Privacy Policy
Last updated: 2026-05-16
This Privacy Policy describes how p2claw ("we," "us," or "our") collects, uses, and discloses information about you in connection with the p2claw website at p2claw.com, the p2claw agent and command-line tools, and any related services we provide (collectively, the "Services"). By using the Services, you agree to this Policy.
blue-otter-7392. The full URL a visitor types
looks like app-blue-otter-7392.p2claw.com.
Aliases are not reassigned, even after a peer is deleted
or revoked.
The Services do not require you to create an account or provide a name, email address, or payment information. If you choose to contact us (for example, by emailing us about a privacy request), we will collect the contact details and message contents you send. If we offer paid plans in the future, we will collect the information needed to deliver and bill those plans, as described at the relevant signup flow.
When you use the Services, we automatically collect certain information, which may include:
Most traffic between visitors and the apps you publish flows directly between their device and your machine, encrypted in a way we cannot read. We see that the connection happened — when, between which addresses, and how many bytes flowed — but not the request or response contents.
Some inbound traffic cannot use that direct path — for example, webhooks from third-party services, requests from tools that don't have p2claw installed, and other cases where data is routed directly through our edge. In those cases we accept the public HTTPS connection and forward the bytes to your machine over a fresh encrypted connection. During that forwarding window we receive the request and response in plaintext. In the ordinary course, our edge does not log or persistently store request or response bodies. We may retain bytes briefly to investigate suspected abuse or to comply with legal obligations.
When a direct connection between a visitor and your machine is prevented by an unusually restrictive network in between, the connection falls back to a relay run by a third party. The relay sees encrypted bytes, byte counts, and the IP addresses involved, but cannot read the contents.
Whichever path a request takes, we always see:
Some apps published through p2claw require visitors to
sign in. For those, we operate an OAuth broker at
oauth.p2claw.com that federates to upstream
identity providers (such as GitHub) when you sign in to
an auth-gated app. The provider you choose sees the
standard OAuth scopes p2claw requests; p2claw sees what
the provider returns about you. The broker is only in
the request path when an app has explicitly enabled
sign-in; apps that don't require sign-in never involve
the broker at all.
When you sign in through the broker, the broker sees:
After it mints your session token, the broker is out of the path. The token is delivered to your browser as a cookie scoped to the app you signed in to. The broker does not see anything you do in the app after that point.
The broker does not keep upstream access tokens or refresh tokens from the provider you signed in with. It reads the profile fields it needs, mints the session token, and discards the upstream token. We do not have ongoing access to your provider account on your behalf.
The app you signed in to — running on its host's hardware, not ours — receives the identity fields it needs (your email, display name, etc.) as request headers handed to it by the p2claw daemon on the host's machine. The session token itself stays out of the app's reach.
We use the information we collect to:
We share information with third parties who provide services on our behalf, subject to obligations consistent with this Policy. Categories include providers of hosting and content delivery, DNS resolution, peer-relay infrastructure, customer support, analytics, security and fraud prevention, and (if and when paid plans launch) payment processing.
Where the network does not permit a direct peer-to-peer path, traffic between a visitor and your machine may be routed through a third-party relay. The relay sees encrypted bytes and the IP addresses at either end; it does not see the underlying content. The relay provider's own privacy policy applies to that hop.
We may disclose information if we believe in good faith that doing so is reasonably necessary to comply with a legal obligation, lawful request, or court order; to protect the rights, property, or safety of p2claw, our users, or others; or to detect, prevent, or address fraud, security, or technical issues.
If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information we collect may be transferred as part of that transaction.
We do not sell your personal information, and we do not share it for purposes of cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable law (including the California Consumer Privacy Act).
The marketing site may use cookies and similar technologies for functionality, traffic measurement, and security. Most browsers let you refuse or delete cookies; doing so may affect site functionality. We do not currently use the marketing site for cross-context behavioral advertising. If we add advertising or marketing-attribution tools in the future, we will update this Policy to describe them and any opt-out mechanisms.
We retain information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Identifiers we issue (peer fingerprint and alias) are retained for the lifetime of the corresponding peer. We do not reassign aliases that are or have recently been associated with active peers, so that previously-issued URLs remain unambiguous; we may release aliases that have been dormant for an extended period, or reissue identifiers for operational reasons such as system recovery. Operational and diagnostic logs are retained on a rolling basis and deleted thereafter.
Because the Services are built around a public/private key pair generated on your device, you control most of your information directly:
p2claw identity to see your peer identifier
and alias, and p2claw routes to see the routes
you have published.
Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a copy of the personal information we hold about you, to object to or restrict certain processing, and to lodge a complaint with a data protection authority. Where we process your personal data on the basis of our legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by applicable law. We do not discriminate against users who exercise their rights.
We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction. The peer-to-peer wire protocol used by the Services applies cryptographic authentication and end-to-end encryption to traffic between peers. No system is perfectly secure, however, and we cannot guarantee the security of information transmitted to or stored by us.
We operate the Services from infrastructure located in one or more countries which may be different from the country in which you reside. By using the Services, you understand that your information may be transferred to, stored in, and processed in those countries. Where required, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) for cross-border transfers of personal information.
The Services are not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If we learn that we have collected such information, we will delete it.
We may update this Policy from time to time. If we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice (such as via the Service or a release note).
For privacy questions, requests to exercise your rights, or anything else covered by this Policy, contact privacy@p2claw.com.