Privacy Policy

By using Replicas, you consent to the data practices described in this policy. If you do not agree with this policy, please discontinue use of the Service.

Personal Information

We collect information you provide directly to us, including:

• Account information (name, email address, password)
• Payment information (processed securely through third-party payment processors)
• Organization information (team name, member details)

Usage Information

• Workspace creation, configuration, and usage metrics
• The surface that created each workspace (Dashboard, Slack, Linear, GitHub, CLI, public API, or Automations) — used to determine seat assignment and meter API and Automations usage as described in our Terms of Service
• The email address of the user who created each workspace, used to count seats per billing period
• Credit consumption, metered API and Automations usage, and billing history
• Log data (IP addresses, browser type, access times, pages viewed)

Workspace Data

Workspace configuration information we store in Supabase:

• Repository URLs and names for workspace templates
• Workspace configuration settings and instance types
• Workspace usage metrics and credit consumption

Important: Your source code, files, and workspace contents remain isolated within sandboxes (ephemeral virtual machines on E2B). We do not access, scan, or store the code or data within your workspaces. All workspace data is deleted when the workspace is destroyed.

In-Chat Media

Media produced by workspace agents or uploaded at the user's request during chat sessions (such as screenshots, screen recordings, diagrams, audio, and other media assets) are stored persistently to enable sharing, retrieval, and display within the Replicas platform. This includes:

• Screenshots and screen recordings captured by workspace agents
• Generated diagrams, images, and other visual content produced by agents
• Audio clips produced during workspace sessions
• Files uploaded at the user's request during a chat session

In-chat media is associated with your organization and the workspace that generated it. Unlike ephemeral workspace data, in-chat media persists beyond the lifecycle of the workspace to remain accessible in chat history and shared links. You may request deletion at any time (see Data Retention below).

Integration Metadata

For integrations with GitHub, Linear, and Slack, we store only metadata necessary for operation:

• GitHub: pull request numbers, issue numbers, and repository URLs (not PR/issue contents)
• Linear: session identifiers and interaction metadata (not issue contents)
• Slack: workspace IDs and channel references (not message contents)

Encrypted Credentials

Credentials required for Replicas to function are stored encrypted in Supabase Vault:

• GitHub App credentials (used only within workspaces for code access)
• AI coding agent credentials (e.g., AWS Bedrock, Claude API keys)
• Third-party service credentials (Linear, Slack, etc.)

Critical: Credentials are never accessed or viewed by Replicas staff. They are injected into workspaces and destroyed when the workspace is destroyed. No credentials are persisted outside of active workspace sessions.

• Provide, maintain, and improve the Service
• Process transactions and manage your subscription
• Create and manage your workspaces
• Send administrative information, updates, and security alerts
• Respond to your requests and provide customer support
• Monitor and analyze usage patterns to improve performance
• Detect, prevent, and address technical issues or fraudulent activity
• Comply with legal obligations

We do not sell your data. We may share information in these circumstances:

• Service Providers: Third-party vendors who perform services on our behalf (payment processing, infrastructure hosting)
• Legal Requirements: When required by law or to protect our rights, property, or safety
• Business Transfers: In connection with any merger, sale of company assets, or acquisition
• With Consent: When you explicitly authorize us to share information

We implement industry-standard security measures to protect your information:

• Isolated workspace sandboxes with dedicated security groups
• Encrypted data transmission using TLS/SSL
• Secure authentication and access controls
• Regular security audits and monitoring
• Restricted employee access to personal data

Workspace Data

All workspace data, code, files, environment variables, and credentials are permanently deleted when a workspace is destroyed. We maintain no backups, snapshots, or archives of workspace contents.

Workspace History

Workspace chat transcripts and Canvas files are stored in S3 so history remains accessible after a workspace sleeps. Team and Enterprise plans can disable workspace history persistence in Organization Settings.

In-Chat Media

In-chat media — including content produced by workspace agents and files uploaded at the user's request — persists beyond the lifecycle of the workspace that created it. This media is retained until you request its deletion.

You may request deletion of your data, including agent-captured media, by emailing founders@replicas.dev. We will process deletion requests within 30 days.

Account and Organization Data

When you delete your account:

• Your workspaces and all associated data are permanently deleted
• Organization and user information is removed from active systems
• Integration metadata (GitHub repos, Linear sessions, etc.) is deleted
• In-chat media (agent-produced content and files uploaded at the user's request) is retained until explicitly deleted via a deletion request
• Encrypted credentials are permanently deleted
• Some data may be retained for legal, tax, or accounting purposes
• Aggregated, anonymized usage metrics may be retained for analytics

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through our website or support channels.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last Updated” date at the top of this policy.