Privacy
How the GOAT Connect invite-only beta processes your data. The beta is limited to 50 users.
Updated 28 October 2026
Delete GOAT Connect account
Operator and contact
GOAT Connect is operated by 김병준 (Kim Byungjun), who also handles security incidents. For privacy requests, account deletion, support or abuse reports, email:
What this policy covers
This policy covers the hosted GOAT Connect service and this marketing website. Connect is optional: running GOAT on your own machines does not by itself upload your projects or conversations to Connect. Your coding agent providers have their own data practices.
Sign-in and account data
Clerk handles Connect sign-in, account identifiers, email addresses, profile information you supply and authentication data. The relay verifies Clerk credentials and uses your account identifier to associate your devices and environments. The sign-in service uses session credentials and may use cookies; the static marketing website does not set cookies.
Environment and device records
To link your machines and route connections, the relay stores account and environment identifiers, labels, public keys, endpoint URLs, tunnel and DNS allocation details, the local tunnel origin, link preferences and timestamps. It also stores hashed environment credentials, revocation records and short-lived proof identifiers used to prevent replay.
For mobile notifications, it stores device identifiers and labels, platform and OS version, app version and bundle identifier, notification preferences, APNs or FCM push tokens, and iOS Live Activity tokens when supplied. These tokens let us deliver updates to your device.
Activity updates and push notifications
The relay processes agent activity updates: environment and thread identifiers, project and thread titles, model names, status, headline, optional detail, timestamps and links back to the thread. Titles and status text can contain information about your work. Updates and notification payloads may be held in delivery queues and sent to Apple APNs or Google FCM, depending on your device and preferences.
Delivery records include account, environment, thread and device identifiers, delivery results, errors and a token suffix. Notification content can appear on your lock screen. You can disable notifications or Live Activities in your preferences.
Tunnel traffic and optional held webhooks
Cloudflare provides the managed tunnels and handles network requests, including IP addresses and request metadata. After connection bootstrap, normal HTTP and WebSocket application traffic goes through Cloudflare to your environment, rather than through the relay Worker. Cloudflare terminates HTTPS; this is not end-to-end encryption that hides application content from the infrastructure provider. The relay is a trusted connection broker, not a zero-knowledge service.
Automation webhooks are forwarded by the relay. By default it does not persist webhook requests. If you enable holding webhooks while offline, a Cloudflare Durable Object stores the raw request, including its body, headers, query and hook token, so it can retry delivery. Do not send secrets or personal data you do not need in webhooks.
Service providers and diagnostics
We use this data to authenticate you, connect your machines, deliver notifications and webhooks, diagnose failures and protect the service. The configured infrastructure uses Clerk for identity, Cloudflare for the relay, tunnels, queues and held webhooks, PlanetScale Postgres for relay records, Axiom for diagnostics, Apple APNs for iOS delivery and Google FCM for Android delivery.
Axiom tracing is configured for relay requests and first-party client diagnostics. Traces can include identifiers, request methods and paths, response status, timing and errors. The webhook forwarding path redacts hook tokens and does not attach webhook bodies to its traces. Turning off GOAT product usage telemetry does not turn off Connect operational diagnostics.
These providers may process data outside your country. The current relay database configuration selects PlanetScale's US West region. Other processing locations and provider retention depend on the service and deployment; this policy does not promise that data stays in Korea.
How long data remains
Held webhooks are removed after an environment response, after 24 hours, or when the environment has no remaining linked user. Expiry is enforced by background processing, so cleanup can be delayed by failures. Maintenance also removes expired replay proofs and terminal activity rows older than 30 minutes. The Axiom trace dataset is configured for 30-day retention.
The current relay has no automatic expiry for several other records, including delivery attempts, revoked credentials and non-terminal activity. Unlinking an environment revokes its link and attempts tunnel cleanup; it is not account-wide erasure. We cannot promise an automatic deletion deadline for all Connect data or provider backups.
Access, correction and account deletion
Email the contact above to request access to or correction of your data, stop using Connect, or request deletion of your Connect account and associated hosted data. Use your account email and describe the request; do not send passwords, authentication codes or push tokens. We may need to verify that the account is yours.
Account-wide self-service deletion is not available in the current beta implementation. Requests require operator follow-up across Clerk, relay records, push registrations, held webhooks and tunnel resources. Signing out, unlinking, or deleting a Clerk account alone should not be treated as deletion of all Connect data or revocation of every existing environment session. Your local project files and thread history remain on your machines; manage them there.
If you have a privacy concern or want to exercise rights available under applicable law, use the same contact. We will post policy revisions here with an updated date.
This website
This site loads no analytics scripts and sets no cookies.
It is a static site. Its host may log requests, including your IP address. GitHub Pages, which serves the preview of this site, does this for security purposes.
The download page asks the GitHub API for the newest release from your browser, so GitHub receives that request too.
Product usage data
The GOAT server sends product usage events, associated with a hashed account or installation identifier, to GOAT's own endpoint, which deletes them within 180 days of arrival and forwards them to no one. Deleted events can remain in the database's recovery backups for up to 30 more days, and deletion is delayed while cleanup is down. Events include the provider, model, permission mode, turn result and duration.
Events do not include prompts, responses, file contents, authentication tokens or conversation IDs, and the endpoint does not store your IP address.
Set GOAT_TELEMETRY_ENABLED=false in the server's environment to turn them off.