Made by Caveman
Privacy Policy
What we keep, what we never see, and how to delete your account, in plain words.
In short
- Browsing madebycaveman.com needs no account, sets no tracking cookies and runs no analytics or ads.
- A MyAgents account stores your email address, a scrambled form of your password, and the devices and computers you connect. Nothing else about you.
- Your agents, chats, sessions, files and AI provider keys never come to us. They stay on your own computer.
- We don't sell or share your information for advertising, and we only email you about your account.
- You can delete your account yourself at any time.
1.Who we are
madebycaveman.com and MyAgents are run by Tyler Coleman, doing business as Made by Caveman, PO Box 3781, Amarillo, TX 79102 ("we", "us"). We decide how your information is used: in EU and UK terms, we are the "controller". For anything about privacy, email support@madebycaveman.com.
2.What this policy covers
This policy covers the madebycaveman.com website, including the interactive MyAgents demos, and MyAgents accounts: creating one, signing in on the web, the phone app or the MyAgents app for Even Realities, and pairing your computer. The MyAgents Bridge runs on your own computer and is not operated by us; what it does there stays there (see section 5).
3.When you visit the website
- Server logs. Our hosting provider, Vercel, handles every request and records technical details such as your IP address, browser identifier, the page requested and the time, to deliver the site and protect it from abuse. We don't use these logs to identify or profile visitors.
- Fonts. Pages load fonts from Google Fonts, so your browser connects to Google and Google receives your IP address.
- No tracking. There are no analytics, advertising or social-media trackers, and no cookies are set while you only browse. No third party collects information about your activity on this site over time or across other websites.
- Do Not Track and Global Privacy Control. Because we don't track you, these browser signals change nothing here: there's nothing to switch off. We treat a Global Privacy Control signal as a request not to sell or share your information, which we never do anyway.
- The demos run entirely in your browser on made-up sample data. They are technically blocked from connecting to anything, so nothing you do in them is sent to us or anyone else.
4.When you have a MyAgents account
| What | Details | Why |
|---|---|---|
| Account | Email address; a display name (at first, the part of your email before the "@"); whether your email is confirmed; when the account was created and last changed. | To give you an account and contact you about it. |
| Password | Only a one-way scrambled form (a "hash"). We never store or see your password itself. | To check your password when you sign in. |
| Google sign-in (only if you use it) | Your Google account identifier, name, email address and profile picture link, and the sign-in tokens Google issues, which we store encrypted. We ask Google only for your basic profile and email address. Never Gmail, Drive, Calendar or other Google data. | To let you sign in with Google. |
| Sign-ins | For each signed-in session: an identifier, when it expires, and the IP address and browser identifier it was started from. | To keep you signed in and to spot sign-ins you don't recognise. |
| Devices | The devices signed in to your account: their type (web, phone app, Even Realities app), a name such as "Chrome on Windows" or one the app provides, and when each was first and last used or signed out. | So you can see and sign out any device. |
| Computers you pair | The name you give the computer, a public key it generates and that key's fingerprint, and when it was paired and last checked in. Never anything stored on the computer. | So only computers you approved can be reached through your account, and you can remove them. |
| Preferences | Small settings you choose, such as display options. | To remember them across devices. |
| Security log | Events such as signing in, resetting your password, signing out a device, pairing or removing a computer, a device being given access to one of your computers, and requesting or cancelling deletion. Each records the device or computer involved and a one-way scrambled form of the IP address (not the address itself). | To protect your account and investigate misuse. |
| Short-lived codes | Email-confirmation links (valid 24 hours), password-reset links (1 hour), device sign-in codes (10 minutes), computer pairing codes (10 minutes, stored only in scrambled form), and counters of recent attempts per IP address to slow down guessing. | To confirm it's you and to stop abuse. |
While you're signing up or signing in, the site may keep a sign-in cookie in your browser (needed to stay signed in) and remember the email address you just entered until you close the tab. Nothing is used for tracking.
5.What we never receive
Your agents, chats, desktop sessions and their content, meeting transcripts, tasks, files, the keys or logins for your AI providers, and the permissions you give your agents all stay on your own computer, with the MyAgents Bridge. Signing in to MyAgents never gives us, or anyone, access to your computer: each computer has to be paired by you, and you can remove it at any time. We don't take payments, so we hold no payment details.
6.Who processes your information
We use these providers to run the service. They process information only on our behalf:
- Vercel: hosts the website and the account service, in the United States.
- Neon: stores the account database, in the United States (Northern Virginia).
- Resend: sends account emails.
- Google: only if you choose "Continue with Google", and for website fonts (see section 3).
We don't sell your personal information, and we don't share it for advertising. We may disclose information if the law requires it, or to protect our users or the service from fraud or abuse.
7.How long we keep it
- Your account: until you delete it.
- When you delete your account, you're signed out everywhere, your devices and computers are disconnected, and the account is locked at once. You then have 14 days to change your mind by signing in again. After that, a clean-up that runs every day permanently erases your account and everything listed in section 4, except the security log (below).
- Sign-ins last up to 14 days unless you sign out or remove the device first. Expired sign-ins, with the IP address and browser identifier they hold, are erased daily.
- Short-lived codes expire as listed in section 4 and are erased daily. Counters of recent attempts are erased after a day.
- The security log is kept for 12 months, then erased. Once your account is erased, its entries are no longer linked to you.
- Backups: our database provider keeps a rolling 6-hour history for recovery. Anything erased is gone from it within 6 hours.
8.Emails we send
Only emails about your account: confirming your email address, resetting your password, confirming afterwards that your password was reset, and letting you know if someone tried to create an account with your address. No newsletters or marketing.
9.Your choices and rights
- In your account you can see and sign out every device, remove paired computers, change your password, and delete your account.
- By email to support@madebycaveman.com you can ask for a copy of your information, ask us to correct it (including changing your email address), or ask any question about this policy. We'll answer within 30 days, and may need to confirm the request comes from you. We won't treat you differently for using any of these rights.
If you live in a US state with a privacy law (for example California, Colorado, Virginia)
You can ask to know what personal information we hold about you, to get a copy, to have it corrected or deleted, and to opt out of its sale, sharing for targeted advertising, or profiling. We don't sell or share personal information, target advertising, or profile anyone, so there's nothing to opt out of, but you're welcome to ask. If we turn down a request, you can ask us to reconsider by replying to our answer.
If you live in the European Economic Area or the United Kingdom
- Why we may use your information (legal bases): to provide the account you asked for (contract); to keep the service and your account secure, through the security log, sign-in records and abuse counters (legitimate interests); and to keep records the law requires (legal obligation).
- Transfers: your information is stored and processed in the United States. We rely on the safeguards our providers offer for transfers, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
- Your rights: access, correction, erasure, restriction, portability (a copy in a common format), and objection to processing based on legitimate interests. You can also complain to your local data protection authority, though we'd appreciate the chance to help first.
- We don't make decisions about you by automated means.
10.Security
Passwords are stored only in scrambled form; all connections are encrypted; sign-in attempts are rate-limited; Google sign-in tokens are stored encrypted; and every device and computer can be removed by you at any time. No system is perfectly secure, and we'll tell you without undue delay if a breach affects your information.
11.Age
MyAgents accounts are for people 18 and older. We don't knowingly collect information from anyone under 18. If you believe someone under 18 has created an account, contact us and we'll delete it.
12.Changes to this policy
If we change this policy, we'll update the date above. If a change significantly affects how we handle your information, we'll email account holders before it takes effect.
13.Contact
Made by CavemanPO Box 3781
Amarillo, TX 79102