BCD Privacy

BCD stores account and device metadata needed to operate the service, plus metadata-only product telemetry such as install/device identifier, version, platform, tool name, success/error status, duration, error type, the call's place in its conversation and the size of its result.

Telemetry does not store file contents, file paths, command text or arguments, process output, clipboard contents, or screenshots.

To resume setup and measure activation, BCD keeps your selected AI app, first computer and AI-app connection times, first confirmed task success, the latest day you succeeded and whether you succeeded again on a later day (calendar days in Pacific time) until the account is deleted. These records never contain file names, paths, arguments or results. Internal and configured test accounts are excluded from account activation totals.

Remote tool payloads pass through the relay in memory to complete requested actions and are not intentionally persisted, except for the summaries kept in team activity logs described below and the schedules and links you make. A computer's Activity page on the dashboard is read from that computer while you look and is not kept on the relay; when you mark an action there as checked, BCD keeps only that action's operation ID, who marked it and when, for 30 days. When you schedule a saved workflow, BCD keeps which computer and workflow it runs, the workflow version, when it runs, the inputs you gave it, and the last run's time, state and error message until you stop the schedule or remove the computer or account; the workflow's steps stay on your computer. When your AI app makes a share or upload link, BCD keeps the link's computer, file or folder path, name, size, expiry and how many times and bytes it was used, until 30 days after it expires; the link itself is stored only as a hash. The file passes through the relay in pieces while it is downloaded or uploaded and is never stored there. When you open the live screen of one of your computers (which needs its Live screen permission), its screen images and the clicks and typing you send pass through the relay's memory while the session is open and are never stored or logged. Account credentials and OAuth/device tokens are hashed where applicable. BCD does not sell user data.

If you choose Google sign-in, we receive your Google account identifier and verified email address to create or connect your BCD account. We do not request Gmail, Drive, contacts, or calendar access. We retain the identifier and email while your BCD account remains active, and do not retain Google access or refresh tokens. Temporary sign-in verification records expire after 10 minutes. Google handles authentication under its own privacy policy.

If you choose a paid subscription, Stripe processes your payment details. Stripe collects your billing address and any business tax details you provide to calculate taxes and issue invoices. BCD stores the Stripe customer, subscription, invoice, and payment identifiers, plan, payment status, amounts, and dates needed to provide access and handle billing. BCD does not receive or store your full card number or security code. Stripe handles payment information under its own privacy policy. Billing records may be retained as required for accounting and dispute handling.

To limit free trials to one per person and to refuse a trial for a computer that already used one, BCD keeps a normalized form of the email address of every account that received a trial or was verified (lowercased, without anything after a “+”, and without dots for Gmail) and the identifier of each computer connected to an account that received a trial. These are kept even after the account or computer is removed and are used to decide whether a new account or computer gets a trial. To prevent self-referrals, BCD stores the card fingerprint Stripe provides for each subscription payment and compares it with the referrer's payments. A card fingerprint is an identifier Stripe derives from a card; it is not the card number and cannot be used to charge the card.

Our public website pages (home, prompts, use cases, comparison and guide pages, language landing pages, iOS, pricing, signup, sign-in, support, and policy pages) use a first-party cookie to count visits. We record the page, the site language you chose, the site or campaign that referred you, the kind of device (phone, Mac, Windows, or Linux), and, if you create an account, which of those visits led to it and the resulting subscription revenue. We do not record IP addresses or other browser details for this, do not use third-party analytics or advertising scripts, and do not track account, computer, or AI tool activity this way. Browsers sending Global Privacy Control or Do Not Track are not counted. Visit records are kept for up to 13 months, or while a linked account remains active.

We also keep daily totals of setup steps (opening the dashboard, copying or downloading the installer, approving a computer, and connecting a first AI app). Each total records only the step and, for the dashboard, the landing and pricing buttons and the copy button, the kind of device (Mac, Windows, Linux, or phone), never the account, IP address, or browser details. Browsers sending Global Privacy Control or Do Not Track are not counted.

When a tool call fails, we keep the tool name, the kind of failure, its error code, a short reason code or the permission it needed, which computer it was on and the account it happened on for 30 days, so we can fix problems you run into. We also count, per account and day (Pacific time), how many tool calls were made and how many failed, as numbers only, for 30 days. When a computer's connection to BCD ends, we keep when it connected and disconnected, how the connection ended (for example, the computer stopped answering or BCD restarted), how many calls it cut off and when it reconnected, for 30 days. When a connection stops for a moment and then carries on, we keep only how often per computer and day it did so by length, and the longest, for 30 days. When a second connection for the same computer arrives, we also keep whether the two came from the same network and reported the same computer name, without keeping the network address or the name. To apply the Free plan's monthly limit, we count per account and calendar month how many tool calls reached the account's computers, as a number only, and keep these monthly counts for about 13 months. We never keep the request's contents, file paths, commands or output. When a call's outcome is unknown (its computer disconnected or it timed out), we keep for 15 minutes a keyed hash of the call (account, computer, tool and arguments, from which the arguments cannot be read) and its operation ID, so that the same call sent again is first checked on the computer instead of running twice. To see how AI apps recover from failed calls, we count per day, for 30 days, how often a failed tool later succeeded in the same conversation, was sent again unchanged, kept failing the same way, or was checked after an unknown outcome, by tool and error code only; the comparison of calls happens in memory and is not kept. For shell commands we count per day only which of a few kinds each was (such as reading, listing, searching, copying, moving or deleting files), from the name of the first program it runs, never the command. When you run the connection check on the dashboard, we keep its result for 30 days: when it ran, the account and computer it was for, the browser family (such as Chrome or Safari) and kind of device, how many test messages came back, the longest pause, the typical round trip and the download speed, never the network address. When you run bcd report on a computer, it sends and we keep for 30 days a summary of BCD's logs there for the last 48 hours: how many times BCD connected and how its connections ended, the kinds of network errors by code, whether a proxy or extra certificates are set and how many VPN-like network connections are up (yes/no and counts), the kind of system proxy (HTTP, SOCKS or an auto-config script, and whether it runs on that computer, never its address), how BCD's updates went, and the BCD, system and Node.js versions. It never includes file names, paths, commands, network addresses or log messages; bcd report --show prints all of it without sending. bcd check sends the same summary with the results of the connection check run from BCD itself (directly, through the system proxy and after a quiet spell), kept like the dashboard's connection checks.

Computers shared with a team keep that team’s activity log. For every tool call on them, including their owners’ own calls, BCD stores who made it (account email), which computer, which AI app, which tool, the result, error code, duration and time, and, unless the team owner turns this off, the file and folder paths, web addresses (without their query) and commands the call named, and the names and identifiers it used (such as an app, a workflow, process, job, tab or operation ID, a configuration key or a file name). Values in commands, names and identifiers that look like passwords, keys or tokens are masked before they are stored. Typed text (including what a search looks for), file contents, clipboard contents and output are never stored. Changes to the team, such as invitations, joins, role changes and shared computers, are recorded with who made them. Only team admins can view and export the log. Entries are kept for the period the team owner chooses (30, 90, 180 or 365 days; 90 by default), stay for that period after a member leaves or deletes their account, and are deleted with the team.

Product telemetry defaults to 30-day retention. Local audit logs remain on the user’s computer, are not uploaded as audit content, and default to 90-day retention. The relay's database is backed up daily and before each update; backups stay on computers BCD runs (the relay computer and its standby) for up to two weeks and are never given to anyone else.

Support requests store the email and message you submit for up to 180 days so the request can be handled. Avoid including credentials or secrets.

Feedback you send through the feedback form or an AI app's send_feedback tool stores your message, its kind (bug, idea, praise, or other), the optional 1-5 rating, the page language, where it came from, and either your BCD account (when you are signed in or send it from an AI app) or the email you enter (optional). We use it to improve BCD and to reply when you left an email. Feedback we have closed is deleted after 180 days and all feedback after 365 days.

Messages AI agents on your account send each other through the send_message tool store the message, the sending and receiving agent names, the sending AI app and the time, plus each agent's name, AI app, the line it gives about its work and when it last used agent messages. Only AI apps signed in to your account can read them. Messages are deleted after 7 days, and an agent's entry 7 days after it last used agent messages. A wake webhook that an agent registers with set_wake_webhook or you add on the AI agents page stores its URL and key until it is removed; when a message arrives for that agent, BCD calls it with only the agent's name, the sender's name and the number of unread messages, never the messages.

Video tools run on your computer. If you ask BCD to transcribe a video, Apple speech recognition on that computer turns the speech into text; for languages without on-device support, Apple processes the audio under its own privacy policy. BCD does not receive the audio or the video.

If you ask to hear about the Windows version, we store that email address, your language, and the visit record it came from, and use it only to tell you when BCD runs on Windows. Ask through the support page to be removed.

When you create an account, we send one welcome email with setup instructions to its address. It is sent through Google (Gmail) or Resend, and replies come to the BCD team. If you ask us to email you the link for your Mac, we store that email address, your language, and the visit record it came from for 30 days, only to send that one link and to avoid sending it again. The email is delivered by Resend, our email delivery provider. We never use the address for marketing.

Referral codes link a new signup to the referring account. We retain referral attribution and reward records while the related accounts remain active. Referrers see aggregate counts, not the invited account’s email or payment details.

For privacy or support questions, use the BCD support page.