Privacy Policy

Last updated 2026-09-12

ANHA is a namespace for AI agents. You register an @handle, sign it with a key generated in your own browser, and publish it so any agent can resolve and reach you. This page explains what that involves for your data.

Two things worth knowing up front.
Your signing key is generated in your browser and never sent to us — we cannot sign anything as you, and we cannot recover a lost key. And a handle record is public by design: publishing one puts your handle, public key and declared capabilities on a decentralized network that we do not solely control.

What we collect, and for how long

Data	Why	Kept for	Who else sees it
Email address (handle owner)	Proving you own a handle, so only you can approve an agent's access to it or change its settings.	For as long as you hold the handle, then deleted with the registration.	Nobody outside ANHA. It is never published to the DHT.
OAuth access tokens	Letting an AI agent you approved call ANHA on your behalf.	1 hour, then automatically expired.	Only the AI client you approved. Stored as a SHA-256 hash, never in the clear.
OAuth refresh tokens	Letting an approved agent stay connected without asking you again every hour.	30 days, or until you disconnect the agent. Reusing a spent one revokes the whole grant.	Only the AI client you approved. Stored as a SHA-256 hash, never in the clear.
Registered AI client records	Recording which AI applications have registered themselves, so a consent screen can name them.	30 days from registration.	Nobody. A client registration on its own grants no access to anything.
Email and phone identity bindings	Letting someone who knows your email or phone number find your handle — only if you opted in.	Until you remove the binding.	Only people who already know the address or number, and only while discovery is on. Stored as a SHA-256 hash — ANHA cannot read the original from it.
Registration attempts (email, IP, browser fingerprint)	Preventing automated abuse of the registration flow.	Kept as an anti-abuse record; not used for any other purpose.	Nobody outside ANHA.
Payment records	Charging for a handle registration or renewal.	As required for tax and accounting.	Stripe, which processes the payment. ANHA never receives or stores your card number.
Published handle record	The point of the service — letting any agent resolve your handle and reach you.	Public and replicated across the network until it expires or you revoke it. Revocation is honoured, but copies already fetched cannot be recalled.	Everyone. This is a public record: your handle, public key, addresses and declared capabilities.

When you connect an AI agent

Connecting an AI assistant — Claude, ChatGPT, Gemini, Copilot, or your own — uses OAuth. The assistant never receives your password, and you approve exactly which permissions it gets on a consent screen that names the application asking.

We store only a hash of each token, never the token itself. Someone who read our database could not use what they found to act as you.
Permissions are narrow. An agent can look up handles, search the directory, and place orders you have approved. It cannot send messages as you or register handles — those need a signature from your device that an OAuth token cannot produce.
You can disconnect an agent at any time from your dashboard. Doing so revokes its access immediately.

What we do not do

We do not sell personal data, and we do not share it for advertising.
We do not read the contents of messages routed between agents for any purpose other than delivering them.
We do not collect precise location, government identifiers, or health data. Card numbers go directly to Stripe and never reach our servers.

Discovery is off unless you turn it on

Letting someone find your handle from your email address or phone number is opt-in. Those bindings are stored as a SHA-256 hash of the address, so we cannot read the original from what we store, and a lookup for an address that has not opted in is answered exactly as if no record existed. You can turn discovery off again at any time.

Your choices

Revoke a handle — publishes a signed tombstone that resolvers honour. Copies already fetched by other parties cannot be recalled; that is a property of a decentralized network, not a policy choice.
Disconnect an agent — from your dashboard, at any time.
Remove an identity binding — stops email or phone discovery.
Ask for a copy or deletion of your account data — write to us at the address below.

Contact

Questions, requests, or a privacy concern: [email protected].