Privacy policy

Last updated: 2026-09-05. This page describes the hosted service at bezalel.sh. If you self-host a plane, none of your data touches our infrastructure.

What we store, and why

Bezalel exists to hold capability state for your agents, so what it stores is exactly what you wire up:

• Account — sign-in is handled by Clerk; we keep your name and email there, and use your Clerk user id as the tenant key on plane data.
• Agent tokens — per-agent bearer tokens and their scopes. The plane stores one-way token hashes; for the initial onboarding token, the hosted dashboard keeps the raw value in Clerk private metadata so it can show it back only to your signed-in account.
• Memory — session excerpts your agents bank and the durable facts distilled from them. You can browse and delete (“forget”) any entry from the dashboard.
• Email — messages in the inboxes your agents own, including content, metadata, and attachments.
• Texting — your iMessage pairing (the number or address you verify by OTP) and the messages routed through it.
• Money — bank account and transaction data you link via Plaid, and a ledger of agent spending.
• Computer, sandboxes, connectors — session and connection metadata, plus OAuth grants for the third-party apps you connect.
• Audit trail — a log of capability calls (who did what, when), kept so you can inspect exactly what your agents have done.

Who processes it

The plane runs on Railway with data in Neon Postgres; this website runs on Vercel. Capability providers process the data for their domain: Clerk (auth), AgentMail (email), Photon Spectrum (iMessage), Plaid (bank data), OpenAI (memory extraction and embeddings), Supermemory (legacy memory), Orgo (computer), E2B / Daytona / Vercel Sandbox (sandboxes), and Composio (app connectors). Each receives only what its capability needs.

When product analytics is enabled, PostHog receives your account and agent IDs, page categories, tool names, setup milestones, message counts, outcomes, and timings. Its browser SDK stores identifiers to connect visits. We exclude message content, tool arguments and results, credentials, financial details, and page URLs. Session recording is disabled. Self-hosted installations send these events only when their operator configures PostHog.

What we do not do

We do not sell your data, show ads, or train models on your content. The providers above process capability data and the limited analytics described here.

Your controls

• Revoke any agent token at any time; revoked tokens never come back.
• Forget individual memories, disconnect connectors, and unpair iMessage from the dashboard.
• Delete your account from Clerk's Manage account screen, or ask michael@goshen.fyi. A signed deletion event immediately revokes agent tokens, then removes bank access, active virtual cards, connected inboxes, memory, cloud desktops, sandboxes, and app grants before erasing the tenant's plane database rows. If a provider is temporarily unavailable, Clerk retries the signed cleanup and local data is retained until it completes. Temporary provider backups and required financial records remain subject to each provider's own retention policy.

Questions about any of this: michael@goshen.fyi.