Effective date: October 18, 2026. This policy applies to the Rigaway apps, the desktop agent, our websites (rigaway.com), hosting (rigaway.app and custom domains), and cloud desktops. The controller of your personal data is Rigaway, Inc., a Delaware corporation ("Rigaway", "we", "us").
The short version
On Self-Hosted, your source code, terminals, files, and AI chats are not uploaded to our servers. They travel end-to-end encrypted between your own devices; your chats are stored on your phone and in your AI tool's session files on your own computer. On a cloud-desktop plan your code runs on a machine we host for you, so it is stored on our infrastructure; the connection to it is still end-to-end encrypted, and our control plane doesn't read it. Your AI coding agent runs on your computer with your own AI account and sends the code you ask it to work on to your AI provider under that provider's terms. Our servers handle accounts, device registration, connection setup, notifications, subscriptions, and hosting. We don't sell or share your personal data for advertising, and we don't use advertising trackers.
What we collect
- Account: your email address, optional profile name and avatar, and the short-lived sign-in codes we email you. If you sign in with Apple, Google, or GitHub, the account identifier and verified email that provider shares with us (and your name, if the provider shares it). For Sign in with Apple we also keep the token Apple issues at sign-in so we can revoke Rigaway's access at Apple when you delete your account.
- Beta & waitlist signups: if you join the beta or a waitlist, your email address, your name (optional), which phone and computer platforms you use, which plan you're interested in, and which page you signed up from.
- Devices & connections: device name and platform, the public keys and device tokens your devices use to authenticate and recognize each other, connection-setup (signaling) messages, and IP addresses, which are necessarily processed to connect devices, serve requests, and rate-limit abuse. If a connection is relayed, our relay forwards encrypted traffic it cannot read and we record how many bytes were relayed per day.
- Notifications: a push token for each of your phones. A notification carries a title (often the name of the chat it's about) and a short message, which can include text written by your AI agent or by your automations (for example an email subject). It passes through our servers, Expo, and Apple or Google to reach your phone; we don't store notification contents.
- Subscriptions: purchases are made through Apple or Google and tracked with RevenueCat, linked to your Rigaway account ID. We receive your plan, purchase and renewal status, and dates — never your card details.
- Teams: if you create or join a team, its name, its members, and the email addresses of people invited.
- Hosting: if you publish a website, the files you deploy, its settings, custom domains, environment variables and secrets (secrets are stored encrypted), and — if you enable them — its database, file storage, and request logs, plus aggregate traffic counts used for limits and billing. If you make a website private, the email addresses you allow, the email addresses visitors enter to get an access code, and a hashed passphrase.
- Cloud desktops: if you use one, the files and software on that machine, plus runtime, storage, and network usage meters.
- Automations: if you use them, your personal inbox address and webhook URL, the tags and senders you route to each of your devices, and how many events and automation notifications you use each month. Email you forward to your Rigaway address and requests sent to your webhook pass through Cloudflare to our servers, which hand them to your computer; if it's offline we hold them (up to 25 MB) until it reconnects, for at most 7 days, and delete each one once your computer has received it. With current versions of the Rigaway desktop app, held messages are encrypted to keys that exist only on your computers, so we can't read them; they're unencrypted only briefly in our servers' memory while being received and handed over. Your automations themselves — their rules, history, and the chats they run — live on your computer. If you connect your own mailbox, the app password stays on your computer and your computer reads the mailbox directly; it never passes through us.
- Connected integrations: if you connect a third-party service through Rigaway, our server completes the sign-in exchange and passes the resulting token to your device, where it's stored on your computer. We don't keep a copy.
- Website session: if you sign in on rigaway.com, a session cookie (see Cookies).
- Support & reports: messages you send us, and abuse or copyright reports, including the reporter's email if provided.
- Logs: limited server logs (such as request and error records) used to operate and secure the service.
What we don't collect: on Self-Hosted, your code, files, terminal output, or AI chat transcripts; the credentials for your AI provider accounts (they stay on your computer); precise location; or advertising identifiers. The Rigaway mobile app includes some third-party libraries (for example crash reporting, payments, and tracking-permission modules) only so that apps you build can use them when you preview them on your phone in Rigaway; Rigaway doesn't use them to collect data about you.
Cookies
We use strictly necessary cookies only: a signed, HttpOnly session cookie that keeps you signed in on our website (expires after 30 days or when you sign out), and signed access cookies that unlock private hosted websites shared with you. Our website has no analytics, advertising, or cross-site tracking cookies.
How we use it and our legal bases
- To provide the service you ask for — accounts and sign-in, connecting your devices, notifications, automations, hosting, cloud desktops, subscriptions, and support (performance of our contract with you).
- To keep Rigaway secure and prevent abuse — rate limiting, fraud and abuse prevention, handling reports and takedowns, and debugging (our legitimate interests in a safe, working service).
- To tell you about the beta or launch if you joined the waitlist (your consent, which you can withdraw anytime), and to send transactional and service emails.
- To comply with law — for example, reporting child sexual abuse material to NCMEC and responding to valid legal process (legal obligation).
We don't use your data for advertising, and we don't make decisions with legal or similarly significant effects about you based solely on automated processing.
Who we share it with
We don't sell personal data. We share it only with the service providers listed on our Subprocessors page (for example Cloudflare, our server hosts, Resend, Google Workspace, Apple and Google, RevenueCat, Expo, GitHub, and Fly.io), under contract and only as needed to run Rigaway. Apple and Google also process your purchase as merchant of record under their own privacy policies. Your AI provider receives what your agent sends it under your own agreement with that provider — they aren't our service providers.
We may also disclose data when required by law or valid legal process, to enforce our terms, to protect the rights and safety of users or others (including reporting child sexual abuse material to NCMEC as required by law), or as part of a merger, acquisition, or sale of assets, subject to this policy.
Websites you host
If you publish a website, you decide what it collects from its visitors and you're responsible for your own privacy notice and legal compliance. We process your visitors' data (such as IP addresses, request logs you enable, private-website access emails, and whatever your website stores in its database or file storage) on your behalf, as your processor, to serve your website. The same applies to personal data in files on a cloud desktop. Our Data Processing Addendum governs that processing and applies automatically; no signature is needed.
International transfers
Rigaway is a U.S. company. Our control plane and its database run in the United States, so personal data from other countries is transferred to and processed in the U.S. Our providers may also process data in other countries (see Subprocessors). For transfers of personal data from the EEA, we rely on the European Commission's Standard Contractual Clauses (2021/914); for the UK, the UK International Data Transfer Addendum to them; and for Switzerland, the same clauses as adapted for the Swiss Federal Act on Data Protection. We have the same safeguards in place with our providers, and we assess these transfers and apply additional measures — such as end-to-end encryption of device traffic and encryption in transit — where needed. You can ask for a copy of the relevant safeguards at privacy@rigaway.com.
How long we keep it
- Sign-in codes expire after 10 minutes. App sign-in sessions expire after 90 days without use; website sessions after 30 days.
- Account, device, team, and hosting data are kept while your account is active. When you delete your account we delete it, including your hosted websites, their databases and storage, devices, push tokens, and linked sign-in identities.
- Cloud desktops: a desktop unused for 7 days is archived to private storage; if your cloud-desktop subscription ends, its data is permanently deleted after a 30-day grace period. When you delete your account, your cloud desktop (its machine, disk, and any archive) is destroyed right away; if a provider is briefly unavailable we keep retrying until it's gone.
- Hosted websites: each website keeps up to its 5 most recent deployments so you can roll back (fewer if your storage allowance runs short); older versions are deleted automatically when you deploy. You can delete a website anytime in the app (Publish → your website → Delete website): we remove its deployments, custom domains, database, environment variables and secrets, and — if no other website of yours uses it — its file storage. Removal from our storage provider normally happens right away; if a provider is briefly unavailable we keep retrying until it's gone. The website's address is released right away (if your subscription has lapsed, it stays reserved for your account for 30 days). A website under a takedown or legal hold can't be deleted until the hold is released. If your Self-Hosted subscription or trial ends, your websites are paused after 7 days and, if you haven't resubscribed within 30 days of it ending, deleted the same way, with their addresses released immediately; we email you first.
- Website request logs (if enabled) are kept for up to 7 days.
- Automation email and webhooks waiting for an offline computer: deleted as soon as your computer receives them, and after 7 days if it never does. They're stored encrypted so only your computers can read them, and they aren't included in backups. Monthly usage counts are kept while your account is active.
- Waitlist signups: until you ask us to remove you or 12 months after Rigaway's public launch, whichever comes first.
- Server logs: 30 days.
- Backups: we back up our account database every night to private, encrypted storage, and each backup is deleted automatically after 30 days. So data you delete, including a deleted account, can remain in a backup for up to 30 days. We use backups only to recover from failures. Backups don't include the files or databases of your hosted websites.
- Support email: up to 2 years after the conversation ends.
- Abuse reports, takedown records, and content under legal hold (for example, a website preserved for a child-safety report) are kept for as long as needed for that purpose and as the law requires, even after the account is deleted. Resolved abuse reports are kept for 2 years; content preserved for a child-safety report is kept for at least 1 year, as U.S. law requires, and deleted once the hold is released.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to withdraw consent. In the EEA, UK, and Switzerland you can also complain to your local data-protection authority. Email privacy@rigaway.com to exercise these rights; we'll verify your request (usually by confirming control of your account email) and respond within the time the law requires. You can update your profile in the app and ask us to remove you from the waitlist anytime.
Deleting your account
Delete your account in the app under Settings → Account → Delete account. If you can't sign in, email privacy@rigaway.com from your account's email address and we'll delete it for you. Deleting your account removes your profile, sign-ins, devices, team memberships, hosted websites and their data, cloud desktop, and usage records; we keep only what's listed under retention above (such as abuse and legal-hold records), and purchase records stay with Apple, Google, and RevenueCat. The code, chats, and files on your own computer and phone aren't stored by Rigaway, so deleting your account doesn't touch them. Deleting your account doesn't cancel an App Store or Google Play subscription — cancel that in your store account.
California residents
In the past 12 months we have collected these categories of personal information, from you and your devices, for the purposes described above: identifiers (email, name, account and device IDs, IP address); commercial information (subscription status); internet or network activity (logs and usage meters); and, if you host content, use a cloud desktop, or forward email or webhooks to an automation, the content you provide. We disclose these only to the service providers described above for business purposes. We do not sell or "share" personal information (including for cross-context behavioral advertising), and we don't use or disclose sensitive personal information for purposes that require a right to limit. You have the right to know, delete, and correct your personal information, and you won't be discriminated against for exercising these rights. You can use an authorized agent; we may ask for proof of authorization.
Children
Rigaway is a developer tool not directed to children and is not intended for anyone under 18. We don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email privacy@rigaway.com and we'll delete it.
Security
Connections between your devices are end-to-end encrypted (WebRTC with DTLS) and authenticated with per-device signed keys; our relay only ever sees encrypted traffic. We use encryption in transit, encrypt hosted-website secrets at rest, and apply access controls to our systems, but no system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires. Report vulnerabilities via our security page.
Changes & contact
We'll update this policy as the service evolves and change the effective date above; for material changes we'll notify you in advance by email or in the app. Questions or requests: privacy@rigaway.com.