Privacy Policy

Privacy Policy governing data collection, storage, and usage on the Claw Passport platform.

Last Updated: February 2025

This Privacy Policy explains how Claw Passport ("Platform", "Service", "we", "us", or "our") collects, uses, stores, and protects information when you use the Platform. By using Claw Passport, you agree to the practices described in this policy.

1. Information We Collect

1.1. Wallet and Authentication Data

When you connect your Solana wallet and authenticate via NFT ownership, we process:

• Public wallet address 閳?Used to verify NFT ownership and authenticate your session
• NFT asset address and attributes 閳?Read from the Solana blockchain to identify your .claw domain and agent configuration
• Ed25519 signature 閳?Used for challenge-response authentication (not stored after verification)

We do not collect, store, or have access to your wallet private keys, seed phrases, or signing keys.

1.2. Agent Data

When you use the AI agent service, the following data is generated and stored:

• Chat history and session transcripts 閳?Conversations with your AI agent
• Workspace files 閳?Custom files, skills, scripts, and memory files you create or your agent generates
• Agent configuration 閳?Identity files (IDENTITY.md, soul.md, skills.md), channel settings, and preferences
• Device identity 閳?A cryptographic device identifier used for channel pairing

1.3. Channel Integration Data

When you connect messaging platforms, we process:

• Bot tokens 閳?Telegram, Discord, and Slack bot tokens you provide for channel integrations
• Pairing data 閳?Approved device/user lists for channels using pairing mode
• Inbound messages 閳?Messages sent to your agent through connected channels are processed by your AI agent instance

1.4. LLM API Keys

If you provide your own LLM API keys (Anthropic, OpenAI, OpenRouter, etc.), these keys are stored securely and used solely to route requests to the respective LLM providers on your behalf.

1.5. On-Chain Data

All .claw domain data stored on the Solana blockchain is publicly visible by design, including:

• Domain name and NFT metadata
• Agent wallet address and transaction history
• Token launches, transfers, and all on-chain operations
• NFT ownership and transfer history

This is inherent to blockchain technology and cannot be made private.

1.6. Automatically Collected Data

We may collect standard web analytics data including:

• IP address
• Browser type and version
• Device information
• Pages visited and usage patterns
• Referring URLs

2. How We Use Your Information

We use collected information to:

• Authenticate your identity via Solana wallet and NFT ownership
• Provision and operate your AI agent instance
• Store and restore your agent data across container restarts (via R2 snapshots)
• Route LLM requests to configured providers
• Deliver messages between your connected channels and your AI agent
• Maintain platform security 閳?detect abuse, prevent unauthorized access, and enforce Terms of Service
• Improve the Platform 閳?analyze usage patterns, debug issues, and develop new features
• Communicate with you 閳?platform announcements, service updates, and critical notices

3. How We Store Your Data

3.1. Agent Data Storage

Agent data (chat history, workspace, memory, configuration) is stored on Tencent Cloud COS object storage. Data is organized by user and isolated 閳?each .claw domain's data is stored in a separate path and is not accessible to other users.

3.2. Sensitive Credential Storage

Sensitive credentials follow strict handling rules:

• LLM API keys 閳?Stored in R2 with restricted access. Never exposed in API responses (redacted to first 8 characters). Excluded from container snapshots and written fresh on every startup.
• Bot tokens 閳?Stored on user records in R2. Written to container config on startup only. Excluded from snapshots.
• Wallet keys 閳?Written to containers with restricted file permissions. Excluded from snapshots. Never exposed to users.

3.3. On-Chain Data

Data written to the Solana blockchain (domain registration, wallet transactions, token operations) is permanent and publicly accessible. We cannot delete, modify, or restrict access to on-chain data.

3.4. Container Data

Active container data exists only while the container is running. When a container sleeps, data is preserved via R2 snapshots. Containers are ephemeral 閳?a fresh container is provisioned on each wake, and data is restored from the snapshot.

4. Data Sharing

4.1. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or agent data to third parties.

4.2. Third-Party Service Providers

Your data may be processed by the following third-party services as part of Platform operations:

Each third-party provider is governed by their own privacy policy. We encourage you to review them.

4.3. LLM Provider Data Sharing

When your AI agent processes messages, the content of those messages is sent to the configured LLM provider for inference. This includes:

• User messages and conversation context
• System prompts and agent configuration relevant to the request

We do not control how LLM providers handle, store, or use this data. Please review the privacy policies of the relevant providers:

• Anthropic Privacy Policy
• OpenAI Privacy Policy
• OpenRouter Privacy Policy

4.4. Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, prevent fraud, or ensure user safety.

5. Data Retention

5.1. Active Accounts

Agent data is retained as long as your .claw domain exists and is associated with the Platform. Snapshots are updated regularly and overwrite previous versions.

5.2. Domain Transfer

When a .claw domain is transferred or sold, the associated agent data (snapshots, workspace, chat history) transfers with the domain to the new owner. The previous owner loses access.

5.3. Service Termination

If the AI agent service is terminated for your domain (either by you or by us), we may delete associated container data, snapshots, and R2 storage after a reasonable notice period. On-chain data cannot be deleted.

5.4. Data Deletion Requests

You may request deletion of your off-chain data (R2 storage, snapshots, user records) by contacting us. We will process deletion requests within a reasonable timeframe, subject to any legal retention obligations. On-chain data cannot be deleted due to the nature of blockchain technology.

6. Data Security

We implement reasonable security measures to protect your data, including:

• Container isolation 閳?Each user's agent runs in a separate, isolated container
• Credential exclusion 閳?Sensitive files (API keys, wallet keys, bot tokens) are excluded from snapshots and written fresh on every startup
• Restricted file permissions 閳?Credential files inside containers use restrictive access controls
• Authentication 閳?JWT-based session management with HttpOnly cookies
• Anti-replay protection 閳?Nonce-based challenge-response for wallet authentication

However, no system is 100% secure. We cannot guarantee absolute security against unauthorized access, data breaches, or other security incidents. You use the Platform at your own risk.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access 閳?Request a copy of the data we hold about you
• Correction 閳?Request correction of inaccurate data
• Deletion 閳?Request deletion of your off-chain data (on-chain data cannot be deleted)
• Portability 閳?Request your data in a portable format
• Objection 閳?Object to certain processing of your data

To exercise these rights, contact us via the channels listed below. We will respond within a reasonable timeframe.

8. Children's Privacy

The Platform is not intended for use by anyone under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect data from minors. If we become aware that a minor is using the Platform, we will take steps to terminate their access and delete associated data.

9. Blockchain and Public Data

By using the Platform, you acknowledge and accept that:

• All Solana blockchain transactions are publicly visible and permanent
• Your wallet address, .claw domain name, agent wallet transactions, token launches, and NFT activity are publicly accessible on blockchain explorers
• We cannot delete, redact, or restrict access to on-chain data
• Domain profile pages displaying your domain name, wallet addresses, and NFT metadata are publicly accessible

If privacy is a concern, consider using a dedicated wallet for .claw domain activity that is not linked to your personal identity.

10. Future Changes

10.1. Advertising

We may introduce ads in LLM output for free-tier users in the future. If implemented, ad-related data collection will be described in an updated version of this policy.

10.2. $CLAWID Token

If the $CLAWID token is issued in the future, any data collection related to token distribution, staking, or governance will be covered by an updated version of this policy or separate token-specific terms.

10.3. Premium Tiers

If premium subscription tiers are introduced, additional data (e.g., payment information) may be collected and will be described in an updated version of this policy.

11. Changes to This Policy

We may update this Privacy Policy at any time. Changes will be effective upon posting the updated policy to the Platform with a revised "Last Updated" date. Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy.

For material changes, we will make reasonable efforts to notify users.

12. Contact

For privacy-related questions or data requests, reach out to us on Twitter/X.