Coral Hub: privacy information
Coral Hub is in closed beta. This page describes how the hub handles your data. It is a technical disclosure written in plain language, not legal advice. It is about Coral Hub only: the Coral app privacy policy covers the Coral desktop app.
Last updated: 13 October 2026. Coral Hub is in closed beta; this information may change, and we will update the date when it does.
The short version
- Coral Hub can read what passes through it. When you open a terminal, chat or file from one of your Coral servers in the hub, the content travels from your server to the hub and on to your browser. Both connections use TLS, but the hub is the end of each one, so it can read the content while it passes through. This is not end-to-end encryption.
- Coral Hub does not save that content. It is held in memory while it is being relayed and is not written to the database, the logs or disk.
- Coral Hub does save a small amount of account information, listed below.
What the hub keeps in memory briefly
To show your agents in one list, the hub keeps a short summary of each connected server's agents in memory (names, status, branch, a short summary, token counts; at most 500 live agents plus up to 200 archived ones per server, about 1.25 MiB in all). If a server's connection drops, the hub keeps only presence (name and status, not summaries, prompts, paths or commands) for 10 minutes and then forgets it. None of this is written to disk or the database. A signed-in session's account id and email are also held in memory for a few seconds, so the hub does not have to read the database on every request (a short session cache); nothing new is written anywhere.
What passes through the hub but is not stored
Terminal output and the keys you type, chat messages, file contents and listings, agent prompts, task and board data, and the requests used to launch agents. Hub logs record only that a request happened (method, route name, result, size, duration), never its content, its query string or any credential.
If you are not comfortable with a service operated by someone else being technically able to read this traffic while it is in transit, do not connect that Coral server to the hub. Local Coral keeps working without the hub.
What we store, why, and for how long
| Data | Why | How long |
|---|---|---|
| Email address | Your account and sign-in links | Until your account is deleted. During the closed beta, write to hello@subgentic.ai and we will delete your account and its data; encrypted backups age out within 30 days |
| GitHub numeric id (if you sign in with GitHub) | To recognise you on later sign-ins. We do not store your GitHub access token or other profile data | Until you unlink or delete your account |
| Server labels, settings (for example the server's access mode: view, interact or launch) and last-seen time | To show and manage your connected servers | Until you remove the server or delete your account |
| Dashboard preferences: theme, default agent type and permission mode, diff mode, display toggles, your custom colour themes, tags, folder tags and saved views | So the web dashboard looks and behaves the way you set it, on every device | Until you change or delete them, or delete your account. Never contains session content or paths from your machines other than the folder names you tag |
| Hashed server tokens | To let your Coral server reconnect. We store only a one-way hash, never the token itself | Until revoked; revoked servers are kept for 30 days for the audit trail, then deleted |
| Hashed session identifiers | To keep you signed in | Deleted at sign-out; at most 24 hours idle and 30 days total |
| Hashed one-time codes: sign-in links, OAuth state, server enrollment codes | To complete sign-in and enrollment | Minutes to hours; expired rows are purged automatically |
| Audit events: sign-in, sign-out, enrolling or revoking a server, setting changes, launches from the web. Each has a time, your account, the server involved, your IP address and your browser's user-agent text | Security, abuse response and so you can review activity on your account | 30 days, then purged automatically |
| Failed-sign-in and attack-signal events (bad server tokens, refused sign-in links, enrollment lockouts, blocked-access attempts), with the IP address, but no account details when the account is unknown | Security and abuse response | 30 days, then purged automatically |
| Operator actions (disabling an account, revoking a server by hand) | A tamper-evident operator log kept outside the database so the actions can be re-applied after a restore. Holds account and server ids, the operator's name and times, never emails or content | 360 days; older entries are replaced by a summary of the resulting state, which holds only pseudonymous account and server ids (never emails). This log is operator data, outside the database backups, and is not covered by the 30-day retention |
| Operational metrics | Running the service. Counts only; no emails, ids, IP addresses or content in labels | 30 days |
| Web server (proxy) access logs | Abuse response and troubleshooting. Time, route, result and your IP address; query strings, headers and cookies are removed | Rotated automatically: three files of 10 MB, so about 30 MB (the time this covers depends on traffic) |
| Encrypted database backups | Recovery | 30 days of backups are kept, then deleted. The encrypted backup is also copied off-site to object storage at the hosting provider, and the 30-day retention applies to that copy as well. Backups contain the data above in encrypted form. A restored backup can briefly bring back rows older than 30 days until the next purge run |
We do not sell this data. We do not use it for advertising. We do not store payment information in the hub.
Cookies
Two cookies, both strictly necessary, both Secure and HttpOnly: a session cookie that keeps you signed in, and a short-lived cookie (about an hour) used during sign-in to make sure the link or OAuth reply returns to the same browser. No tracking or advertising cookies. The hub's web interface loads no third-party scripts, fonts or images.
Who else sees your data
- Your email provider and the mail service used to send sign-in links see your address and that a link was sent.
- GitHub, if you choose GitHub sign-in, sees that you signed in to this service.
- GitHub (release check): the hub server itself contacts
api.github.comonce an hour to learn the newest public Coral release, so it can tell you when your machine is behind. It sends no user data, credentials, account or server information; GitHub sees only the hub's IP address and acoral-hubuser agent. - The hosting provider: the hub runs on a single server at a commercial cloud provider, with an encrypted off-site backup copy at the same provider. Traffic and stored data are on their infrastructure. The provider and region are not yet listed here.
- A certificate authority: the public certificate request for the hub's domain.
- Operators of the hub have access to the database and to live traffic on the machine. That access is limited to the operators of the service; changes made through the Hub's operator commands are recorded in the operator log.
Who can see what, between users
Each account sees only its own servers and agents. The hub enforces this in the application and again in the database. Another user cannot list, open or launch anything on your servers.
Your choices
- Each server starts in view-only mode. Typing into agents (interact) and starting agents (launch) are separate, per-server choices that also need the setting on the Coral server itself. Interact also includes changing a board's settings on that machine, including turning on cross-team messaging between boards there (off by default, both boards must opt in); that lets agents on different boards of the same machine pass messages to each other.
- Revoke any server from the Servers page at any time; its connection is closed immediately.
- Sign out everywhere to end all browser sessions.
Deleting your account
During the closed beta, write to hello@subgentic.ai and we will delete your account and its data; encrypted backups age out within 30 days.
Questions
Write to hello@subgentic.ai.