Privacy Policy — ZebraClaw

1. Information We Collect

When you use ZebraClaw, we may collect the following types of information:

Account information — Your email address and authentication credentials, managed through Firebase Authentication (Google sign-in or email/password).
Billing information — Payment details processed securely by Stripe. We do not store your full credit card number on our servers.
Deployment metadata — Server names, regions, server sizes, IP addresses, and configuration choices you make during setup.
Usage data — Page views, feature usage patterns, and error logs to improve the service.
Push notification tokens — If you use our mobile app and enable notifications, we store your Expo push token to deliver messages.

2. How We Use Your Information

We use your information to:

Provision and manage your cloud server deployments on DigitalOcean.
Process payments and manage your subscription.
Send you deployment status updates and push notifications.
Provide customer support and troubleshoot issues.
Improve and develop new features for the service.

3. Data on Your Server

Each ZebraClaw deployment provisions a dedicated server that belongs to you. Conversations with your AI agent, API keys you configure, and any data processed by OpenClaw live on your server — not on ZebraClaw's infrastructure.

ZebraClaw accesses your server only to:

Complete initial setup and configuration via the deployer bridge.
Relay chat messages between the web/mobile app and your agent.
Proxy the Control UI so you don't encounter self-signed certificate warnings.

We do not read, analyze, or store the content of your conversations with your AI agent.

4. Third-Party Services

ZebraClaw integrates with the following third-party services, each with their own privacy policies:

DigitalOcean — Cloud infrastructure provider that hosts your server.
Stripe — Payment processing for subscriptions and billing.
Firebase (Google) — Authentication and user identity management.
Expo — Push notification delivery for mobile apps.
AI model providers (Anthropic, OpenAI, Google, etc.) — Your server connects directly to these providers using API keys you supply. ZebraClaw does not proxy or intercept this traffic.

5. Data Security

We take reasonable measures to protect your information:

Sensitive data (gateway tokens, Tailscale credentials) is encrypted at rest using AES-256.
All connections between your browser and ZebraClaw use HTTPS/TLS.
Deployed servers are hardened with SSH key-only access, fail2ban, and UFW firewall rules.
Secrets are stored in HashiCorp Vault, not in environment files.

6. Data Retention and Deletion

We retain your account and deployment data for as long as your account is active. If you delete your account or cancel your subscription:

Your server can be destroyed through the dashboard, which permanently deletes all data on it.
Account records and billing history are retained as required by law and for dispute resolution.
You may request deletion of your personal data by contacting us.

7. Cookies and Local Storage

ZebraClaw uses minimal browser storage:

oc-theme — A localStorage item that remembers your chosen color theme.
Firebase session — Authentication tokens stored by the Firebase SDK.
_ctrl cookie — An HMAC-signed session cookie (2-hour expiry) used to authenticate Control UI proxy requests.

We do not use third-party tracking cookies or analytics scripts.

8. Children's Privacy

ZebraClaw is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" at the top of this page. We encourage you to review this page periodically.

10. Contact

If you have questions about this Privacy Policy or your data, please contact us at zebraclaw.com/support.