Privacy · Dashcat

The early-access list

If you join the list, we keep your email address so we can tell you when Dashcat builds are ready.

What we send: one message per release, and nothing else. We never sell or share your address.
Who holds it: the list is run on Buttondown, which stores the address and sends the emails for us.
Confirmation: you are only added after you click the link in the confirmation email.
Leaving: every email has an unsubscribe link. Your address is then removed from the list.

dashcat.ai uses no cookies, no analytics and no tracking scripts.
The site is served by Cloudflare, which, like any web host, processes your IP address to deliver pages and protect the site from attacks.

What we keep: your email address, name and handle; the name and handle of each team you make, who is in it with what role, and a log of who changed the team's nodes, groups, people, settings and AI apps, which stays until the team is deleted; and for each machine you add: its name, operating system, Dashcat version, whether it allows the Dashcat connector, its public key, and when it was last online.
Signing in is handled by WorkOS, which sends your sign-in codes and, if you choose Google, receives your name and email address from Google.
Dashcat Dashboard at app.dashcat.ai uses cookies only to sign you in and keep you signed in. It has no analytics or tracking.
Signed-in devices: for each browser or Dashcat app you sign in on, we keep a short label such as "Chrome on Windows", made from what your browser reports, and when it signed in and was last used, so you can see and sign out your devices in Settings. It goes when that device signs out, or after 90 days without use.
Where it is kept: in Cloudflare's database service, in Western Europe.
Removing a node in the dashboard deletes what we keep about it.

How much Dashcat sees depends on how you connect a node. You choose for each one, and Security explains how each way is protected.

Through the Dashcat connector (not open yet): your AI agents' requests and the node's replies pass through Dashcat's cloud so it can deliver them. That includes the commands your AI agents run, the files they read or write, the text they type into apps, command output and screenshots. Dashcat's cloud can read them as they pass. It does not keep them: each is held in memory until the reply is delivered, then dropped.
In Direct mode: your commands, files and screenshots go straight between your own machines, encrypted end to end. They do not pass through us, and we cannot read them.
Each node's activity log stays on that node. When activity history comes to the dashboard, we will keep a copy so you can read it there, and this page will say so first.

To stop floods and guessing, Dashcat counts requests by account, connection, node, IP address and, for sign-in emails, email address. The counts last about a minute and are kept by Cloudflare.
Dashcat can suspend an account that uses the service to reach machines its owner has no right to control, or that otherwise abuses it.

Cloudflare hosts the website, Dashcat Dashboard and Dashcat's cloud, and stores account data.
WorkOS handles sign-in.
Buttondown runs the early-access list.

We never sell your data or use it for advertising.

To see, correct or delete what we hold about you, including your whole account, email privacy@dashcat.ai.