What Agentower sends and keeps

Agentower works from status and usage, not content. The hook on your computer picks out a short list of fields and drops everything else before anything is sent. The full legal wording is in the privacy policy; this page is the practical detail.

#What the hook sends

For each event in a session (started, tool used, needs you, turn ended, failed, ended), the Claude Code, Codex and Cursor hooks send:

• the kind of event (for example "Stop" or "PermissionRequest") and a time;
• the session's ID, and a subagent's ID and type (such as "Explore");
• the name of the tool the agent is using, such as Bash or Edit — never its input;
• before each step (Claude Code and Codex, hook version 9 or plugin 0.4.3), a short activity key worked out on your computer so the card can say what the agent is doing: the kind of step — test, build, install, commit, push, pr, deploy (with the environment's name when the command gives one, such as staging), read, edit or run — and at most one name: the program's name for run (for example curl), or the top-level folder inside the project for read and edit (for example src). From hook version 11 (plugin 0.4.5), the program's name is sent only when it's a plain name such as curl or psql (from version 12, sudo, env and time are skipped, and a command the hook can't read cleanly sends a bare run) — a script's file name (anything with a dot, such as deploy.sh) sends a bare run — and a deploy's environment only when it's one of production, prod, staging, preview, dev, development or test (otherwise a bare deploy). Never the command line, its arguments, a path below the first folder, a file name or any contents. Agentower keeps the folder only for projects with Work details on, and holds the key in memory only — never in the database, exports or the log;
• the tool's own short notice, such as "Claude needs your permission to use Bash", and error types such as "rate limit";
• the project's name — from the repository's remote, or the folder's name — never its path;
• your operating system type (mac, linux or windows) — never the computer's name;
• the AI model's name, when the tool gives it (for example claude-opus-5-5), and the effort level it works at (for example high);
• at the end of a turn, a yes/no flag for "ended with a question" — and, only when Agent chats is switched on, the agent's question or its last message, and — where the computer allows answers from Agentower — its multiple-choice questions and plans to approve (see below);
• where the agent works — its git branch, its linked worktree's folder name, the label you started it with (AGENTOWER_LABEL) and the name of the repository's top-level folder that a file it edited is in — names only, never a path. They name the agent's work stream;
• when the agent starts a helper or a command in the background, that it did — agent or shell and an id, never the command or the prompt — so the board can show it as working in background;
• whether the computer accepts answers from Agentower (own or team; nothing when it's off), so the app knows who may answer its agents;
• a random id for the computer (made on it the first time, kept in ~/.agentower/computer-id — never its name), the hook's version and how old its settings from Agentower are, so you can see your computers and check their connection in Settings → Computers.

#What's never sent

• your prompts, or the agent's replies (except, per setting, with Agent chats or a project's Work details on — below);
• code, file contents, commands or their output (except what an approval is for and a plan to approve, below);
• full file or folder paths (except a file outside the project in an approval, below);
• your computer's name.

These are removed on your computer, by the hook, before anything leaves it. You can check exactly what the hook would send with a dry run — see Connect Claude Code.

#Usage telemetry (on with the installer; you can turn it off)

The one-line installer switches on Claude Code's own telemetry (leave it off with --no-usage); with a manual setup it's your choice, and Codex's is always your choice. With it on, Agentower gets token counts and (for Claude Code) a cost estimate per model request. It's sent with a telemetry-only key that can't do anything else, and Claude Code's prompt logging stays off, so prompts and code are never in it. It reads only the session ID, the model's name, token counts, cost and repository name, and drops every other event.

#Plan limits

The Agentower status-line script sends only your plan's percentages and reset times for the 5-hour and weekly windows, the session's ID, the model's name and its effort level. For Codex, the hook reads only the plan-limit numbers (percent used, window length, reset time) from that session's record on your computer — nothing else in the file. If you name an account (AGENTOWER_ACCOUNT, e.g. "work"), that name is sent too and shown to your team; never the account's email or ID. The session ID also works as a heartbeat that keeps an open terminal's agent on the board. With an API-key login there are no plan limits, so it sends only the heartbeat. See Plan limits.

#Agent chats: the one setting that sends more (off by default)

Agent chats is one setting for the whole workspace, in Settings → Workspace. Only an owner can switch it, with a sign-in from the last 7 days, and every change is in the audit log. It covers every project, new ones included. When it's on, the hook sends things it otherwise never sends:

The agent's question. When an agent ends its turn with a question, the hook sends that one sentence — code removed, at most 200 characters — so you can read it on the board. It's kept only while the agent waits and isn't written to the timeline or log. A question can mention things from your work, such as a file name or a decision, so switch it on only where that's fine.

The agent's last message. At the end of each turn, the hook sends the agent's whole final message — its own words, including any code it shows — up to 8,000 characters, so you can read and answer it in the details panel. Never your prompts, its commands, tool input or output, what it writes mid-turn, or file contents. When the agent asks a multiple-choice question, the hook also sends the question and up to 6 answer labels (80 characters each) — never their descriptions. These make up the agent's chat, together with the messages your team sends it: kept by Agentower's live service — never written to the database, the log, the audit log or exports — for as long as the agent is open (its latest 200 entries at most), and deleted when the session ends, Agent chats is switched off, the workspace is erased or the account deleted. Messages from someone who leaves the team are removed. Only people who may approve that project's agents can read it.

What an approval is for. So an approver knows what they're approving, the hook sends the tool's name and what it will do — the command, the file (its path within the project, or its full path if it's outside the project), or the web address — at most 300 characters, with invisible characters removed. This is sent only if the agent's computer also allows answers from Agentower (AGENTOWER_REMOTE set to own or team — see Each computer decides too). It's kept only while the request is open (at most 60 minutes; 9 for Codex) and deleted when it's answered. A message you send an agent is never written to the database, and the board shows only that a message is waiting, never its text; it stays in the agent's chat until the session ends.

The work record (every project, needs hook version 4; a separate switch from Agent chats). Counts of what an agent did: files changed, lines added and removed, the kind of command (test, build, git…), test results, commits with their short hash, whether a branch was pushed or a pull request opened, and a turn's totals. With a project's Work details switch on, also the file paths (relative to the repository), commit messages, branch, pull request link and failed test names — and, from hook version 6, the first 600 characters of the instruction that started each turn and of the agent's own closing summary, with code blocks removed and anything that looks like a secret (keys, tokens, the value after password= and the like, long random strings) replaced by [hidden] on your computer and again by Agentower. That masking is best effort: it can't spot a secret that looks like ordinary words. With Work details off, no instruction or summary is sent. Never code, diffs, edit text, full command text or command output — lines are counted on your computer, which keeps only small turn records (numbers and file fingerprints, no names) in ~/.agentower/turns/ for two days. When the repository is on GitHub, GitLab or Bitbucket, its owner/name goes too, so commits and pull requests can link to it — never the remote's address or credentials. Kept as long as your history; counts are visible to everyone who can see the agent, names, instructions and summaries only to people who may approve the project. Switching Work details off deletes the names, instructions and summaries already kept. Work stream names (from a launch label, a rename, a branch, worktree or folder name, or the task title) are kept with their project until it's deleted. See The work record.

What each agent is working on. A short task title, at most 80 characters with code removed: the session's name (one you gave it, or the title Claude Code generates) and the description an agent writes when it starts a subagent — never your prompt. Claude Code's generated title sums up what you first asked, so it can hint at it. Kept by Agentower's live service while the agent is open, shown only to people who may approve that project's agents, and forgotten when Agent chats is switched off or the agent closes. A task title never names a work stream.

Questions and plans, so you can answer them. Also only if the agent's computer allows answers from Agentower:

• When Claude asks a multiple-choice question, the hook sends its questions — up to 4, code removed, at most 200 characters each — and the labels of their options — up to 6 per question, 80 characters each — never the options' descriptions.
• When a plan is ready for approval, the hook sends the plan's text, at most 12,000 characters, with invisible and control characters removed.

Both are kept only while the question or plan is waiting, in Agentower's live service — never written to the database, the log, the audit log or exports — and shown only to people who may approve that project's agents. They're deleted when it's answered (in the app or the terminal), expires (after at most 60 minutes), or the agent moves on. The plan's text never goes out through the API; an approver's agent-actions key can read the open questions, to answer them. The chat keeps the first question, its options and what was answered, like the rest of the chat. The audit log records only that someone answered — for example "Answered a question for Peter (AGN-81)" — never the answer.

Switching Agent chats off stops all of these, closes any open requests and erases what's held for the chats.

#Routines

Routines run on your own computer. The routines runner on that computer sends only the computer's random id, its answers-from-Agentower setting, and the ids and fingerprints (hashes) of the routines confirmed there; for each run, when it started and ended and a short reason code such as "timeout". It never sends the project's folder, the run's output or anything Claude does; the output stays on your computer in ~/.agentower/routines/logs/. For a routine's session, the hook also sends the run's id.

Agentower keeps each routine as you set it up — its name, project, computer, schedule, permission mode, allowed tools, limits and its brief's text, which is your own configuration. The brief is shown only to owners and the project's approvers (never to viewers, never in the audit log), and is deleted with the routine, its project or the workspace, or when its person leaves the team or deletes their account. Each run's times, state, reason and tokens are kept like the rest of your history.

#Dictation and spoken alerts

Dictation (hold the microphone button, or ⌥ Space, in an agent's chat) turns your voice into text on your device, with a speech model running in your browser. The audio never leaves your computer — not to Agentower, not to any speech service. Agentower gets only the text, when it's sent — after a 3-second Undo when you let go, or when you press Send if you've turned that off. It listens only while you hold, and asks before its first use. The speech model (about 94 MB) downloads once from Agentower's own site and stays in your browser.

Spoken alerts use only voices on your device; their text is never sent to a speech service.

#What Agentower keeps

• Each agent's project, ID, person, tool, model, machine type, states and their reasons and times, and token and cost totals.
• The work record: counts of what each agent did, its work stream's name, and — only for projects with Work details on — names, the instruction and the agent's summary (see above).
• Daily token and cost totals per project, person and model (which model served the requests — the model's name and numbers only).
• The audit log: who did what and when — never message text or commands.
• Your team: names, email addresses, roles, and profile pictures if you add them.
• Keys and sign-in links are stored only as fingerprints (hashes), so they can't be read back. Notification addresses and webhook signing secrets are stored encrypted.
• Data is stored with Cloudflare, in the EU: both the database and the live service's own storage (what it holds while agents are open, such as open requests, chats and waiting messages) are kept on EU servers.
• An open board's live connection is closed when you sign out (or sign out everywhere, or delete your account) and when your sign-in expires, so a board left open can't keep receiving updates.

How long it's kept. Agentower deletes old history automatically, every hour:

• finished agents and their timelines: after 7 days on Solo and one year on Team and Enterprise (open agents are never deleted);
• the audit log: after 365 days;
• routine runs (times, states, tokens): like finished agents — 7 days on Solo, one year on Team and Enterprise; routines themselves (and their briefs) stay until you delete them;
• monthly API call counts and daily token totals per model: after 13 months.

Chat text is kept only while an agent is open (see Agent chats).

Deleting a project deletes its data. When an owner deletes a project, its agents, their timelines, usage totals, approvers, guardrail and anything Agentower's live service held for them go at once; only the audit log's line saying who deleted it (with counts) stays. See Merge or delete a project.

You can take it out at any time — see Export your data — and delete your account yourself — see Delete your account. Exports include your agents and their history and work, usage, projects, the team, guardrails, notification channels, routines and their runs, computers, keys (never the keys themselves), plan-limit accounts and what Agentower keeps about you. Not in an export: agent chats, which are never exported because they're held only while the agent is open; and routines' briefs, which owners and the project's approvers can read in the app.

#What your team sees

Everyone in a workspace sees the team's agents and each person's name or email address. With Google sign-in, Agentower gets your verified email address and display name — nothing else from your account.