Privacy Policy
Last updated: September 26, 2026
This policy explains what 0bridge collects, why, and what control you have. It covers the hosted gateway at 0bridge.dev and the 0b command-line tool.
0bridge is an independent project run by an individual developer based in the Republic of Korea ("we", "us"), who is responsible for the personal data described here. Contact: support@0bridge.dev.
What we collect
Account. Your email address. If you sign in with Google or GitHub, also your name, profile picture and the account ID the provider shares. We do not receive your Google or GitHub password.
Sign-in records. Sessions and how each was signed in, one-time sign-in codes (kept until they expire or are used), device tokens for the 0b tool (stored only as a hash), and the apps you authorize, with their consent records and access tokens. If you add a passkey: its public key, name and device type (the private key never leaves your device), and your recovery codes, stored only as hashes.
Connected services. For each service you connect: its address, the label you give it, and the OAuth tokens the service issues so 0bridge can act for you. These tokens are stored in storage dedicated to your account.
Secrets vault. If you use it: the names of your values, the repo and environment each belongs to, whether it's a secret or a plain variable, and the values themselves encrypted on your device. The key that opens them stays on your devices; we never receive it, so we can't read the values. If you turn on passkey unlock, we also keep a copy of that key encrypted with your passkey, which only your passkey can open. We also keep short-lived records of approvals you give (a device using production values, a new device receiving your vault key).
Usage records. Security and audit logs: sign-ins, token and connection changes, and which tool was called on which connection, when, and whether it succeeded. We do not store the arguments or results of tool calls.
Technical data. IP address, user agent and request metadata that our hosting provider processes to deliver and protect the service.
What we don't collect
- The content passing between your AI tools and your services is relayed, not stored.
- The
0btool's local data — your manifest, synced configs and backups — stays on your computer. Your vault key and secrets referenced by local tools are kept in your operating system's keychain; vault values leave your computer only encrypted. - We do not sell personal information, use it for advertising, or use your data to train AI models.
How we use it
To sign you in, keep your connections working, protect the service against abuse, show you your own activity, and contact you about your account or changes to the service.
Who processes it
- Cloudflare hosts the service (Workers, Durable Objects, D1) and sends sign-in emails.
- Google and GitHub, only if you choose to sign in with them.
- Services you connect receive the requests your tools make through 0bridge, under their own privacy policies.
We disclose data to others only when the law requires it or to protect the service and its users.
How long we keep it
Account data is kept while your account exists. Audit logs are kept for 90 days. Expired codes, sessions, tokens and approval requests are removed. Vault values are kept until you delete them. When you delete your account, we delete your account data, connections, stored tokens and vault.
Your choices
- Disconnect a service, revoke an app or device token, or remove a passkey or vault value at any time with
0bor the web dashboard. - Ask us for a copy of your data, a correction, or deletion of your account at support@0bridge.dev.
Security
Connections use HTTPS. OAuth tokens for your connected services are encrypted at rest with a key per account. Device tokens and recovery codes are stored hashed, access tokens can be revoked immediately, vault values are end-to-end encrypted, and access to production systems is limited to us.
Changes
We will post changes to this policy on this page and update the date above. Material changes will be announced before they take effect.