stored with Cloudflare, whose network is worldwide, so it may be held outside Australia. The site runs on Vercel, which may process requests outside Australia. When we email you a sign-in code, Resend (a United States company, sending through its Tokyo region) sends it: it gets your email address and that one message, under its data processing agreement. We choose providers with strong security, and share only what each needs to do its job.
Who else sees it
Your agent, using its key. Your agent’s own AI provider then handles what your agent reads, under that provider’s terms. We don’t sell or rent anything, and only share it if the law requires us to.
Cookies
None for visitors. When you sign in to read your agent’s mail you get one sign-in cookie, for 12 hours; admins get one too.
Your choices
Email support@devpings.com to see what we hold about you, correct it, or delete it. Deleting also switches off your agent’s address. If you’re unhappy with how we handled it, tell us first; you can also contact the Office of the Australian Information Commissioner (oaic.gov.au).
If something goes wrong
If there is a breach that could seriously harm you, we’ll tell you and, where required, the OAIC.
Contact
support@devpings.com, or the feedback form. Security problems: security@devpings.com.