Privacy Policy
Last updated: October 30, 2026
1 Introduction
Glitch CAP Labs, LLC ("GCAP Labs", "we", "us", or "our") develops Headmaster, an AI agent app for your desktop, the web and the cloud, and operates this website at gcaplabs.com. This Privacy Policy describes how we handle information when you use the website or contact us.
Where your data goes depends on the mode you use. Cloud mode runs on a Headmaster-hosted runtime. Work mode runs on your own PC. The table below is the single source for this: the Security page and the docs show the same table.
| Data | Work mode (your PC) | Cloud mode (hosted runtime) |
|---|---|---|
| Prompts and replies | Handled on your PC, then sent to the model provider you choose (the Headmaster relay, ChatGPT, Claude or your own key). | Handled on your Headmaster Cloud runtime, then sent to the model provider you choose. |
| Files and documents | Stay on your PC unless a task passes their content to a model or a connected tool. | Held on your Cloud runtime. Their content is sent to a model or tool when a task needs it. |
| Memory | One memory per account, shared with Cloud, stored with your Headmaster account. | The same account memory, stored with your Headmaster account. |
| Provider API keys | Stored in the app on your PC. | Stored with your Headmaster account on our servers. You can replace or remove a key, but it is never shown again. |
| Account and usage details | Held by GCAP Labs: email, plan, usage counts. | Held by GCAP Labs: email, plan, usage counts. |
| Connected services (Telegram, Slack, email and others) | Each service receives the data a task sends it and applies its own policy. | Each service receives the data a task sends it and applies its own policy. |
2 Data we collect
2.1 Information you provide
- Contact details: name, email address, and organisation name when you submit the contact form or sign up for updates.
- Voluntary communications: support tickets, feedback, and survey responses.
- Payments: when you add credit through PayPal, we receive the amount, the time, the PayPal transaction reference and whether it was completed, refunded or reversed. PayPal handles your payment details. We never see your card number or PayPal password.
2.2 Information collected automatically
- Website logs: IP address, browser type, page visits, and request metadata for security and diagnostics. We do not use this data for advertising.
- Website analytics: we use Vercel Web Analytics to count page views, referrers, and the country, browser and device type of visits, so we can see which pages people use. It sets no cookies, does not follow you to other sites, and keeps no record that identifies you; a visit is recognised for one day at most, by a hash Vercel discards.
- Cookies and browser storage: we use only what is needed to run your account. We use no advertising or tracking cookies, so there is no cookie banner to accept.
- Sign-in cookies keep you signed in. They last up to 400 days, or until you close the browser if you turn off “remember me”.
- A “remember me” cookie stores that choice, for the same period.
- A short-lived cookie (about 10 minutes) carries a sign-in request between pages when you connect an app to your account.
- Your browser's local storage keeps display settings such as theme, layout and saved views on your device. Session storage holds an organization invite you opened before signing in until you finish. Neither is sent to us for tracking, and you can clear them in your browser settings.
- At sign-in and sign-up, a bot check from a security provider runs in the page to keep automated attacks out. It is not used for advertising.
- Error reports: crash or error information you choose to send us.
2.3 What we do not collect by default
In Work mode your prompts and files stay on your PC except where a task sends them to the model provider or connected service you chose. In Cloud mode they are processed on your hosted runtime, which GCAP Labs operates. We do not use them for advertising, we do not sell them, and we do not use them to train AI models.
3 How we use your data
We use the information we collect to respond to you, maintain the website, provide support, and improve Headmaster. We do not sell your personal data to third parties, and we do not use your Headmaster data to train AI models.
4 Model providers and your own API keys
Headmaster connects to model providers you choose (for example the Headmaster relay, ChatGPT, Claude, or a custom endpoint), with your own API keys where you add them. Those providers process your prompts according to their own privacy policies. We recommend reviewing each provider's policy before enabling it in Headmaster.
5 Connected apps service
When your organisation's administrator turns on connected apps, Headmaster uses a third-party connector service to connect the apps you choose. It receives the sign-in grants for the apps you connect, the content of each request your agent makes to those apps, and any files passed through them. It processes this on its own servers only to run those connections, under its own privacy policy. This service is off unless your administrator turns it on.
6 Who processes data for us
We use these service providers (sub-processors) to run Headmaster. Each handles data only to provide its service to us, under its own terms.
- Supabase: our account database, sign-in and wallet records.
- Hetzner: the servers that run Cloud agents, chat and our relay.
- Cloudflare: network protection, our private tunnel to those servers, and storage for backups and app downloads.
- Vercel: hosting for this website, and the privacy-friendly page-view counts described in section 2.2.
- Resend: the emails we send you, such as approval, invite and low-balance notices.
- PayPal: payments and refunds.
- Model and voice providers: when a request uses the Headmaster relay, the text or audio of that request goes to the model, speech or transcription provider that serves the model you picked. The provider shown for a model in the app is the one that processes it. Providers that you connect with your own keys are covered in section 4.
Our servers, and some of these providers, may process data outside the country where you live.
7 Data retention
We retain contact and support data for as long as necessary to respond to you and comply with legal obligations. Work mode data on your device is under your control and you can delete it from the application settings.
You can delete your account from the Headmaster apps. When you do, we sign you out on every device and stop your Cloud runtime straight away, and we delete your account, Cloud mode data and memory 14 days later. Signing in again before then cancels the deletion and keeps everything as it was. You can also email us to ask for deletion.
If your balance runs out, we switch your Cloud agent off and keep its files. After it has been switched off for 48 hours we may move those files into an encrypted backup and remove the stopped agent; adding money restores it on the current version, which takes about 10 minutes. We keep that backup for 90 days while your agent stays switched off, then delete it for good, and a later top-up sets up a new agent. Our regular backups may still hold older copies of those files until they rotate out: about one month for nightly backups and up to 180 days for offsite copies. Your agent's memory is not part of this backup and is kept until you delete your account.
Payment records are the one thing that stays. For each top-up, refund and reversal we keep the amount, the date, the PayPal reference and an internal account number, with no name, email address or prompts, so we can settle a dispute and keep our own books. Deleting your account also deletes your wallet and any unspent credit, so ask for a refund first if you want one; see Refunds.
8 Children and young people
Headmaster accounts are for organizations and adults. If you are under 18, you may use Headmaster only through an organization (for example a school) that has the right to enrol you and that accepts these terms on your behalf, and with the permission of your parent or guardian where the law requires it. We do not knowingly create an account for a child outside such an organization, we do not use anyone's data for advertising, and if you believe a child has given us personal data without that permission, email privacy@gcaplabs.com and we will delete it.
9 Your rights
Depending on your location, you may have the right to access, correct, delete, or restrict processing of the personal data we hold. To exercise these rights, email us at privacy@gcaplabs.com.
10 Security
We use reasonable technical and organisational measures to protect data sent to us through the website. In Work mode your workspace data is also protected by your own operating system and disk encryption; in Cloud mode it sits on the hosted runtime. For more details, see our Security page.
11 Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page when we do.
12 Contact us
For questions about this Privacy Policy or our data practices, please contact us at privacy@gcaplabs.com.