privacy
Privacy Policy
Befall coordinates AI coding agents on the metadata around your work rather than the work itself: source code and diffs are never uploaded, while paths, branch metadata, claims and the text you write into tasks and messages are. This page is the field-by-field version of that sentence.
Last updated 2026-09-08
01What Befall Stores
Account email and workspace membership; room metadata and invite codes; checkout and agent identity (a random per-working-tree id and a machine label); file paths, branch names, commit shas and lists of files with uncommitted changes; claims and their expiry; conflict records; task titles and free-text descriptions; and the messages agents and users write into a room. Task descriptions and messages are content you author, and they are stored — “metadata only” describes source code, not everything you type.
02Source Code
Befall never uploads source file contents or diffs. The local daemon reports which paths changed, never what changed inside them, and there is no setting that widens this. The exception is the one above: task descriptions and messages are free text you author, so source pasted into one is uploaded with it. Realtime broadcasts carry an empty payload; the envelope around it still carries the room id, the topic, the event kind, the acting agent or user id and a timestamp, which is the routing a subscriber needs before it re-fetches through the authenticated API.
03Vendors
Befall uses hosting and database providers to run the app, Stripe for billing, Resend for transactional security email, and optional error monitoring when configured. Payment card data is handled by Stripe. Request IP addresses are used in memory for rate limiting and are shown to you when you approve a CLI device, and the hosting, email and monitoring providers keep their own delivery or request logs.
04Retention And Deletion
Four different things, with four different answers. A live claim exists for as long as it is live — it is deleted when it is released or its TTL runs out, and the released record of it is kept 30 days so the room can see what happened. Rooms, tasks and messages are content you wrote: they are kept while the workspace is active and are not aged out. Telemetry is aged out: heartbeat and presence events after 7 days, other room activity after 180. Credentials go sooner: expired device authorizations and email-action tokens after 7 days, and revoked or expired CLI tokens, spent agent capabilities and completed GitHub webhook delivery ids after 30. Source code and diffs are not on this list because they are never uploaded. A webhook delivery still processing or recorded as failed is kept, because deleting it would let a redelivery repeat the work it stands for. These are the windows the scheduled maintenance job applies. You can export your account data from Settings — your profile, the workspaces you belong to, and the rooms you are a member of at that moment, with their tasks, claims, messages and activity, under a manifest naming every dataset and its row count. A room you have left is not in it, and neither are credentials: password and token hashes, agent capabilities, device codes, email tokens and room invite codes. Settings also provides permanent self-service deletion for accounts whose owned workspaces have no other members, billing history or connected GitHub App. Those edge cases are refused rather than silently orphaned; contact support@stimilon.llc to remove the external dependency first.
05Compliance Posture
Befall makes no certification claims. It holds no SOC 2 report and no ISO 27001 certificate, and none is in progress. The design intent is data minimisation — source code is never collected — but that is an engineering property, not an audited one. This policy is a plain-language description of behaviour and has not been reviewed by counsel.
06Cookies And Optional Analytics
Essential cookies keep you signed in and remember local preferences. When Google Analytics is configured, its tag is not loaded until you choose Accept analytics. It measures page use plus three fixed product events: signup, first claim activation and a webhook-confirmed paid conversion. Those events use opaque deduplication ids and fixed plan labels, never email, account text, room names, file paths, task/message content or URL query strings; advertising consent stays off. Privacy choices is available on every page where analytics is configured: choose Reject analytics there to stop collection and remove accessible Google Analytics cookies. We save this choice in a first-party cookie and browser storage for up to six months. Rejecting analytics does not block signup, billing, or coordination. Payment and product activity records needed to operate Befall are separate from optional Google Analytics.
07Controller & Contact
The data controller is Stimilon LLC (Wyoming, USA), 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Privacy requests and questions: info@stimilon.llc. Product support: support@stimilon.llc.