Privacy Policy.
Effective November 2, 2026.
This policy explains what Ancha Labs ("we", "us") collects when you use ancha.io, the hosted workspace at app.ancha.io, the @ancha-labs/cli command-line tool and our documentation, and what we do with it.
What we collect
- Account: your email address and sign-in records. Sign-in is handled by Supabase Auth. If you set a password, it is stored only as a hash.
- Workspace content: what you bring to Ancha and what runs produce:
- agent code you upload or clone;
- configurations, tests and worlds;
- runs and attempts, including tool calls and the final state of each simulated tool;
- secrets you add for your agent, such as your own model provider key.
- CLI: when you sign in from the CLI, a short-lived device code links it to your account. API keys are shown once and stored only as hashes. The CLI doesn't send us usage telemetry.
- Forms: what you send through forms on ancha.io, such as your email, the tool you're asking for and what your agent does with it.
- Technical data: server logs with IP addresses and request details, used for security and debugging. We keep them for up to 30 days.
- Website analytics: ancha.io counts page views and clicks on demo and quickstart links with Vercel Web Analytics. Click events include the link placement (such as the hero or footer) and an AI referrer category when it is available. They do not include trace contents, URL query parameters or customer records. Each page view records the time, the page, the referrer, the visitor's country, region and city, and the browser, operating system and device type. A visitor is recognized by a hash of the request instead of a cookie, and the hash is discarded after 24 hours.
How we use it
- To run the service for you: host your workspace, run your agent and its tests, show you results.
- To keep Ancha secure, prevent abuse, and fix problems.
- To answer you when you contact us.
- To understand, in aggregate, how the service is used, so we can improve it.
We don't sell personal data. We don't use your content to train AI models. We don't show ads.
Language models
Some features use language models, for example simulated people, generated worlds and drafting tests. When you use them, we send the content those features need to model providers through OpenRouter. We never send your secrets. Your own agent's model calls use your keys and go to the provider you choose, under that provider's terms.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Fly.io | your workspace machine, its storage, the gateway | United States (California) |
| Supabase | sign-in and account records | United States (California) |
| Vercel | the ancha.io website and its page-view and link-click analytics | global edge network |
| Mintlify | the documentation site | global edge network |
| Cloudflare | storing form submissions | global |
| OpenRouter | routing model calls for Ancha's model features | United States |
We also disclose data when the law requires it, or to protect the rights and safety of our users or others.
Keeping and deleting data
- We keep your account and workspace while your account is active.
- To delete your account, email patrick@ancha.io. Within 30 days we delete your workspace machine and its storage, and your account records.
- Form submissions are kept until you ask us to delete them.
Your choices
You can ask us to access, correct, export or delete your personal data. Email patrick@ancha.io and we'll reply within 30 days. Depending on where you live, you may have more rights under local law, and we'll honor them.
Children
Ancha is for professionals and isn't directed to children under 16.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the product before the change takes effect.
Contact
Privacy questions: patrick@ancha.io.