Your data. Plain English.
Privacy Policy.
Small bills. Clear boundaries.
Last updated: September 22, 2026. The cheapos Club at cheapos.lol is operated by the cheapoS project, based in Florida, United States. Contact [email protected] for privacy questions or requests.
This policy covers the Club website, accounts, community submissions, and optional usage sharing from cheapoS. Model providers, gateways, sign-in providers, and linked sites have their own policies.
1. Local work and online services are different
cheapoS stores task work locally. When you use a remote model or gateway, prompts, selected code, attachments, and tool results may be sent to the service you configure. Local storage does not mean that no data leaves your device. Review that service’s privacy, retention, and training settings before sending private material.
The Club’s automatic usage sync does not request your source code, prompts, diffs, test output, or provider API keys. Community submissions and support messages are separate: they contain the information you choose to send. Do not include secrets or other people’s private information.
2. What we collect and why
- Account and sign-in information: an account identifier, sign-in provider identifier, handle, display name, and profile information supplied by X or GitHub, which may include an email address or avatar. Supabase handles authentication and sessions. We use this information to sign you in, attribute contributions, and maintain your account; we do not receive your X or GitHub password.
- Optional installation and usage data: installation and pairing identifiers, a public verification key, consent settings, sync sequence information, event identifiers, reporting dates, input/output token counts, access categories, agent roles, and task outcome counters when supplied by your client. Model names are included when model sharing is enabled. These records are linked to your account; they are not anonymous. We use them for profile statistics, rankings, aggregate statistics, and duplicate or abusive-report detection.
- Optional finished-work reporting: a separate cheapoS opt-in shares new unattended coding jobs, opaque job and reviewed-candidate identifiers, exact request membership, reported model charges and currency, lifecycle timing, recorded rescue actions, routine approvals, and coverage gaps. These reports are linked to your account. They contain no prompts, code, repository paths, or model identities. We use accepted signed reports for member and community finished-work statistics. Turning off this option, pausing sharing, or disconnecting deletes this additional job evidence; account deletion removes it too. Existing token-record retention is unchanged. Older tasks are not uploaded by enabling this option.
- Community contributions: titles, descriptions, repository/discussion/screenshot links, author attribution, cheers, and benchmark summaries you submit. Importing a task export extracts summaries in your browser, including model names, counters, check summaries, commit references, and changed-file paths. Those extracted fields are included when you submit the build. Review them before publishing.
- Operational information: our hosting and authentication services process request information such as IP addresses, browser information, timestamps, and errors to deliver and protect the site. Installation pairing also uses a derived IP-based identifier to limit abuse. Support messages include the contact details and content you send us.
3. What other people can see
Enabling public sharing makes your handle, display name, rank, and shared statistics available on the website and public data endpoints. Shared model information may appear on your profile and in aggregate views. Disabling profile sharing does not automatically remove community posts.
New build posts are visible only to their author and authorized site operators until an operator approves publication. Approved posts are public, including attribution and imported benchmark details, independently of leaderboard sharing. Editing a published post removes it from public view until it is approved again. Rejected posts remain privately available to their author for revision or deletion. Do not submit confidential material. Previously published content can remain in copies, search indexes, or caches controlled by others.
4. Service providers and other disclosures
We use Cloudflare for hosting and delivery, and Supabase for authentication and database storage. X or GitHub supplies the identity information used when you choose that sign-in method. Following external links or loading externally hosted screenshots or repository content can send connection information to the destination service.
We do not sell personal information or share it for cross-context behavioral advertising. We may disclose information when reasonably necessary to operate the service, comply with legal obligations, respond to lawful requests, protect people and the service, or investigate abuse. If the service changes ownership, we will give notice of material changes in how personal information is handled.
These services may process information in the United States and other countries. Protections may differ from those where you live. Provider policies describe their practices: Cloudflare, Supabase, X, and GitHub.
5. Browser storage and the playground
The site uses browser storage for your sign-in session, theme preference, and pending installation pairing. Authentication providers may also use cookies. Blocking storage can prevent sign-in or pairing from working. The scripted playground demonstrates a prepared task; watching it does not run a live agent against your repository. Any future live execution or optional analytics will need disclosures matching that feature before collection starts.
6. Your choices and account deletion
In Account Settings, you can edit your profile, change sharing choices, revoke an installation connection, and request permanent account deletion. You can also stop syncing in cheapoS. Stopping sync or disconnecting an installation does not by itself erase previously submitted token records. Finished-work reports have the separate deletion behavior described above.
Account deletion removes your Club sign-in, profile, connected installations, personal usage records, database-backed build posts, and cheers. Curated listings maintained in the site repository require a removal request to [email protected]. Your personal statistics and ranking cannot be restored. It does not delete local cheapoS files, your X/GitHub account, or external repositories.
We retain only combined anonymous token and build totals from deleted accounts for aggregate statistics, without account or installation identifiers, handles, individual event records, model lists, or reporting dates. These totals cannot be restored to a personal profile. Copies held independently by other people or search engines are outside our control.
Email [email protected] for access, correction, export, deletion help, or other privacy requests. We may need to verify account ownership without asking for your password or API keys. Depending on applicable law, you may also have rights to object to or restrict processing, withdraw consent, appeal a response, or complain to a privacy authority. We will handle requests within applicable legal deadlines.
7. Retention and security
Account and contribution data is retained while your account or published content remains active, unless you delete it or request removal. Operational records may remain as needed for security, troubleshooting, dispute resolution, and legal obligations. Backups may retain older records until the hosting provider’s normal expiry; deletion is not a promise of instant removal from every backup or external cache. We do not keep deleted accounts’ individual usage events merely to calculate aggregates.
We use access controls and signed installation messages, but no service or transmission is completely secure. Signatures establish continuity of a reporting installation; they do not prove every reported token or outcome is accurate. Please report suspected exposure or misuse to [email protected].
8. Age and policy changes
The Club is intended for adults aged 18 or older. If you believe a child has provided personal information, contact us so we can investigate and remove it where required.
We will update this page and its date when practices change, and provide additional notice or seek consent when required for material changes. See also our Terms of Service.