Privacy Policy

Effective 2026-05-21

Windy Connect (the windy CLI + the orchestrator Worker at api.windyconnect.com) is the agent-onboarding kernel of the Windy ecosystem. This policy describes what data we collect when you pair your agent with us, how we use it, and how to get rid of it.

What we collect

Your email address — needed to send the magic-link pair confirmation and to create your Windy Mail mailbox.
An ephemeral pair-session token — a 15-minute device code generated by your CLI and shown in your browser. Stored only for the duration of the pair flow, then deleted.
An Eternitas Passport ID — a string of the form ET26-XXXX-XXXX that identifies your paired agent.
Cloudflare access logs — standard request logs at our edge: IP address, user-agent, path, status code. Retained ≤30 days, used only for abuse detection.

We do not collect: your real-world identity (only the email you choose to use), your messages, your agent's outputs, billing information (Windy Connect itself is free), or any browsing data outside the pair flow.

How we use it

To deliver the magic-link pair confirmation via Resend.
To mint an Eternitas Passport Token (EPT) — a JWT that lets your agent authenticate to other Windy services.
To provision your Windy Mail mailbox (Stalwart server at mail.windymail.ai) and Windy Chat identity.
To diagnose service issues from the access logs above.

We do not: sell or share your email with third parties; serve ads; profile you; train AI models on your data.

How long we keep it

Pair session (15 min) — deleted automatically by the Durable Object's TTL.
Eternitas Passport — for as long as you want. Run how to delete below to revoke.
Mailbox contents — controlled by Windy Mail, not Windy Connect. See the Windy Mail privacy policy when published.
Access logs — 30 days max at Cloudflare's edge.

How to delete your data

The windy CLI ships with a one-command reversal:

windy disconnect --yes

This:

Deletes every file we wrote on your machine
Strips every marker-bounded config block we touched
Marks your Eternitas Passport for revocation

For full account deletion (mailbox + passport + audit trail), email [email protected]. We respond within 7 business days; deletion completes within 30.

Subprocessors

We use the following service providers to operate Windy Connect. We have data-processing agreements with each:

Cloudflare, Inc. — edge hosting + DNS for *.windyconnect.com and the orchestrator Worker
Resend — transactional email delivery for the magic-link pair confirmation
Amazon Web Services — Stalwart mail server, Synapse Matrix homeserver (Windy Chat), Eternitas registry
GitHub, Inc. — public source code repository
PyPI — Python package distribution

Children's privacy

Windy Connect is not directed at children under 13. We do not knowingly collect data from anyone under 13. If we learn we have, we'll delete it.

Changes to this policy

We'll update the "Effective" date above and link to the previous version from the GitHub repo's CHANGELOG.md if anything material changes.

Contact

Email [email protected] for any privacy question. Security issues go to [email protected] per SECURITY.md.

Windstorm Labs LLC · MIT-licensed source at github.com/sneakyfree/windy-connect

This document is informational and not legal advice. We recommend reviewing with counsel before relying on it commercially.