Privacy Policy

Last updated: November 1, 2026

Outpost is a workspace app for coding agents, terminals, and local or cloud development environments. This policy describes the Outpost service at outpost.casa and app.outpost.casa and its desktop, web, and Android clients. Outpost is operated by Kiran Kunigiri. For privacy questions, contact kirankunigiri@gmail.com.

Outpost is not local-only. Workspace information and agent conversations sync through our hosted services so you can access them across devices, including when an execution host is offline. The AI providers and integrations you choose also receive the information needed to perform your requests.

Information we process

• Account information. Google sign-in supplies an account identifier, email address, and basic profile information permitted by the sign-in scopes. Outpost's authentication service, hosted on Cloudflare, handles this exchange and maintains your Outpost authentication session. Outpost does not receive your Google password. Google sign-in does not give Outpost access to your Gmail messages, Drive files, contacts, or calendar.
• Workspace and conversation data. This includes project and workspace names, repository and branch metadata, pane layouts, settings, drafts, queued messages, prompts, agent responses, reasoning or tool records emitted by your provider, and related runtime status. Synced raw transcripts can contain code, file contents, paths, command output, and anything an agent records. Avoid putting secrets or information you are not authorized to share into these records.
• Files and connected services. Files normally remain on the execution host, but attachments, workspace transfers, cloud execution, and agent or integration requests can send relevant files or content to hosted services. Credentials you explicitly configure or authorize Outpost to provision are processed to connect the selected services.
• Technical and support information. Hosting and authentication services process connection information such as IP addresses, request times, browser or device details, and security or error logs. If you contact us, we receive the information you include. Optional web notifications use a browser push subscription.

How we use information

We use information to sign you in, protect account and workspace access, sync your work, run the commands and agents you request, operate enabled cloud environments, deliver requested notifications, troubleshoot problems, and respond to support or deletion requests.

Google account information is used for authentication, account management, security, and related support—not for advertising or training AI models. Outpost does not request access to additional Google services through its sign-in flow.

Services that receive information

• Google provides sign-in.
• Cloudflare hosts the web client, authentication and control services, stores and synchronizes Outpost product data, including conversation records, relays authorized connections, and stores private uploaded or transferred data.
• Cloud execution providers, such as Modal, process workspace files, commands, and provisioned credentials when you use an enabled cloud workspace. Cloud availability depends on your deployment and configuration.
• Your selected AI providers and integrations receive prompts, context, files, tool requests, or other information needed for the actions you request. Examples include Anthropic, OpenAI, Cursor, providers selected through OpenCode, GitHub, and configured MCP servers. Their own privacy policies and your account settings govern their handling, retention, and any model-training use of that data.

We may disclose information when required by law, to address security incidents or abuse, or at your direction. Do not connect an agent or integration unless you trust it with the permissions and information it can access.

Storage and security

Outpost uses authenticated connections and access controls for hosted product data. Private attachments, transfers, and provisioned credential blobs use encrypted storage with keys controlled by the service. Credentials may also be kept on the execution host, depending on the integration. Credentials are not intended to be stored in ordinary synced settings or transcripts; content you or an agent include in a transcript is still part of that transcript.

Outpost is not end-to-end encrypted or zero-knowledge: the service and its infrastructure providers can process hosted data. No system can guarantee absolute security. Data may be processed outside your country, including in the United States and other locations where the selected infrastructure and providers operate.

Browser and device storage

Outpost uses local storage, IndexedDB, and browser caches for authentication, synced-data caching, preferences, and application delivery. Google and other connected services may use cookies for their own sign-in flows. Clearing browser data removes local sessions and caches; it does not delete your hosted account or workspace data.

Retention and deletion

We retain account and workspace information to provide the service and preserve your workspace history until it is deleted or no longer needed. Closing or archiving a pane, signing out, or putting a cloud workspace to sleep does not delete its retained history or files. Cloud storage, host-local files, service logs, and backups have separate lifecycles.

To request access, correction, export, or deletion of your personal information or Outpost account, email kirankunigiri@gmail.com from your account email. We may need to verify your identity. Account-wide deletion is currently handled by request. Some information may need to be retained for security or legal obligations, and removal from backups may take additional time.

Revoking Google access stops future Google authorization but does not itself delete Outpost data. Deleting data in Outpost also does not necessarily delete copies held by an AI provider, integration, your own computer, or your cloud account; you may need to manage those separately.

Your choices

You choose which projects, agents, providers, and integrations to use. You can revoke connected-service credentials through those services and disable notifications in your browser. Depending on where you live, you may have additional privacy rights, including the right to complain to your local data-protection authority. Contact us to make a request.

Changes and contact

We will update this page as Outpost's data practices change and update the date above. For questions or privacy requests, contact kirankunigiri@gmail.com.