Privacy Policy

• Account info (email, display name) from Sign in with Apple, Google Sign-In or email login. With Sign in with Apple you can hide your email; we then receive only Apple's private relay address
• OAuth tokens for services you connect (e.g. GitHub, Google Cloud) — encrypted with AES-256-GCM at rest
• Account, billing, device, connection and security metadata
• Content-free task status and feature-usage records
• Items you intentionally publish or share
• Human support emails pending a reply, and minimal duplicate-prevention records, as explained under Data Retention
• Agent-to-Agent session tasks and messages, and agent memories you save, as explained under Data Retention

• We do not store your conversation or task history, chat messages, AI replies, AI Support chats or cloud user memory, except Agent-to-Agent sessions as explained under Data Retention. Conversation and task histories remain on your computer; selected AI providers follow their own policies.
• Provider API keys (BYOK) stay on your computer, in the local credential storage used by GWC Studio or GWC for VS Code. GWC servers never store or log these provider keys.
• GWC processes workspace information when you use a feature that needs it, within the access you authorize. For GWC Bridge, file and document tools use the folders and permissions you grant. Separately enabled commands, processes and Taichu tasks run with your Windows-user rights and are not restricted to those folders merely by the file-sharing settings.
• We don't sell your data. Service providers process data as described under AI Providers and Third-Party Services below
• AI access is configured on your computer through provider sign-in, your own API keys (BYOK), or local models. GWC does not sell AI model usage.

• To route authorized requests between your device and selected computer without creating a cloud chat archive (Agent-to-Agent sessions are the exception, as explained under Data Retention)
• To operate your connections and own AI provider access
• To maintain billing and subscription status
• We do not use your data to train AI models

Your phone or browser sends messages through the GWC relay to your selected computer. GWC Studio or GWC for VS Code runs the AI session there using your provider sign-in, your own API keys (BYOK), or a local model. GWC does not sell AI model usage. When you use a provider, your computer sends the prompt and relevant chat history, code and workspace context to the provider configured there. A local model processes inference on the computer running it.

Your provider account and agreement govern that provider's handling of requests, including retention and privacy. GWC account, connection metadata and temporary encrypted message transit still apply. Using a local model does not mean that phone or web messages bypass GWC.

Where your prompt is processed depends on the model you choose. Providers operate their own infrastructure in their own jurisdictions, and each applies its own retention policy to the request — which may differ from ours and may change without notice to us. In particular, models served by DeepSeek are processed on DeepSeek's infrastructure in the People's Republic of China; models served by Z.AI (Zhipu, the GLM family) are processed by Z.AI, whose operator is based in the People's Republic of China; models served by Alibaba Cloud (Qwen) are processed on Alibaba Cloud's international DashScope endpoint, operated by a company based in the People's Republic of China; models served by BytePlus are processed in Singapore; and models served by Anthropic, OpenAI, Google and xAI are processed on those providers' infrastructure under their published API terms.

If your country restricts the use of AI services processed in another region, choose a provider and request route that comply with those restrictions. Your own provider access does not by itself guarantee data residency. Check the provider configured on your computer, its actual processing locations and your provider agreement against your requirements. Checking what your country permits is your responsibility — we do not verify the identity, nationality, or location of our users. See the Terms of Service for more.

Your account, billing, device and connection/security metadata, along with Agent-to-Agent session tasks, messages and the agent memories you save, is stored in a CockroachDB cluster GWC runs on its own servers — no managed database provider holds your data. The cluster spans four regions: Singapore (primary), Frankfurt, Seoul and New Jersey. For durability, every record is replicated to at least three of those regions, so your data is stored in the European Union, Korea and the United States as well as Singapore. Data is isolated per account: every record is scoped to your user ID and protected by authenticated access controls. Backup copies of this database are also held off-site in Cloudflare R2 object storage under GWC's own account — see Data Retention below.

Google Cloud services. Three Google services process data on GWC's behalf. Secret Manager stores the connection credentials you provide when you connect an external vault or service — these are your secrets, held encrypted and used only to make the connection you asked for. Cloud Storage holds files and artifacts only when you choose to publish or share them. Gmail SMTP delivers transactional email — including sign-in links, account notices and requested download-link emails — which means the recipient email address passes through Google to reach you. None of the three is used for advertising or profiling. They do not archive conversations, AI replies or task history. Items you intentionally publish or share are separate.

AI Support. A question about GWC goes to an outside AI service to generate an answer. GWC does not store AI Support chats, questions, answers or chat history at all, nor produce a weekly digest. AI Support answers GWC questions only and cannot perform account actions. Do not include secrets. For refunds, account deletion, billing disputes or legal requests, email support@gwc-corp.com. Human support email is separate: GWC wipes the original body and its reply from its database after sending the reply, or wipes an unanswered request after seven days. Message-ID, sender address and status remain to prevent duplicate requests. Staff mailbox copies are outside GWC's database and are not erased by this cleanup.

Connected services: OAuth tokens for connected services are encrypted with AES-256-GCM at rest.

Provider keys: API keys (BYOK) stay in local credential storage on your computer. GWC servers never store or log them. Credentials for other connected services are separate and are handled as described above.

GWC does not retain conversation or task history as account content. Those stay on your computer or with the AI services you choose. Messages on their way to or from your computer are held encrypted until they are delivered (at most 24 hours) and deleted within an hour after delivery. Agent-to-Agent sessions are the current exception, described below.

AI Support chats are not stored at all. For human support emails, the body and GWC's reply are wiped from GWC's database once the reply is sent. An unanswered request is wiped after seven days. Message-ID, sender address and status remain to stop duplicates. Staff mailbox copies are outside GWC's database. Account, billing, device and connection/security records and items you deliberately publish or share follow separate rules.

Agent-to-Agent is the current exception. GWC stores each Agent-to-Agent session's opening task and the messages exchanged in it, so both participants can read the session on their computers, on the web and in GWC Connect. Each time a session gets a new message, its messages older than 30 days are deleted and only its newest 2,000 are kept. Ending a session does not delete it: its task and remaining messages stay until either participant's account is deleted. Live turns passing between the two computers are held only in server memory and cleared within 15 minutes. Agent memories you save for your agent are kept until you delete them or your account. We are moving Agent-to-Agent sessions to the participants' computers. Cloud user memory derived from chats is not kept.

Local database backup archives are normally eligible for cleanup after 14 days once that individual backup has been successfully copied to our private off-site object storage. If its off-site copy has not been verified, we keep the local archive longer rather than delete the only known good copy. Off-site backup copies do not currently have an automatic age-based deletion rule and are retained until GWC removes them. Deleted content may therefore persist in a backup after you remove it from the live service.

Subscription billing records and retained historical payment and usage records are kept as long as required to operate your account and meet our tax and accounting obligations. These records do not contain the content of your prompts or replies.

Records from retired GWC commerce services may be retained only as needed to settle or refund historical transactions, resolve disputes, and meet legal and accounting obligations. This can include order records, messages, listing metadata, credentials, and customer deliverables. No new commerce transactions are accepted.

Retention by an AI provider is governed by that provider, not by us. Deleting content from GWC does not delete any copy the provider may hold under its own policy.

• Export: download your profile, your project list, your saved agents and your preferences as JSON, anytime. Conversation and task history, AI Support exchanges and project file contents are not included in the account export. Agent-to-Agent sessions and agent memories are not included either
• Delete: Request full account deletion inside the GWC Connect app (Settings → Account → Delete Account) or on the website — how to delete your account. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account settings
• Portability: the export is a machine-readable JSON file you can take elsewhere. We do not currently offer a code or project-file archive download
• Account deletion is scheduled 30 days after confirmation. The retention exceptions above still apply

GWC integrates with services you connect (Google Cloud, Stripe, GitHub, AI providers). Each service has its own privacy policy. We only share the minimum data needed for the integration to work.

When you request download links by email, we use the email address you enter and your selected website language to send one short message with Android, iPhone and GWC Bridge links. The iPhone link may use TestFlight while beta testing is available, or the App Store after public approval. If neither link is available, we queue one iPhone-only follow-up email with its link and QR code when a release becomes available.

To prevent repeated requests, we group email aliases for rate limiting and follow-up deduplication: plus-addressing variants, and Gmail or Googlemail addresses with different local-part dots, count as the same inbox. We still send the requested email to the address provided. Daily rate counters store a keyed HMAC digest of that inbox rather than its plaintext email address. Those counter records are deleted after two days by scheduled cleanup.

The initial Android and GWC Bridge links do not create a subscriber record. While an iPhone link is pending, we keep its delivery email address and language only until you cancel, the one-time follow-up is attempted, or 90 days have elapsed, whichever comes first. Failed follow-up attempts are not automatically resent. Scheduled cleanup also deletes expired requests and any claimed records left by interruptions.

The cancellation link in a pending email opens a confirmation page. Simply opening or previewing the link does not cancel your request; submitting its confirmation button deletes the pending iPhone request. SMTP delivery failures are reported rather than counted as successful emails.

GWC Bridge connects ChatGPT remotely to a computer you authorize through a supported version of GWC Studio or GWC for VS Code. File and document tools can list, read, search, create, edit, copy, move, delete and restore supported items in folders you share and grant. Your connection permissions and the capabilities enabled on the PC determine which operations are available. A folder with file changes disabled cannot be changed through those file tools just because a ChatGPT confirmation setting is permissive.

ChatGPT's own permissions determine when it asks before tools run; Claude has separate connector and tool permission settings. GWC has no operational four-level tool-approval selector or shared PC/Web/Mobile approval cards; older desktop builds may still display a read-only legacy level. GWC for Web and GWC Connect mobile provide Cloud and linked-computer monitoring and inactive-computer removal, not access switches. GWC Studio or GWC for VS Code is where you register the computer and control Bridge On/Off. ChatGPT and Claude access may currently be status-only readouts rather than separate desktop switches; review or revoke their individual OAuth connected-app grants when necessary. Neither client tool approvals nor Bridge controls expand your folders or OAuth grants.

Commands, process input and Taichu tasks run with the operating-system user rights of the account running GWC. They are not sandboxed or confined to your shared folders by the file-sharing settings: they may use the network or access other data that user account can access. Secret-file protection is enabled for GWC's protected file operations. The supported Bridge settings do not offer a control to disable it. It is not a guarantee that arbitrary commands or task instructions cannot access sensitive data.

If you enable system-process access, results can include program names, process IDs, executable paths, process creation times, and CPU and memory measurements. Executable paths may be absolute and may reveal an operating-system username or installed software. Ending a process requires its current identity and an enabled capability; GWC refuses protected critical and GWC/VS Code processes.

Direct file, command and process tools do not start a Taichu model session. Explicitly delegated Taichu tasks receive the instructions and model choice you submit and may use the files, programs, provider connections and network access available to your configured Taichu runtime. Task instructions and relevant context may be processed by the AI providers used by that runtime. Use of your own keys or provider sign-in can incur that provider's charges. Task data and provider handling are also subject to the applicable Taichu settings and provider terms, not just the relay-buffer rules below.

To carry out your requests, GWC processes the relevant tool inputs and results. These can include account and connection information, device names, folder identifiers and labels, relative file paths, file and document contents or images, search text and matches, proposed edits, command text, process input/output, process metadata, task instructions/results, and the activity entries or usage information you request. A folder label is not the folder's absolute path; file contents, command output and process information can nevertheless themselves contain paths or other personal information.

Delivery buffers can contain encrypted copies of request data, including proposed edits, command text and task instructions. Depending on the relay path, these buffers are held in Redis, our database, or both, and request data may remain after a tool finishes until acknowledgement, expiry handling and cleanup remove it. Returned tool results are forwarded through live response handling rather than saved as a GWC Bridge results history. GWC processes this data to deliver the service; this is not an end-to-end encrypted channel that hides the data from GWC.

GWC Bridge requests have a short delivery-validity window; that is not a promise of immediate erasure. Expired database delivery records are scheduled for cleanup every ten minutes. Cache copies have separate acknowledgement, expiry and cleanup mechanisms, and failures can delay removal. Database backups may contain buffered request data after live cleanup. The backup retention described under Data Retention applies, including off-site copies retained until we remove them; there is no promise that every copy is erased when a tool returns.

GWC also keeps connection and security records such as the account, client, device and folder identifiers, selected permissions, connection/revocation times and available last-used information. Revoked ChatGPT connections and folders no longer shared are removed from the live GWC Bridge store after 30 days, normally on the next successful hourly cleanup. OAuth consent requests default to 10 minutes, authorization codes to 1 minute, access tokens to 30 minutes and refresh tokens to 30 days. Device lifecycle/settings history and GWC Bridge audit records do not currently have a separate age limit while the account exists; they are removed with account deletion. Operational API request/application logs likewise do not currently have a fixed age limit in our reviewed deployment configuration. GWC Bridge's state-changing usage counters in shared Redis expire after two days; its fixed-window rate-limit records expire after two minutes and its current token-bucket state after about 40 seconds when idle. Existing last-used information is not erased simply because the connection is revoked. In the full-tool release, a connection's last-used time reflects its most recent successful state-changing call: successful read-only calls do not append a PC activity entry or update that timestamp, and independent connection checks maintain online and last-seen status.

The PC activity log records GWC Bridge state-changing and elevated actions while it is on. You control it on the PC; while it is off, those actions still run within your capabilities and confirmations but are not recorded. It records targets, approval decisions and outcomes, never returned file/document contents, command/process output or Taichu answers. Retention defaults to 30 days; GWC Bridge can lengthen it but cannot shorten it or turn the log on or off. Targets can include a folder label, relative path, command text or another action target and can themselves contain sensitive information, so do not put secrets in them. A shorter retention period, if the local product offers one, must be selected on the PC. The log is stored on the PC, and requested activity entries can be returned to ChatGPT through GWC Bridge. Successful read-only calls, including viewing activity, do not create their own activity entry.

Long-running search sessions temporarily hold their query, progress and bounded results in PC memory. You can read pages without consuming them, list your sessions, or stop and discard a search. Sessions expire and do not survive a daemon restart. Stopping a search does not recall results already delivered to ChatGPT. The relay handling described above also applies when search instructions or results pass through GWC.

If you grant the optional feedback:write permission and use Give feedback, the message and optional category you submit are sent to GWC support/product staff, together with the account reference needed to handle the submission. No automatic file, command-output or diagnostic attachment is included. Feedback is an intentional submission, not a passive tool-activity record. We remove it from the live feedback store within 90 days of submission. For earlier deletion, contact support@gwc-corp.com with the feedback reference. Copies in backups follow Data Retention above.

The Set PC settings tool can change only the device's display name or lengthen the number of days kept in its activity log, within supported limits. It cannot turn off logging, change secret protection, grant access to more folders, enable a capability or change local approval rules. These tool limits are separate from desktop owner controls in GWC Studio or GWC for VS Code. Web and mobile show connection status and allow inactive-computer removal; they do not offer access or permission switches. Bridge On/Off changes must be checked on the computer. Its ChatGPT and Claude access entries may only be status readouts. A displayed or saved setting is not proof of effective permission, especially while the computer is offline. ChatGPT and Claude confirmation controls and independent protected-action checks still apply.

The Disconnect PC tool stops the selected computer's Remote Connect relay until the owner reconnects through the desktop GWC Studio or GWC for VS Code controls; it does not shut down the computer. It is not the same as revoking an OAuth connection or deleting stored data. To remove a connected app's authority, revoke the connection in Settings → Connected apps on the GWC website. Disconnecting, stopping sharing or revoking access does not undo completed edits, recall data already sent, reverse charges, or guarantee that every process, task or external descendant has stopped.

Tool results sent to ChatGPT/OpenAI are handled under OpenAI's terms, privacy policy and the settings applicable to your account or workspace. GWC's buffer cleanup, search expiry, local-log retention and revocation do not control copies held in your ChatGPT conversation or by other providers.

When you connect GWC Bridge from Claude, everything in "GWC Bridge for ChatGPT" above applies in the same way, with these differences. Claude's connector tool permissions (Always allow, Needs approval or Blocked), not a ChatGPT setting, affect when Claude asks before an action.

Tool results and requested activity entries are sent to Claude and are handled by Anthropic under its terms, its privacy policy and the settings applicable to your account or workspace. GWC's buffer cleanup, search expiry, local-log retention and revocation do not control copies held in your Claude conversation.

The GWC Connect mobile app (com.gwc.ai, iOS and Android) accesses the following device capabilities, each only for the feature named:

• Photos & files: only when you choose an existing image or file to attach to a chat or transfer to your computer. The app does not capture photos with the camera. Attachments travel to the recipient you authorize, not into a GWC-hosted conversation history.
• Microphone: voice input is transcribed by your device's platform speech recognition (Apple on iOS, Google on Android), which may process the audio on that vendor's servers under its own privacy policy. GWC receives only the resulting text — raw audio is never sent to our servers.
• Notifications: a Firebase Cloud Messaging (FCM) push token is used to deliver notifications. It is a device identifier, not location or contact data.
• Local network: GWC Connect reaches your own computer through GWC's authenticated cloud relay. An optional WebRTC connection can carry data directly between paired devices, with cloud signaling and a relay fallback. This uses device and network information to establish the connection — the app requests no GPS/location access.
• On-device storage: mobile session tokens are held in the platform secure store. AI provider access is configured on your selected computer; provider keys stay there and are never stored on GWC servers.

On iOS and Android, GWC Connect sells only the Connect Pass subscription through the App Store or Google Play. Apple or Google processes the payment; GWC receives only the purchase and transaction identifiers needed to verify, grant and restore Connect Pass and bind it to your account.

Questions about privacy? Email us at support@gwc-corp.com.

To report harmful or offensive AI output, email the same address with the subject "AI Safety".