Agent-built pages and privacy: what we store, what we do not
A page built by an assistant is stored exactly like one built by hand — with two extra facts, and one fewer.
The two extra facts
An account or page created over the API carries a mark, *origin: agent*, and the User-Agent string the program sent — “Claude-Code/1.2”, “MyBot/0.1”, whatever it called itself. Both exist so the owner can see, in the dashboard, that a program made the key and which one. Neither is shown to visitors.
The one fewer
A provisional account has no e-mail. Until you open the claim link there is nothing in our records that points at a person: a page, a key hash, a claim-token hash. When you claim, you add an e-mail and a password hash — the same two fields any account has.
What the program learns
- What you told it. That is between you and the assistant; it does not pass through us except as page content.
- The API key and the claim link, which it should hand to you and not keep beyond what you allow.
- Statistics, if it asks: counts and a daily series. Never a visitor’s address, which we do not have either.
What visitors see
The same as on any page: the content, and nothing about how it was made. No cookie is set, no script from a third party runs, and the 18+ destinations are withheld from the page source and from the Markdown edition alike. The `page.md` view the assistant uses to check its work shows exactly what a visitor can already see.
What disappears
A provisional page nobody claims and nobody visits is unpublished after 30 days and deleted after 60 — files, statistics, keys, tokens and the account row. The name is released, not parked, because nobody ever shared it. A claimed account is never touched by this; deleting it is your action, from the account settings, and it deletes.