Privacy Policy

Full session transcript sharing is optional and off by default. Unless you enable it in Dashboard Profile, Resin sends sanitized, allowlisted evidence rather than full transcript content. Opting in permits collection of prompts, model responses, tool activity, and code included in sessions.

When you connect your environment to the Resin cloud service, Resin processes sanitized, allowlisted observation records, tool capability profiles, verification digests, and evaluation results as required to provide the service. Local secret redaction remains active, including when transcript sharing is enabled, but cannot guarantee that all sensitive content will be removed.

When you sign in with supported providers (such as Google or GitHub), Resin receives account identifiers, email addresses, and basic profile details required to authenticate you, manage memberships, and secure your account. Resin never sells your personal data.

Resin collects technical request logs and error traces to operate the service and maintain system reliability.

Resin uses PostHog, a product analytics service, to understand how the website and Dashboard are used and to detect failures. On the website this includes page views, clicks and other interactions, performance measurements such as page load timing, and errors with their stack traces. Signed-in activity is linked to your opaque Resin user and account identifiers, not your email address. PostHog stores a random identifier in a first-party cookie and local storage to recognize your browser. Analytics requests go through resin.sh before reaching PostHog.

PostHog session replay records how pages render and respond while you use them. All page text and every form input are masked in the browser before recording, so replays do not contain what you type or the text displayed on the page. Request and response headers and bodies are not recorded.

The Resin command-line tools, local daemon, and cloud services report errors and basic usage events, such as the Resin version, operating system, and a sanitized error message and stack trace. Home directories, project paths, usernames, email addresses, tokens, and other secrets are removed before anything is sent. Error reports never include prompts, transcripts, source code, tool inputs or outputs, command-line arguments, or environment variable values. Before you sign in, the command-line tools use a random installation identifier.

Command-line error reporting is on by default. Turn it off with resin privacy error-reporting disable, or by setting DO_NOT_TRACK=1 or RESIN_ERROR_REPORTING=0 in your environment.

Resin uses processed information to provide the Resin Dashboard, evaluate and qualify compiled tools, maintain workspace access controls, diagnose system issues, and protect against unauthorized access or abuse.

Personal account details, device authentications, and linked identity providers belong solely to your personal user account.

Tool qualifications, activation history, and sanitized performance evidence created within an explicit team workspace are accessible to authorized members of that workspace according to their role.

Resin relies on service providers for specific operational functions:

• Google Identity and GitHub OAuth process sign-in requests and verify identity.
• When tool evolution, repair, or evaluation features invoke AI models, Resin sends sanitized prompts and capability schemas to the configured model provider (such as OpenRouter, Anthropic, or OpenAI) under their respective privacy terms.
• PostHog processes product analytics, masked session replays, and sanitized error reports from the website, Dashboard, command-line tools, and cloud services.
• Configured database and object storage infrastructure store cloud evidence bundles and qualified tool artifacts.

Data is shared with providers only to the extent necessary to deliver the configured service.

We may retain user data to operate, maintain, improve, and secure Resin, resolve disputes, and meet legal obligations. Retention is not user-selectable. We do not promise a fixed retention period or automatic deletion when you stop using Resin.

Revoking device credentials blocks subsequent cloud access without deleting historical records or remotely erasing a device. Turning off full transcript sharing stops future uploads, not retention of data already received.

Contact hello@resin.sh to exercise applicable access, export, or deletion rights. We handle requests under applicable law and any retention requirements.

Legal, investigative, or security holds may prevent deletion of designated records. Removing dashboard self-service controls does not remove applicable privacy rights.

For questions about this policy, data export or deletion requests, or technical inquiries, please email hello@resin.sh.

We may update this policy as Resin evolves. The effective date at the top of this page indicates the current revision.

Use of Resin is also subject to the Terms of Service.