Privacy Policy

• Account info (email, display name) from Google Sign-In or email login
• OAuth tokens for services you connect (e.g. GitHub, Google Cloud) — encrypted with AES-256-GCM at rest
• Chat messages and task history within your workspace
• Usage data (tasks run, USD Balance used, features accessed)

• We never store your AI provider API keys — not even encrypted. BYOK (Bring Your Own Key) keys stay on your device (browser or Taichu local storage) and are sent per-request only; keys included with a request are used in memory to route the call and are never persisted or logged
• BYOK mode: your API keys are stored only on your device (browser storage or Taichu local storage) — never on GWC servers. When you run a BYOK request through GWC Cloud, the key is transmitted with that request over TLS, used in memory to route the call to your AI provider, and never persisted or logged
• GWC processes workspace information when you use a feature that needs it, within the access you authorize. For GWC Bridge, file and document tools use the folders and permissions you grant. Separately enabled commands, processes and Taichu tasks run with your Windows-user rights and are not restricted to those folders merely by the file-sharing settings.
• We don't sell your data. Service providers process data as described under AI Providers and Third-Party Services below
• If you use local API key management, your keys never reach our servers at all

• To provide the GWC platform and process your AI requests
• To route AI requests using your own keys or your USD Balance
• To maintain billing and subscription status
• We do not use your data to train AI models

When you run an AI request, your prompt — including relevant chat history, code, and workspace file context — is transmitted to the AI provider serving that request (e.g. OpenAI, Google, Anthropic, BytePlus). If your selected model is unavailable, a failover provider processes the request instead (see the Terms of Service for the failover chain).

Requests funded through USD Balance use GWC-managed provider accounts. Where a provider offers a setting to exclude API traffic from model training, we enable it; where a provider does not offer that option, its standard terms apply to the request. BYOK uses your own provider account and agreement, and that provider's data retention and privacy policies apply. Cloud BYOK requests pass through GWC as described in the AI requests section above. Only requests sent directly from your device to the provider bypass GWC's AI inference relay; GWC account and connection processing still applies.

Where your prompt is processed depends on the model you choose. Providers operate their own infrastructure in their own jurisdictions, and each applies its own retention policy to the request — which may differ from ours and may change without notice to us. In particular, models served by DeepSeek are processed on DeepSeek's infrastructure in the People's Republic of China; models served by Z.AI (Zhipu, the GLM family) are processed by Z.AI, whose operator is based in the People's Republic of China; models served by Alibaba Cloud (Qwen) are processed on Alibaba Cloud's international DashScope endpoint, operated by a company based in the People's Republic of China; models served by BytePlus are processed in Singapore; and models served by Anthropic, OpenAI, Google and xAI are processed on those providers' infrastructure under their published API terms.

If your country restricts the use of AI services processed in another region, do not use GWC USD Balance routing. BYOK lets you use your own provider account and agreement; it does not by itself guarantee data residency or bypass GWC. Cloud BYOK requests pass through GWC. Only requests sent directly from your device to the provider bypass GWC's AI inference relay; GWC account and connection processing still applies. Check the actual request route and provider agreement against your requirements. Checking what your country permits is your responsibility — we do not verify the identity, nationality, or location of our users. See the Terms of Service for more.

Your account data, billing records and conversation history are stored in a CockroachDB cluster that GWC runs on its own servers — no managed database provider holds your data. The cluster spans four regions: Singapore (primary), Frankfurt, Seoul and New Jersey. For durability, every record is replicated to at least three of those regions, so your data is stored in the European Union, Korea and the United States as well as Singapore. Data is isolated per account: every record is scoped to your user ID and protected by authenticated access controls. Backup copies of this database are also held off-site in Cloudflare R2 object storage under GWC's own account — see Data Retention below.

Google Cloud services. Three Google services process data on GWC's behalf. Secret Manager stores the connection credentials you provide when you connect an external vault or service — these are your secrets, held encrypted and used only to make the connection you asked for. Cloud Storage holds the documents Creative generates for you. Gmail SMTP delivers transactional email — sign-in magic links and verification codes — which means your email address passes through Google to reach you. None of the three is used for advertising or profiling, and none receives your conversations or code.

Cloud Routing: Requests billed to your USD Balance run through GWC-managed provider accounts — your own AI provider keys are never stored on our servers. OAuth tokens for connected services are encrypted with AES-256-GCM at rest.

BYOK Mode: When using BYOK (Bring Your Own Key), your API keys are stored only on your device (browser storage or Taichu local storage). GWC servers never persist your BYOK keys. Keys sent with a request (including live key validation) are used only in memory for that request and are never written to storage or logs.

Conversation content you create in the web and mobile apps is retained until you delete it. Deleting a conversation removes it from the live database; deleting your account removes account data from the live service, subject to the retention exceptions below.

Local database backup archives are normally eligible for cleanup after 14 days once that individual backup has been successfully copied to our private off-site object storage. If its off-site copy has not been verified, we keep the local archive longer rather than delete the only known good copy. Off-site backup copies do not currently have an automatic age-based deletion rule and are retained until GWC removes them. Deleted content may therefore persist in a backup after you remove it from the live service.

Billing records — token counts, cost, model and timestamp, never the content of your prompts or replies — are retained for as long as required to operate your account and meet our tax and accounting obligations.

Records from retired GWC commerce services may be retained only as needed to settle or refund historical transactions, resolve disputes, and meet legal and accounting obligations. This can include order records, messages, listing metadata, credentials, and customer deliverables. No new commerce transactions are accepted.

Retention by an AI provider is governed by that provider, not by us. Deleting content from GWC does not delete any copy the provider may hold under its own policy.

• Export: download your profile, credit balance, your most recent 1,000 usage records, your project list, your saved agents and your preferences as JSON, anytime. Conversation content and project file contents are not included in the export
• Delete: Request full account deletion — how to delete your account
• Portability: the export is a machine-readable JSON file you can take elsewhere. We do not currently offer a code or project-file archive download
• Account deletion is scheduled 30 days after confirmation. The retention exceptions above still apply

GWC integrates with services you connect (Google Cloud, Stripe, GitHub, AI providers). Each service has its own privacy policy. We only share the minimum data needed for the integration to work.

GWC Bridge connects ChatGPT remotely to a computer you authorize through a supported version of GWC Studio or GWC for VS Code. File and document tools can list, read, search, create, edit, copy, move, delete and restore supported items in folders you share and grant. Your connection permissions and the capabilities enabled on the PC determine which operations are available. A folder with file changes disabled cannot be changed through those file tools just because a ChatGPT confirmation setting is permissive.

ChatGPT's own permissions determine when it asks before tools run; Claude has separate connector and tool permission settings. GWC has no operational four-level tool-approval selector or shared PC/Web/Mobile approval cards; older desktop builds may still display a read-only legacy level. GWC Web and GWC Connect mobile provide Cloud and linked-computer monitoring and inactive-computer removal, not access switches. GWC Studio or GWC for VS Code is where you register the computer and control Bridge On/Off. ChatGPT and Claude access may currently be status-only readouts rather than separate desktop switches; review or revoke their individual OAuth connected-app grants when necessary. Neither client tool approvals nor Bridge controls expand your folders or OAuth grants.

Commands, process input and Taichu tasks run with the operating-system user rights of the account running GWC. They are not sandboxed or confined to your shared folders by the file-sharing settings: they may use the network or access other data that user account can access. Secret-file protection is enabled for GWC's protected file operations. The supported Bridge settings do not offer a control to disable it. It is not a guarantee that arbitrary commands or task instructions cannot access sensitive data.

If you enable system-process access, results can include program names, process IDs, executable paths, process creation times, and CPU and memory measurements. Executable paths may be absolute and may reveal an operating-system username or installed software. Ending a process requires its current identity and an enabled capability; GWC refuses protected critical and GWC/VS Code processes.

Direct file, command and process tools do not start a Taichu model session. Explicitly delegated Taichu tasks receive the instructions and model choice you submit and may use the files, programs, provider connections and network access available to your configured Taichu runtime. Task instructions and relevant context may be processed by the AI providers used by that runtime. GWC-managed model use can consume your GWC USD Balance; use of your own keys or provider sign-in can incur that provider's charges. Task data and provider handling are also subject to the applicable Taichu settings and provider terms, not just the relay-buffer rules below.

To carry out your requests, GWC processes the relevant tool inputs and results. These can include account and connection information, device names, folder identifiers and labels, relative file paths, file and document contents or images, search text and matches, proposed edits, command text, process input/output, process metadata, task instructions/results, and the activity entries or usage information you request. A folder label is not the folder's absolute path; file contents, command output and process information can nevertheless themselves contain paths or other personal information.

Delivery buffers can contain encrypted copies of request data, including proposed edits, command text and task instructions. Depending on the relay path, these buffers are held in Redis, our database, or both, and request data may remain after a tool finishes until acknowledgement, expiry handling and cleanup remove it. Returned tool results are forwarded through live response handling rather than saved as a Remote Connect results history. GWC processes this data to deliver the service; this is not an end-to-end encrypted channel that hides the data from GWC.

Remote Connect requests have a short delivery-validity window; that is not a promise of immediate erasure. Expired database delivery records are scheduled for cleanup every ten minutes. Cache copies have separate acknowledgement, expiry and cleanup mechanisms, and failures can delay removal. Database backups may contain buffered request data after live cleanup. The backup retention described under Data Retention applies, including off-site copies retained until we remove them; there is no promise that every copy is erased when a tool returns.

GWC also keeps connection and security records such as the account, client, device and folder identifiers, selected permissions, connection/revocation times and available last-used information. Revoked ChatGPT connections and folders no longer shared are removed from the live GWC Bridge store after 30 days, normally on the next successful hourly cleanup. OAuth consent requests default to 10 minutes, authorization codes to 1 minute, access tokens to 30 minutes and refresh tokens to 30 days. Device lifecycle/settings history and GWC Bridge audit records do not currently have a separate age limit while the account exists; they are removed with account deletion. Operational API request/application logs likewise do not currently have a fixed age limit in our reviewed deployment configuration. GWC Bridge's state-changing usage counters in shared Redis expire after two days; its fixed-window rate-limit records expire after two minutes and its current token-bucket state after about 40 seconds when idle. Existing last-used information is not erased simply because the connection is revoked. In the full-tool release, a connection's last-used time reflects its most recent successful state-changing call: successful read-only calls do not append a PC activity entry or update that timestamp, and independent connection checks maintain online and last-seen status.

The PC activity log records GWC Bridge state-changing and elevated actions while it is on. You control it on the PC; while it is off, those actions still run within your capabilities and confirmations but are not recorded. It records targets, approval decisions and outcomes, never returned file/document contents, command/process output or Taichu answers. Retention defaults to 30 days; GWC Bridge can lengthen it but cannot shorten it or turn the log on or off. Targets can include a folder label, relative path, command text or another action target and can themselves contain sensitive information, so do not put secrets in them. A shorter retention period, if the local product offers one, must be selected on the PC. The log is stored on the PC, and requested activity entries can be returned to ChatGPT through GWC Bridge. Successful read-only calls, including viewing activity, do not create their own activity entry.

Long-running search sessions temporarily hold their query, progress and bounded results in PC memory. You can read pages without consuming them, list your sessions, or stop and discard a search. Sessions expire and do not survive a daemon restart. Stopping a search does not recall results already delivered to ChatGPT. The relay handling described above also applies when search instructions or results pass through GWC.

If you grant the optional feedback:write permission and use Give feedback, the message and optional category you submit are sent to GWC support/product staff, together with the account reference needed to handle the submission. No automatic file, command-output or diagnostic attachment is included. Feedback is an intentional submission, not a passive tool-activity record. We remove it from the live feedback store within 90 days of submission. For earlier deletion, contact [email protected] with the feedback reference. Copies in backups follow Data Retention above.

The Set PC settings tool can change only the device's display name or lengthen the number of days kept in its activity log, within supported limits. It cannot turn off logging, change secret protection, grant access to more folders, enable a capability or change local approval rules. These tool limits are separate from desktop owner controls in GWC Studio or GWC for VS Code. Web and mobile show connection status and allow inactive-computer removal; they do not offer access or permission switches. Bridge On/Off changes must be checked on the computer. Its ChatGPT and Claude access entries may only be status readouts. A displayed or saved setting is not proof of effective permission, especially while the computer is offline. ChatGPT and Claude confirmation controls and independent protected-action checks still apply.

The Disconnect PC tool stops the selected computer's Remote Connect relay until the owner reconnects through the desktop GWC Studio or GWC for VS Code controls; it does not shut down the computer. It is not the same as revoking an OAuth connection or deleting stored data. To remove a connected app's authority, revoke the connection in Settings → Connected apps on the GWC website. Disconnecting, stopping sharing or revoking access does not undo completed edits, recall data already sent, reverse charges, or guarantee that every process, task or external descendant has stopped.

Tool results sent to ChatGPT/OpenAI are handled under OpenAI's terms, privacy policy and the settings applicable to your account or workspace. GWC's buffer cleanup, search expiry, local-log retention and revocation do not control copies held in your ChatGPT conversation or by other providers.

When you connect GWC Bridge from Claude, everything in "GWC Bridge for ChatGPT" above applies in the same way, with these differences. Claude's connector tool permissions (Always allow, Needs approval or Blocked), not a ChatGPT setting, affect when Claude asks before an action.

Tool results and requested activity entries are sent to Claude and are handled by Anthropic under its terms, its privacy policy and the settings applicable to your account or workspace. GWC's buffer cleanup, search expiry, local-log retention and revocation do not control copies held in your Claude conversation.

The GWC AI mobile app (com.gwc.ai, iOS and Android) accesses the following device capabilities, each only for the feature named:

• Camera & photos: only when you attach an image to a chat or capture one for a task. Attachments are treated as chat content (see "What We Collect").
• Microphone: voice input is transcribed by your device's platform speech recognition (Apple on iOS, Google on Android), which may process the audio on that vendor's servers under its own privacy policy. GWC receives only the resulting text — raw audio is never sent to our servers.
• Notifications: a Firebase Cloud Messaging (FCM) push token is used to deliver notifications. It is a device identifier, not location or contact data.
• Local network: GWC Connect reaches your own computer through GWC's authenticated cloud relay. An optional WebRTC connection can carry data directly between paired devices, with cloud signaling and a relay fallback. This uses device and network information to establish the connection — the app requests no GPS/location access.
• On-device storage: session tokens and any BYOK keys are held in the platform secure store on your device, never on our servers.

Purchases and subscriptions are managed on our website; the mobile app displays usage and balance only and initiates no in-app purchases.

Questions about privacy? Email us at [email protected].

To report harmful or offensive AI output, email the same address with the subject "AI Safety".