PhysicsBasePrivacy Policy
Last updated 23 October 2026
This policy explains what the hosted PhysicsBase service at https://www.physicsbase.ai, run by PhysicsBase ("we"), collects, why, and what you can do about it. The short version: we keep what's needed to give your agents identities and show you what they did. We don't sell data or show ads, and you can export or delete everything.
What we collect
| Data | Why |
|---|---|
| Your email address | To sign you in with a one-time code, identify you in your organisations, and send sign-in codes, alerts and important notices about the Service. |
| Passkey public keys and session records | To sign you in. Private keys stay on your device; we never receive them. |
| Organisation data: names, members, roles, apps, enrollment-key policies | To run your organisation. Enrollment keys are stored only as one-way hashes. |
| Agent records: names, public keys, policies, last-active times | To verify your agents and enforce their policies. Agents' private keys never leave them. |
| Vault credentials (your third-party API keys) | To make API calls for your agents. They are encrypted at rest (AES-256-GCM), never shown back in full, never given to agents, and decrypted only to make a call you allowed. |
| Activity log: events, the agent or person involved, the app or API host, method, path, status and the reason the agent gave | Your audit trail, search, exports and alerts. Request and response bodies of brokered calls are passed through and not stored. |
| Usage counters | Per-agent limits and the monthly free-plan meters. |
| IP addresses | Held briefly in memory for rate limiting and abuse protection. They aren't written to the activity log. |
| Alert settings, including a webhook URL | To send the alerts you chose. Webhook signing secrets are encrypted. |
Cookies
We use one session cookie to keep you signed in, and a short-lived cookie during passkey sign-in. Both are strictly necessary. There are no analytics, advertising or tracking cookies.
Who else processes data
- Our hosting provider runs the servers and stores the encrypted database.
- Resend delivers emails: sign-in codes, invitations and alerts.
- Google Fonts serves the typefaces on our pages, so your browser contacts Google when loading them.
- APIs you connect receive the requests your agents make through the vault, as you configured.
- Your webhook endpoint or Slack workspace receives alerts, if you set one up.
We don't sell or rent personal data, and we don't use it for advertising or to train AI models.
How long we keep it
- Activity log entries: 365 days, then they're deleted automatically. Export them first if you need them longer.
- Everything else: until you delete it, delete the organisation or delete your account.
- Backups: kept for up to 14 days, then overwritten. Deleted data disappears from backups within that time.
Your choices and rights
- Access and export: Team → Export downloads everything an organisation holds as JSON, without secrets. Activity → Download CSV exports any search.
- Correction: rename organisations and agents, and change policies, in the dashboard.
- Deletion: Account → Delete your account, or Team → Delete this organisation. Deletion is immediate in the live system.
- For anything else, including requests under GDPR, UK GDPR or US state privacy laws, email support@physicsbase.ai. We'll respond within 30 days.
Security
Agent tokens last five minutes and are bound to the agent's key. Vault secrets are encrypted at rest, with the key held separately from the database. Connections use HTTPS. Report vulnerabilities to support@physicsbase.ai.
Children
The Service is for businesses and developers and isn't directed at children. We don't knowingly collect data from anyone under 18.
Changes
We'll post changes here and update the date above. For material changes, we'll email account owners in advance.
Contact
PhysicsBase · support@physicsbase.ai