Privacy

This policy covers the Hub at oloop.run and its API. The oloop CLI runs agents on your machine.

Handles and email

The reservation form sends your handle and email to the Hub. We use your email to bind the handle to your mailbox, verify mailbox control, send sign-in links, and recover a lost key. Account records also hold status and key hashes. The form reserves a handle. The CLI completes the claim.

Reservation records expire after 15 minutes. Direct CLI claims and recovery requests use a 48-hour pending expiry. Active account records have no scheduled expiry. Raw verification mail expires from private storage after 30 days.

Public content

Published manifests, agent files, model rows, handles, and version history are public. The Hub also serves public indexes and per-artifact request counts. Do not publish secrets or private data.

Deleting an agent removes its latest listing. Old version pins remain available unless operators withdraw the artifact. Storage keeps prior object versions. Removal cannot recall copies that other people downloaded.

Recommendations and machine data

The oloop CLI recommends setups for your machine. To do that, it sends a coarse machine profile and your use of public manifests to oloop.run. Recommendations are on by default. This is the exact first-send notice:

Recommendations are on.
oloop sends your machine class and your use of public manifests to oloop.run.
This powers your recommendations, public counts, and run results.
Verified runs are public under your handle.
It sends no prompts, files, paths, or keys.
See what is sent: oloop recommendations status. Turn off: oloop recommendations off.

It sends no prompts, files, paths, or keys. Usage events fire automatically on exec and host start. Pulls are observed by the server, not reported by the CLI. A Verified run is public under your handle. Turn automatic sends off with oloop recommendations off; list the exact fields with oloop recommendations status. Hub commands such as pull, publish, and login, and model calls, still use the network when recommendations are off.

The session machine profile exists only for that sign-in, up to 30 days. Clear it at any time with DELETE /api/session/machine. The hub marks the handle for recomputation, and the next hourly rollup recomputes that handle's aggregates from the stored records. Clearing stops future sends from that session; it does not erase counters already aggregated. The site's Clear control removes the filter in your browser only; it does not delete the stored profile.

Data inventory

This table lists every field the recommendations feature can send, its purpose, destination, retention, and how to remove it.

Request logs and counts

Private request logs contain IP addresses, requested paths, and full query strings. Query strings can include one-time sign-in tokens. Logs support diagnostics and hourly request counts. They expire after 30 days.

Counts measure requests, not runs or users. Bots and repeated requests count. The dashboard shows recent daily counts and a total from stored rows. Counter rows have no scheduled expiry.

The Hub uses hashes of IP addresses and email addresses for rate limits.

Public a/<owner>/<artifact>/evidence.json files contain per-artifact request counts. They contain no visitor identifiers or IP addresses. The hourly process rewrites a file when that artifact has new requests.

Counts that name a handle, such as u/<handle>/stats.json, Verified runs, and pulls, are public under that handle. They are not anonymous. Machine-class breakdowns are shown only as aggregates that meet the distinct-handle floor.

Cookies and browser storage

The Hub uses a secure, HttpOnly session cookie for browser sign-in. Sessions expire after 30 days. Sign-in links work once and expire after 10 minutes. Sign-out revokes the current session. Key rotation and completed key recovery revoke the handle's sessions.

The reservation form stores the handle in your browser's local storage. Config pages use it to hide the claim prompt. It does not prove that a claim is complete. You can remove it through your browser settings.

Record expiry and physical deletion are separate. Expired records can remain until the storage service removes them.

Google Analytics

The site loads Google Analytics 4 on every page for page-view statistics. The tag sends page URLs, paths, referrers, and device and browser information to Google. Google Analytics uses cookies. Opting out of recommendations does not remove the analytics tag.

Public URLs such as /u/<handle>, /a/<handle>/<artifact>, and /@<handle>/<slug> contain handles. Those handles can reach Google through page URLs or referrers. The HttpOnly session cookie does not remove handles from URLs.

Google's retention is separate from the Hub's log retention. See Google's privacy policy. Blocking the analytics tag does not prevent the site's other features from working. The Hub's request counters come from server logs.

Handle payments

If you buy a priced handle, Stripe handles checkout. The Hub records the handle, price, currency, and checkout session ID. Paid records expire after two years. Payment event records expire after 90 days. Stripe handles payment information under its privacy policy.

Data questions

Stop future automatic sends with oloop recommendations off. Send account or data deletion questions to support@oloop.run. Removing a local CLI folder does not delete Hub records or public copies.