# Bezalel privacy policy

_Last updated: 2026-08-22._ This page describes the hosted service at
https://bezalel.sh. If you self-host a plane, none of your data touches our
infrastructure.

## What we store, and why

Bezalel exists to hold capability state for your agents, so what it
stores is exactly what you wire up:

- **Account** — sign-in is handled by Clerk; we keep your user id, name,
  and email address to key your plane data.
- **Agent tokens** — per-agent bearer tokens and their scopes. The plane
  stores one-way token hashes; it cannot recover the raw tokens.
- **Memory** — session excerpts your agents bank and the durable facts
  distilled from them. You can browse and delete ("forget") any entry
  from the dashboard.
- **Email** — messages in the inboxes your agents own, including
  content, metadata, and attachments.
- **Texting** — your iMessage pairing (the number or address you verify
  by OTP) and the messages routed through it.
- **Money** — bank account and transaction data you link via Plaid, and
  a ledger of agent spending.
- **Computer, sandboxes, connectors** — session and connection metadata,
  plus OAuth grants for the third-party apps you connect.
- **Audit trail** — a log of capability calls (who did what, when), kept
  so you can inspect exactly what your agents have done.

## Who processes it

The plane runs on Railway with data in Neon Postgres; this website runs
on Vercel. Capability providers process the data for their domain:
Clerk (auth), AgentMail (email), Photon Spectrum (iMessage), Plaid
(bank data), Supermemory (memory), Orgo (computer), E2B / Daytona /
Vercel Sandbox (sandboxes), and Composio (app connectors). Each
receives only what its capability needs.

## What we do not do

We do not sell your data, show ads, or train models on your content.
Data leaves the plane only to the providers above, only in service of
the capabilities you enabled.

## Your controls

- Revoke any agent token at any time; revoked tokens never come back.
- Forget individual memories, disconnect connectors, and unpair
  iMessage from the dashboard.
- Delete your account from Clerk's Manage account screen, or ask
  [michael@goshen.fyi](mailto:michael@goshen.fyi). A signed deletion event
  immediately revokes agent tokens, then removes bank access, active virtual
  cards, connected inboxes, memory, cloud desktops, sandboxes, and app grants
  before erasing the tenant's plane database rows. If a provider is temporarily
  unavailable, Clerk retries the signed cleanup and local data is retained
  until it completes. Temporary provider backups and required financial records
  remain subject to each provider's own retention policy.

Questions about any of this: [michael@goshen.fyi](mailto:michael@goshen.fyi).