Skip to content
clutchbox

Privacy policy

Last updated October 26, 2026

Clutchbox is an early developer preview operated by Philip Zhan. Our browser extension syncs your sign-ins to the sites you choose, and each user gets a cloud computer that AI agents you connect can use, kept signed in to those sites. This policy covers our web app, the cloud computer, agent connections, and the extension.

Account information

When you sign in with Google, we receive your name, email address, profile image, Google account identifier, and email verification status. We store account and authentication records, including Google sign-in tokens, to identify you and maintain your account. We request basic identity access only; Google sign-in does not grant access to Gmail, Drive, browsing history, or other websites.

Session records can include your IP address and browser information. Essential cookies keep you signed in and protect the sign-in process. We also record your computer's status and how many computer minutes you use each month, to apply the free allowance. Request and error metadata may be processed by our hosting provider to operate and secure the service. Our own error logs record only the kind of error, never cookies, tokens, or page contents.

Browser extension and sync

After you connect the extension, it reads the cookies only for the websites you add and allow in your browser, or for every website in your browser profile if you choose Allow all sites. It leaves out sites you exclude and uploads the rest to your account over HTTPS. While connected and not paused, it does this when you add or remove a site, when you choose Allow all sites, within seconds of signing in to or out of a synced site, when the browser starts, every minute, and when you choose Sync now, uploading only when something changed. It reads cookies only: not passwords, browsing history, page contents, or other site data. The cookies include sign-in cookies, which let whoever holds them act as you on those sites.

We keep only your latest upload, encrypted at rest with AES-256-GCM and bound to your account, and use it only to sign your cloud computer in to the same sites. To list your synced sites on your account page, the server decrypts the site list stored with your latest upload (never your cookies). No person reads your cookies or what is on your computer, except with your explicit permission, to investigate security issues or abuse, or to comply with the law. Your account keeps your sync settings (the sites you add, your exclusions, and whether sync is paused), encrypted at rest like your uploads, so you can manage them on your account page and connecting the extension again restores them. The extension keeps a copy of these settings in local extension storage and its latest capture in browser session storage. On your account page you can remove or exclude sites, pause, or turn sync off; in the extension you can pause or disconnect. Removing or excluding a site, turning sync off, or disconnecting deletes the uploaded copy.

The extension connects with its own token, separate from your sign-in to our web app. Connecting opens our web app in a tab, where you sign in if needed. It keeps its tokens in local extension storage, and keeps syncing to the account that connected it after you sign out of our web app. For each connected browser we store the browser and operating system named by its user agent, when it connected, and when it last synced. Disconnecting a browser, from the extension or your account page, deletes its tokens and the upload it sent, and clears its browser, operating system, and last sync time; a record of when it connected and disconnected stays until you delete your account.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Your cloud computer

Your cloud computer is a computer we create for your account. It keeps its files, settings, and sign-ins between uses, and pauses when idle. When it opens, it applies your latest upload: synced sites are signed in with your cookies, and other sites on the computer are left as they are. Your account page also sends your browser's time zone, which we keep with your account and set on the computer so sites show your local time.

Agent connections

If you connect an agent, such as Claude or ChatGPT, we store its OAuth client registration, your consent, and authentication records, and when each agent last used your cloud computer. We tell a connected agent your account's email address so it can say which account it is connected as. A connected agent can use your cloud computer as you could: open it, see the screen, click and type, visit sites where you are signed in, run commands, and download files from it. What it sees, including screenshots, page contents, and command output, goes to that agent and its provider, whose own terms and privacy policy apply. Only connect agents you trust with your signed-in sites. You can disconnect any agent, or all of them, from your account page, which immediately invalidates their access.

How information is used and shared

We use this information to sign you in, run your cloud computer, keep it signed in, enforce access permissions, apply the allowance, prevent abuse, and troubleshoot the service. We use these providers:

  • Google handles sign-in.
  • Vercel hosts our web app and server, and provides its analytics.
  • Neon stores application records, including your encrypted upload.
  • E2B runs cloud computers, including their files and sign-ins.
  • Better Auth provides a hosted dashboard we use to administer accounts. It can read account and sign-in records, but not uploads or computers.

These providers process information only to deliver their services. Web app hosting and database processing are configured in the United States.

We do not sell your information, use it for advertising, or use it to train AI models. We do not use your cookies or anything on your computer for any purpose other than running it for you and the agents you connect. We may disclose information when legally required or necessary to investigate abuse and protect the service and its users.

Web app analytics

We use Vercel Web Analytics on our public pages (the homepage, setup guides, comparisons, and the works-with, security and privacy pages) to understand aggregate visits, referral sources, approximate location, and browser/device categories. Web Analytics does not use tracking cookies. We remove query strings and URL fragments from page-view URLs and exclude account, sign-in, consent, and API routes. We do not send account identifiers, browser captures, or custom behavioral events to analytics. Vercel processes request information to produce these aggregate statistics.

Setup progress

We record when you first finish each setup step (syncing your browser, connecting an agent, and an agent first opening your computer), tied to your account's random ID, to measure how setup goes. These dates are kept while your account exists, including after Delete everything. Server logs of these steps may be kept for a limited time by our hosting provider. We don't send them to analytics providers.

Developer plan updates

If you turn on developer plan updates on your account page, we record when you did and may email you at your Google account address about developer plans. You can turn them off there at any time, which removes that record; we then stop sending these emails.

Retention and your choices

We keep account records, your sync settings, your latest upload, and your cloud computer while your account exists. Each upload replaces the previous one. Delete everything on your account page deletes your cloud computer, with its files and every sign-in on it, your uploaded cookies, and your sync settings, disconnects every browser and turns sync off until you connect the extension again, and resets your setup status; setup dates remain until you delete your account. Disconnecting the extension deletes the cookies it uploaded and keeps your sync settings.

You can request access, correction, or deletion of your account by contacting the support email shown on the Google sign-in consent screen. We will verify that you control the account before fulfilling a request, and delete your cloud computer and uploads before your account. Deleted information may remain temporarily in provider backups or security records until those records expire.

Signing out invalidates your web session; connected agents and browsers keep access until you disconnect them. You can also remove Clutchbox access in your Google Account settings. Removing Google access does not delete your Clutchbox account.

Contact and changes

For privacy questions or account requests, use the support email displayed on the Google sign-in consent screen. We will update this page as the product changes, and ask for your consent before using your information in a new way.