Privacy policy

Last updated: 1 November 2026

This policy covers Asset Goes Here ("agh", "we"), the service at https://app.assetgoeshere.com: its web page, its API, the agh command-line tool when it talks to that service, and its MCP server at https://app.assetgoeshere.com/mcp, which chat apps such as Claude and ChatGPT connect to.

What we collect

• Your account. Your email address, the password you set (stored by our sign-in provider, never by agh itself), and which projects you belong to with which role.
• Tools. The name and role of each tool, such as a coding agent, that a project admin adds, and the sign-in credentials agh issues for it.
• Guest links. The name an admin gives a guest link, what it allows, and what was claimed or delivered through it.
• Project content. What you and your team put into agh: asset requests and their briefs, specs, notes and tags; request batches; the files delivered for them and earlier versions of those files; review decisions and notes; the messages in each asset's conversation; and provenance, meaning whether a file was made by AI, with AI assistance or by a person, and by which model or person. When a file is delivered, agh also reads its size and its embedded metadata, such as the tool that says it made the image.
• Your repository, if you connect one. When a project admin connects GitHub, agh records which repositories that admin can reach through the agh GitHub App. agh then reads image and audio files from the project's branch (to show references and to adopt existing files) and opens pull requests that add accepted files and .agh/provenance.yaml.
• Feedback and bug reports. What you send with agh's feedback tool (agh feedback send, or send_feedback in a chat app or coding agent, which may send one for you when an agh tool fails): the message, whether it is a bug or feedback, the project, asset or tool it is about, the app that sent it, and who sent it, with your email or tool name when it names a project.
• Server logs. Our servers log errors and which agh tools are called, to keep the service running and secure. These logs don't record your email address or IP address.

Chat apps and the MCP server

When you connect a chat app to agh, you sign in with your agh account, and the app can only do what your project role allows. agh receives only what the app sends to a tool, such as the project and asset ids, a brief or a delivered file. agh does not receive or store your conversation with the chat app, and it does not read the app's memory, chat history or your other files. When a chat app hands agh a link to a file from the conversation (ChatGPT's deliver_file), agh downloads that one file from the chat app's own file storage and saves it as the delivery.

What we don't do

• We don't sell your information or share it with advertisers.
• We don't use analytics, advertising or tracking cookies. The web page keeps your sign-in in your browser's session storage, which clears when you close the tab, and serves its own fonts.
• We don't use your files or project content to train AI models.

How we use it

We use this information only to run agh for you: to sign you in, to show your projects to the people in them, to keep the request, delivery, review and publishing history, to publish accepted files to your repository, to build the AI disclosure report for your project, to read your feedback and bug reports and improve agh, and to fix problems and keep the service secure.

Who can see it

• Your project. Other members of a project see that project's content, according to their role. Guests see only the requests their link covers.
• agh's operators. The people who run agh read feedback and bug reports. Other members of your project don't see them. To track fixes, agh copies each report into a private issue tracker on GitHub that only agh's operators can see. The copy says what the report is about but not who sent it, and any passwords, keys or email addresses in the message are blanked.
• The public, if an admin chooses. A project admin can publish an AI disclosure page, which anyone can read. It shows counts by category and provenance and the AI tools used, not individual asset ids or files. The admin can withdraw it at any time.
• Service providers. agh runs on Amazon Web Services in the United States, which hosts the service, stores the data and files, and sends sign-in emails. When a project connects GitHub, files and pull requests go to that repository on GitHub, under GitHub's own terms.
• When the law requires it. We disclose information if we must by law, or to protect the safety or rights of people or the service.

How long we keep it

• Your account is kept until it is removed. Project content, including earlier versions of files and the review history, is kept for as long as the project exists, because that history is what agh records.
• An upload that is never delivered is deleted after seven days.
• Backups of the inventory are kept for up to 35 days after a change.
• Feedback and bug reports are deleted a year after they're sent. Their copies in our issue tracker stay there as the record of the fix.
• Server logs are deleted after 30 days.
• Files already published to your repository stay there under your control; removing them from agh doesn't change your repository.

Your choices

• Project admins can remove members, tools and guest links, and withdraw a published disclosure page, at any time.
• To see, correct or delete your account or your project's data, write to us at the address below. We answer within 30 days.
• You can disconnect a chat app at any time in that app's settings, and remove the agh GitHub App from your account or organization in GitHub's settings.

Children

agh is a tool for teams making games and isn't directed at children under 13. We don't knowingly collect information from them.

Changes

If we change this policy, we update this page and its date.

Contact

Questions about this policy or your data: support@assetgoeshere.com. See also Support.