Privacy notice

Master of Puppets is a cockpit for developers who run many Claude Code agents. It is built to know as little as possible about your work: it watches the state of your sessions, not what is in them. This notice says what it collects, why, who else handles it, how long it is kept, and what you can do about it.

1. Who is responsible

Vincent Berthelemy (v0lt), France, operates Master of Puppets and is the controller of your personal data under the GDPR. Contact: [contact e-mail to complete], [postal address to complete].

2. What is collected

Your account. From Sign in with GitHub (scope read:user only): your GitHub login, numeric id, display name and avatar address, and when you signed in.
Session metadata, never prompts or code. The hooks you install from Connect report, for each Claude Code session: the repository name, the last segment of the working folder (never the full path), the branch, the machine’s name, its state (working, waiting on you, idle, ended), the name of the last tool used, counts of prompts and tool calls, timestamps, and the Claude account the session runs under as Claude Code reports it. Your prompts, Claude’s replies, tool input and output, and file contents are never sent.
Token counts. Per session, model, branch and day: how many input, output and cache tokens were used, as numbers read on your computer. Never the transcript itself.
Launches. If you allow it with mop agent allow-launch: the names and home-relative paths of the folders you allowed, and the prompt you write when you start Claude Code from the app.
What you choose to route through the app. Only when you turn on away mode or use these features: a one-line summary of a permission request (for example the command a tool wants to run), Claude’s questions and the answers you pick, messages you send to a session, and tasks you queue.
Machine figures. Processor, memory and disk use as numbers, the processor model, core count, platform and uptime of each connected computer, with the last ten minutes of history. Never process names or files.
GitHub data of tracked repositories. For repositories the owner connects through the GitHub App: repository details, pull requests, checks, workflow jobs and self-hosted runners. Beta accounts do not connect repositories.
Notifications. The push subscription your browser creates (an address at your browser’s push service and its encryption keys), the device name you see on Notifications, and your notification rules.
Connection data. Cloudflare, which serves the app, processes your IP address and request details to deliver pages and stop abuse. The app keeps no analytics and no advertising trackers.
Cookies. One session cookie (mp_session), needed to keep you signed in. Your theme choice stays in your browser’s storage.

3. Why, and on what basis

To run the service you signed up for: show your sessions, alert you, answer prompts (contract, GDPR art. 6(1)(b)).
To keep it secure and keep accounts apart (legitimate interest, art. 6(1)(f)).
Once billing starts: invoices and payment records, as French accounting law requires (legal obligation, art. 6(1)(c)).

Your data is not sold, not used for advertising, and not sent to any AI provider.

4. Who else handles it (sub-processors)

Cloudflare (United States, global network): hosts the app and its API, and carries every request.
Neon (United States; database region [to confirm]): the Postgres database that stores the data above.
GitHub (United States): Sign in with GitHub, and the repository data of tracked repositories.
Telegram: alerts for the owner only. No beta account’s data is ever sent to Telegram.
Web push services of your browser’s maker (Apple, Google, Mozilla or Microsoft): deliver the notifications you turn on. The message is encrypted end to end; they see only its size and timing.

Where data leaves the European Union, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses that these providers offer.

5. How long it is kept

A routine deletes history every night. It keeps:

Time spent per session state (working, waiting, idle)	90 days
Permission prompts and questions answered from Radar, with their answers	30 days
Messages and stop requests you send to a session	30 days
CI jobs waiting for a self-hosted runner (owner only)	30 days
Activity events (owner only)	180 days
Health checks and routine runs (owner only)	30 and 90 days

Your account, the sessions list and their token counts, connected machines, launches, queued tasks and notification rules are kept while your account exists, and deleted with it. Each machine’s figures keep only the latest sample and ten minutes of history. Alerts held during your quiet hours are deleted when their summary is sent. Database backups roll over within [restore window to confirm].

6. Your rights

Get a copy (access and portability): Download my data on the Your data page gives you every row your account holds as one JSON file.
Delete it (erasure): Delete my account on the same page removes every row of your account, disconnects your machines and devices, and signs you out.
You can also ask to correct your data, restrict or object to its use, by writing to the contact above. You get an answer within one month.
You may complain to the French data protection authority, the CNIL (cnil.fr).

7. Security

Every connection is encrypted. Machine tokens are stored only as hashes and shown once. Each beta account sees only its own data, enforced by the web app and again by the API.

8. Changes

If this notice changes in a way that matters, you are told in the app before it applies. Draft awaiting review by Vincent Berthelemy. Not in force yet.