Privacy Policy

Scope

This policy applies to the RunWhale mobile app and this RunWhale website. It explains our own data handling and sharing. The linked policies of model providers, Git hosts, package registries, and other connected services provide additional information about those services; they do not replace our responsibilities described here.

The app does not require a RunWhale account. It does not send usage analytics or advertising identifiers to RunWhale.

Information handled by the app

RunWhale stores projects, Git history, agent sessions, attachments, preferences, project caches, and generated project data in the app’s local container on your device. Model-provider API keys and the device's Git SSH private key are stored using the operating system’s secure storage.

RunWhale does not upload copies of your projects or Agent sessions to a RunWhale server.

Information sent to services you choose

AI features send request content and the context needed to answer it to the selected model service. Recipients, data categories, consent choices, and provider terms are described in the next section.

When you clone, fetch, pull, or push a repository, the app communicates with the Git host you specified. Installing dependencies may contact package registries. Those services process information under their own terms and privacy policies, and their retention rules are controlled by them and by your account settings.

A GitHub share link reveals the repository owner, repository name, and commit SHA. Pushing publishes the commit to GitHub under the repository's access settings; private repository access remains controlled by GitHub. Opening external websites sends connection information, including your IP address, to their hosts.

Third-party AI services

Before sharing AI request content, RunWhale identifies the selected provider and API address and asks for your explicit consent. Consent applies to that recipient; changing the provider or address requires consent again. Declining prevents the AI request.

With consent, Agent requests send prompts, conversation history, relevant source code and file contents, tool results, and any images or Preview screenshots used as context to Anthropic (Claude API), DeepSeek, Google (Gemini API), or OpenAI, according to your selection. Image generation and web search may also send request content through that provider. The receiving service gets the API key for authentication and connection information such as your IP address. These requests produce the answers, code, images, or actions you ask for and may contain personal information from your files or images.

A custom API address sends requests to that address’s operator, which may forward them to other services. A model or provider name alone does not identify that operator. Review its identity, privacy policy, and onward-sharing practices before consenting.

AI providers, data use, and retention

The following links supplement this policy. RunWhale remains responsible for how it handles and shares your data. Our requirement for third-party recipients is protection of shared personal data at least equivalent to this policy and applicable privacy requirements. Providers may process requests outside your country. Their API features, agreements, region, and account settings affect retention and training use; a consumer chat service’s rules may differ from its API rules. These summaries describe published terms as of the update date, not a promise of zero retention. For access or deletion, contact the provider or runwhale@runwhale.dev for help with requests concerning RunWhale’s processing.

• Anthropic. API inputs and outputs are not used for training by default. They are normally deleted within 30 days, with exceptions for particular features, agreements, safety enforcement, and legal obligations. Opting in or submitting feedback can permit training. Privacy policy · API data use · API data retention
• DeepSeek. The Open Platform terms apply to API use. RunWhale has not confirmed a fixed API retention period or a no-training commitment. Confirm the terms for your account with DeepSeek before sending personal information. Privacy policy · API terms
• Google (Gemini API). Gemini API data use depends on Google’s service tier and region. Unpaid services may use content for model improvement and human review; do not submit sensitive, confidential, or personal information to them. Paid-service rules exclude product-improvement use and also apply in the EEA, Switzerland, and UK. Safety logs and feature-specific retention can still apply. Privacy policy · API terms
• OpenAI. API data is not used for training unless you opt in. Abuse-monitoring logs normally last up to 30 days; safety, legal, feature-specific storage, and approved account controls can change retention. Privacy policy · API data use

Projects running in Preview

Code you run in Preview may contact its own services and process information you enter or permit it to access, including photos, camera, microphone, or location. Review the project's source and connected services before running it. Manage device permissions in system Settings. Preview content included in an agent request is sent to the selected AI service under the data-sharing choices described above.

Website hosting

This website does not include analytics scripts, advertising trackers, or application cookies. Its pages and media are static files.

When hosted on GitHub Pages, GitHub may process request information, including IP addresses, to operate and secure the service. See the GitHub Privacy Statement for its data practices and retention policies.

How information is used and shared

Information is used to provide the features you request, operate and secure the website, and diagnose problems. RunWhale does not sell your personal information or use app project content for advertising.

Information is shared with services you direct the app to use and the website hosting provider described above, or when required to comply with law, protect rights and safety, or investigate abuse.

Retention, deletion, and your choices

You control app data stored on your device. Local workspace data remains until you delete it in the app or remove the app's data on your device; temporary caches may be cleared earlier. Delete individual sessions or projects in the workspace, remove saved API keys in Settings → Models, and remove or rotate the Git SSH key in Settings. Secure-storage items may survive uninstalling the app, so remove them first. Revoke credentials with the model provider or Git host as well. Deleting local data does not delete copies already sent to a model provider, Git host, package registry, or other third party; contact that service to exercise rights over data it controls.

Withdraw AI consent in Settings → About → Privacy Policy → AI data sharing. Revocation stops active agents and prevents further model requests until you consent again. It does not remove information that a third party has already received. The app includes an offline copy of this privacy policy.

To ask about information controlled by RunWhale, request deletion, or withdraw consent where applicable, email runwhale@runwhale.dev.

If you contact support, we receive your email address and message to respond. We keep support correspondence while needed to handle your request or meet legal obligations. You can use the same address for access, correction, or other privacy requests. Do not send API keys or private keys.

Security and children

RunWhale uses technical safeguards appropriate to its local-first design, but no storage or transmission method is completely secure. Do not place secrets in project files, prompts, attachments, logs, or Preview output.

RunWhale is a developer tool and is not directed to children under 13. We do not knowingly collect personal information from children through the app.

Changes and contact

We may update this policy as RunWhale changes. The date above identifies the latest version. For product help, visit RunWhale Support. Questions and privacy requests can be sent to runwhale@runwhale.dev.