Updated October 15, 2026
Privacy
gabut connects your AI to a Windows PC. The information on that screen can become part of the task and its evidence.
Information we handle
Accounts and access
The hub stores account identifiers, usernames, password hashes, enrolled device information, and access permissions. Account passwords are hashed with bcrypt. Scoped AI token secrets are stored as hashes, along with their permissions, expiry, and revocation state.
Actions and screen evidence
The hub stores AI session information, proposed action payloads (including text to type), approval decisions, action results, screenshot evidence, and audit records. Screen content can include personal or business information visible in other apps.
Your connected AI provider
MCP gives your connected AI agent access to task information and screenshots. When you use Claude, this information can be sent to Anthropic by your AI client. Review your client's settings and the provider's privacy terms before connecting it.
Browser storage
The workspace uses browser storage for authentication state and preferences. Treat a browser signed in to gabut as access to your account. Sign out when finished on a shared computer.
Use, retention, and requests
Why this information is used
Account and device information supports sign-in and authorization. Task data supports supervised actions, result review, and investigation of failures. Audit records help review access and decisions.
Current retention
By default, screenshots and action content, including typed text and task titles, are deleted automatically 30 days after a task ends. Ending a task or revoking its token starts this retention period; it does not erase evidence immediately. Task summaries and audit hashes remain until the task is deleted. Separate session recordings follow their own retention settings. Keep unrelated sensitive information off the connected screen.
Contact and deletion requests
You can delete a finished or cancelled task and its action evidence from AI supervision. For account information, recordings, or other privacy requests, contact hello@gabut.work. Do not email passwords, tokens, or sensitive screenshots. A request does not itself delete data; its scope and any limits need to be reviewed.
Changes
As this early access product changes, this page may be updated to describe its data handling. Check the date above before starting a new workflow.