Rigbolt Privacy Policy

Account data may include your email address, account identifier, plan and usage counters. Device data may include a device identifier, display name, platform, app version, public signing key, pairing state, and last-seen state. OAuth data includes registered client metadata, scopes, hashed access/refresh credentials, short-lived authorization codes, and browser-session state. When you use the optional Cloud relay, requested MCP tool inputs and returned results transit the service so they can reach your paired Rigbolt device and the requesting client.

We use this data only to authenticate accounts and MCP clients, pair and route requests to devices, enforce account/device isolation and usage limits, operate subscriptions, diagnose service failures, and provide requested support.

Local project execution remains on Rigbolt. Rigbolt Cloud is an optional relay/control plane and does not replace Local project boundaries, policy, approval, verification, or activity records. The Cloud application does not intentionally persist relayed source-code/tool payloads as durable product records; hosting infrastructure may retain ordinary security or access logs under the hosting provider's operational policies.

Data is shared only with infrastructure providers required to operate Rigbolt Cloud and with the MCP client you explicitly authorize, such as ChatGPT or another compatible client. We do not sell user data or disclose project data for advertising.

Device-enrollment challenges expire after 1 minute; OAuth authorization codes and one-time browser sign-in links after 5 minutes; pending pairing codes after 10 minutes; browser sessions after 12 hours; and OAuth access tokens after 1 hour. Refresh grants persist until rotated or revoked. Account, paired-device, subscription, OAuth-client, and usage records persist while the account or service relationship remains active and until they are revoked or deleted through the available account/support process. Local project files and Local activity remain governed by the user's machine and are not Cloud account records.

You can disconnect the MCP client, revoke paired devices, stop Rigbolt, remove registered local projects, and avoid Rigbolt Cloud entirely by using Local-only workflows. For account-data questions or deletion requests, use the public support channel. Security-sensitive credentials should never be included in support messages.

Rigbolt uses HTTPS in production, OAuth with PKCE, hashed Cloud credentials, device signing keys, scoped project access, and runtime-local approval controls. We may update this policy as the product changes; material changes will be reflected on this page with a revised effective date.