Privacy Policy

dashsquad is software you install and run on your own computer. This policy explains what stays on your machine, what leaves it, and the small number of things we ever see.

Last updated: 25 October 2026

1. The short version

  • Your data stays on your machine. Agent configurations, conversations, session transcripts, files and API keys are stored locally under ~/.dashsquad. We have no access to them.
  • Usage data you can turn off, no cookies. The apps send a small, fixed set of usage events (for example “a message was sent”, never its text) so we can see which features are used. Turn it off in Settings; it applies to every device on your account. The website counts page views without cookies. We run no advertising, session recording or crash reporting.
  • You choose who your agents talk to. Prompts go directly from your computer to the AI provider whose API key you configured. We are not in the middle.
  • We never sell your data and we do not use your conversations to train models.
  • Three things involve servers other than your own — your account and the relay (section 6), automatic updates (section 7) and usage data (section 8). All three are described below.

2. Who we are

dashsquad (“dashsquad”, “we”, “us”) publishes the dashsquad desktop application and operates the website at www.dashsquad.ai. We are the data controller for the limited personal data described in this policy. You can reach us at hello@dashsquad.ai.

3. This website

www.dashsquad.ai is a static site. It counts page views with PostHog in a cookieless mode: it stores nothing in cookies or local storage, and PostHog is set to discard IP addresses. Section 8 gives the details. The site includes no advertising scripts and does not fingerprint or profile visitors. Web fonts are bundled at build time and served from our own domain, so loading a page does not call third-party font servers.

Our hosting provider processes standard server request logs — IP address, user agent, requested URL, timestamp — to deliver the site and protect it against abuse. We do not use those logs to build profiles of visitors.

4. The desktop app: what stays on your computer

You sign in to a dashsquad account when you set up the desktop app (section 6), but your work does not go to that account. Everything the app creates is written to your own disk, by default under ~/.dashsquad:

  • Agent definitions, model choices, tool permissions and other configuration.
  • Conversation history and session transcripts, stored as append-only files so you can audit exactly what an agent did.
  • Per-agent workspaces and any files your agents read or write there.
  • Provider API keys and other credentials, encrypted at rest with AES-256-GCM. The encryption key is held in your operating system keychain.
  • Application and HQ logs.

None of this is uploaded to us. We cannot read it, and we have no mechanism to request it.

5. Services you connect

dashsquad is useful because it talks to services you choose. Those connections are made directly from your computer, using your own accounts and keys.

AI model providers

When an agent runs, your prompts, the relevant conversation context, tool results and any files you attach are sent to the provider you configured — for example Anthropic, OpenAI, Google or OpenRouter. That provider's terms and privacy policy govern what happens to the data, including whether it is retained or used for training. We recommend reviewing those policies before connecting a provider.

Messaging platforms

If you connect a channel such as WhatsApp, Telegram or Slack, messages between you and your agents pass through that platform and are subject to its privacy policy.

Connectors, tools and plugins

Agents can be granted tools — running commands, reading and writing files, browsing the web, or reaching systems through connectors. Those tools act with the permissions you grant them and connect directly to the systems you point them at. Grant access deliberately, and only to systems you are authorised to use.

6. Your account and the relay

To set up the desktop app, you sign in to a dashsquad account. Setup then registers your HQ (the part of the app that runs your agents) with us and connects it to our relay. The relay lets your other devices, such as your iPhone, reach your agents when you are away from your computer. Adding another device is optional.

Because of this:

  • You sign in through our identity provider, which gives us your email address and an account identifier so we know which HQs and devices belong to you.
  • Traffic is forwarded between your device and your own machine over an encrypted connection. The relay is a pipe: we do not store the contents of your conversations.
  • We process connection metadata — timestamps, device and HQ identifiers, IP addresses and byte counts — to route connections, enforce limits and investigate abuse.

Your account does not hold your agents, conversations, files or API keys. They stay on your computer (section 4).

7. Automatic updates

Installed builds of the desktop app check download.dashsquad.ai for new releases so you can stay up to date. We operate that server. The request tells it your IP address and the app version you are running, and our hosting provider records it in the standard server request logs described in section 3. No usage data is attached to it. You can block the check at your firewall if you prefer to update manually.

8. Usage data

We collect a small amount of usage data to learn which features people use. It never includes what you say to your agents or what they do for you.

In the apps

When you are signed in to a dashsquad account, the web app, the desktop app and the iOS app send a fixed set of usage events to our control plane, which forwards them to PostHog. The Android app sends none. The events are:

  • app_opened, signed_in, signed_out and screen_viewed (which screen, from a fixed list of screens)
  • gateway_paired and gateway_removed
  • conversation_started, message_sent (whether you typed, dictated or used voice, and how many attachments — never the text or the files), turn_finished (whether the turn finished, failed or was cancelled, how long it took and how many tools it called) and turn_stopped
  • voice_mode_started and voice_mode_ended (how long voice mode was on)
  • agent_created, agent_deleted, question_answered, effort_changed (which effort level you chose for a conversation, from a fixed list) and analytics_opted_in

From your HQ

When your HQ is paired with your dashsquad account, it also sends a fixed set of usage events about work your agents do, including work they do without you, even when no app is open. They go to our control plane, which links them to the account that paired the HQ and forwards them to PostHog. The events are:

  • agent_message_sent (whether a message between agents was delivered, queued or refused, and for a refusal the reason, from a fixed list) and agent_thread_paused (whether a message limit, a hop limit or you paused it)
  • goal_created (whether you or an agent created it) and goal_finished (completed, cancelled or limit reached)
  • routine_created (whether you or an agent created it, and the type of schedule) and routine_run (whether the run ran, was quiet, was skipped or failed, and for a skipped run the reason, from a fixed list)
  • unattended_limit_reached (whether an agent reached its daily cost or token limit)
  • turn_failed (that a turn was cancelled, interrupted or failed, the reason from a fixed list such as a sign-in problem, a rate limit or a network error, and who started the turn, from a fixed list such as you, an agent, a routine, a goal or a wake-up; never the error text)

Each event also carries the platform (web, desktop, iOS or HQ), the release channel, the app or HQ version and a timestamp.

Events are linked to a pseudonymous account ID: a one-way keyed hash of your dashsquad account (organization) ID. PostHog never receives your account ID, name, email address or IP address. The data describes an account, not an individual person.

We never collect conversation content, prompts, messages between agents, goal objectives, goal or routine titles, files or file names, agent names, API keys or tokens, screen recordings or crash reports.

Turning it off

Usage data is on by default. To turn it off, clear Share usage data in Settings: on the web app in the Devices area and on the screen where you choose your HQ, in the desktop app under Settings → General, or in the iOS app under Settings. The choice belongs to your account, so it applies to every device you use and to your HQ. Our servers drop any event from an account that has opted out.

We use PostHog to turn some features on or off. For this, the control plane asks PostHog which features are on for your hashed account ID. If you have opted out, the control plane decides locally and sends nothing about your account.

On this website

  • We count page views with PostHog in a cookieless mode. It stores nothing in cookies or local storage; it keeps state in memory only, so every visit counts as a new one. A page view records the page address and the referring page, and when you leave a page we record that you left it and how far you scrolled.
  • Your browser sends these requests directly to PostHog’s EU servers. Like any web server, PostHog receives your IP address with each request; it is set to discard IP data, so it does not store it. The site sets no cookies, so your browser sends none.
  • Page addresses and referring pages are recorded without their query strings and fragments. We keep marketing campaign tags (such as utm_source, utm_medium and utm_campaign) to measure where visitors come from. Ad click IDs (such as gclid and fbclid) are replaced with <masked>, and we drop the search term that a search engine may pass on.
  • The website uses no feature flags and does not load settings from PostHog. We do not record clicks, session recordings, heatmaps or page performance, and we run no surveys.

The waitlist

When you join the waitlist, we send one anonymous “waitlist signed up” count to PostHog with a random ID. Your email address is never sent to PostHog.

Service providers

  • PostHog (EU Cloud, Frankfurt) — product usage events and website page views.

9. What we never do

  • We never collect the content of your conversations, files, prompts or keys, and we do not record your screen or crash data.
  • We do not sell, rent or share your personal information for advertising.
  • We do not use your conversations, files or agent output to train models.
  • We do not read the contents of relayed traffic.

11. How long data is kept

  • Local data is kept until you delete it. Removing the ~/.dashsquad directory and uninstalling the app removes your agents, conversations and stored credentials from your machine.
  • Account data is kept while your account is active and deleted within 30 days of you closing it.
  • Server and relay logs are kept for a short period — normally no more than 30 days — for security and troubleshooting, then deleted.
  • App usage events are kept in PostHog for as long as we use them to understand how the product is used. PostHog keeps events for up to 7 years on our plan and does not offer a shorter period. Each event carries your pseudonymous account ID, so we can find and delete your account’s events: email hello@dashsquad.ai and we will delete them.
  • Website page views are kept in PostHog for the same period. Each visit gets a new random ID, so we cannot find or delete the page views of one visitor.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete, export or restrict the processing of your personal data, and to complain to a supervisory authority. For data on your own machine you already have direct control — the files are yours to read, export or delete. For account or relay data held by us, and for usage data held by our analytics provider, email hello@dashsquad.ai and we will respond within the period required by applicable law.

We do not sell or share personal information as those terms are defined under California law, and we do not process sensitive personal information for inferring characteristics.

13. International transfers

Our service providers may process the limited data described above in countries other than your own. Where such transfers involve personal data protected by the EU or UK GDPR, we rely on appropriate safeguards such as standard contractual clauses.

14. Security

Credentials are encrypted at rest and protected by your operating system keychain, agents run with restricted permissions, and relayed connections are encrypted in transit. dashsquad is alpha software, however, and no system is perfectly secure — please keep your machine and your provider keys protected, and review what you grant your agents access to.

If you believe you have found a security vulnerability, please report it privately to hello@dashsquad.ai rather than opening a public issue.

15. Children

dashsquad is not directed to children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the product develops. The date at the top of the page always reflects the current version, and we will highlight material changes on the website or in release notes. Continuing to use dashsquad after a change means you accept the updated policy.

17. Contact us

Questions about this policy, or about privacy in dashsquad generally, go to hello@dashsquad.ai.