Data And Privacy
AgentHub coordinates local files, runtime output, team review, and product identity. This page explains where data should live, what public docs can say, and what must stay local, server-side, or private.
Boundary
The public website is documentation and product packaging. It is not the Hub API, not a model gateway, and not an authorization surface for local files or team projects.
Data Classes
| Data | Owner | Public handling |
|---|---|---|
| TokenDance ID profile | TokenDance ID and the product session that consumes it | Public docs may name claims such as subject, email, and display name, but must not publish user records or tokens |
| Hub session | Hub Server | Public docs describe the session boundary only; tokens, cookies, and signing secrets stay server-side |
| Workspace path | Local Edge / authorized Edge target | Public screenshots must redact private absolute paths and usernames |
| File content | Edge target and explicit user review flow | Do not copy private file content into docs, issues, cards, or screenshots |
| Runtime transcript | Edge events and Hub audit when routed through Hub | Public examples use synthetic prompts and sanitized outputs |
| Diff and artifact | Edge event stream, Desktop/Web review surface | Public docs may show mock diffs; real diffs require owner approval and redaction |
| Model provider credentials | Local environment or server secret store | Never put provider keys in frontend bundles, docs, screenshots, cards, logs, or issue templates |
| Feishu/Lark actor context | Integration Gateway and TokenDance ID binding | Public docs describe tenant/user mapping, not raw callback payloads |
Local Execution Boundary
Desktop and Local Edge are intentionally local-first. A local run may inspect files, start runtime CLIs, stream logs, and produce diffs. Those actions should stay within an allowlisted workspace and an explicit approval policy.
The website mock can demonstrate the shape of a task, but it must not imply that a browser page can read arbitrary local files or start a local CLI. Web workbench actions should route through Hub authorization and an authorized Edge target.
Public Screenshot Rules
Before publishing screenshots:
- Replace real repository paths with short placeholders such as
workspace/app. - Use synthetic prompt text and mock file names.
- Avoid showing provider dashboards, account emails, raw request payloads, access tokens, API keys, or internal hostnames.
- Prefer generated Desktop mock states for public pages.
- Keep failure states honest, but remove private logs and user data.
Event And Log Policy
AgentHub events should be useful for debugging without leaking secrets. Event payloads should prefer stable ids, relative paths, run state, status codes, error codes, and redacted summaries.
Avoid logging:
- Full
Authorizationheaders, provider keys, OAuth codes, refresh tokens, or client secrets. - Absolute user directories when a relative workspace path is sufficient.
- Full prompt or file content in public logs.
- Raw Feishu/Lark encrypted payloads, verification tokens, tenant tokens, or card-action secrets.
Retention Direction
Retention is product-local and still being shaped. Until a stable retention policy is published, public docs should use conservative wording:
| Surface | Current public wording |
|---|---|
| Desktop local run | Local preview state and artifacts are user-controlled and should be treated as local development data |
| Hub-backed task | Hub may persist sessions, tasks, events, audit records, and review state according to product policy |
| Web workbench | Web renders Hub-authorized state and should not directly persist local files |
| Feishu/Lark entry | IM payloads should contain compact task ids and safe summaries, not full task context |
| Remote/Cloud Edge | In development; do not claim stable retention, compliance, or enterprise policy yet |
Access Control Principles
- Authentication comes from TokenDance ID.
- Product authorization is owned by AgentHub Hub Server.
- Local file access is owned by Edge policy and user approval.
- Model API credentials belong to local runtime configuration or server-side secret storage.- TokenDance API keys are not TokenDance ID sessions.
- Website personalization is low-risk and cannot authorize Hub API access.
User-Facing Copy Rules
Use precise language:
- Say "Local Edge can access allowlisted local workspaces" instead of "the website reads your files."
- Say "Hub-backed Web routes through Hub and an authorized Edge target" instead of "Web runs local CLI."
- Say "runtime output may include sensitive project context" instead of treating transcripts as harmless chat.
- Say "in development" for Remote/Cloud Edge privacy claims until there is implementation and policy evidence.
Review Checklist
Before merging a docs, UI, or integration change that touches data:
- The page states which component owns the data.
- Public examples use placeholders and synthetic content.
- Screenshots do not expose private paths, users, tokens, or real customer data.
- Event examples have redacted payloads.
- The copy separates TokenDance ID login, AgentHub product sessions, and TokenDance API keys.
- If a capability is not stable, the page says "in development" or "preview" instead of making compliance promises.