1. Controller and scope
liwei, based in Shenzhen, China, is the controller for the ReignHub official service. Contact liwei2633@gmail.com about privacy and liwei2633@gmail.com for support.
This Policy covers the official service at https://reignhub.app and ReignHub clients connected to it. Independently hosted services are operated by their respective operators; ask them about their policies. Open-source client caches and pairing keys reside on the devices you use.
This Policy explains processing; using the service does not replace separate consent where law requires it. We do not use your sessions or attachments to train AI models. We do not sell personal information or share it for cross-context behavioral advertising.
2. Information we process
| Category | Data | Purpose |
|---|---|---|
| Account and social sign-in | Identifiers, name, email and avatar authorized through GitHub or Google, plus authorization tokens and session information needed for sign-in | Authentication, account identification and security |
| Devices and pairing | Device names, IDs, public keys, credential hashes, account ownership, agent-product identifiers, pairing relationships and online status | Discovery, authorization, synchronization and plan enforcement |
| Network and security | IP address, browser User-Agent, request times, connection status, errors and necessary security records | Connectivity, abuse prevention and troubleshooting |
| Subscriptions and transactions | Account identifier, email, plan, currency, order IDs, payment/refund status, subscription expiry and necessary transaction records | Checkout, billing and entitlements |
| Support communications | Email, explanations, attachments and redacted diagnostic information you provide | Responding to questions and requests |
| Encrypted connection data | Pairing envelopes, signals and end-to-end encrypted application frames in transit | Connection coordination and data forwarding |
Do not send support access passwords, pairing private keys, full card numbers, security codes or unnecessary private conversations. Remote control does not require precise geolocation, contacts or advertising identifiers.
3. Conversations, attachments and local data
Agents and projects run on the host computer. Conversations and attachments travel end-to-end encrypted. Cloud relay does not hold the pairing private keys needed for decryption or persist plaintext content. Connection metadata such as device IDs, public keys, online status and IP addresses is separate from conversation content and is processed under this Policy.
Native clients use SQLite and local files; Web uses IndexedDB for pairing identity, sessions and attachment caches. You can clear this data through the app or browser. Doing so affects offline access and may require pairing again. Revoking authorization or deleting a cloud account does not remotely erase content already downloaded by other devices.
QR pairing uses the camera; selecting or uploading attachments uses system file access. QR recognition is used for pairing, without continuously recording video or uploading camera footage to the official service. Files you choose to send reach the paired computer and may be submitted to a model provider by your chosen agent under its own rules.
4. Purposes and legal bases
Where relevant data-protection laws apply, we process necessary personal data on these bases:
| Purpose | Basis |
|---|---|
| Accounts, discovery, pairing, connections and synchronization | Performing the service contract you request |
| Charges, refunds and subscriptions | Contract performance and tax/accounting obligations |
| Account security, fraud and abuse prevention, troubleshooting | Legitimate interests in protecting users and the service; legal obligations where applicable |
| Support, billing and security notices | Contract performance or legitimate interests |
| Data-rights requests and regulatory requirements | Legal obligations |
| Optional features requiring separate permission | Your consent, which may be withdrawn as provided by law |
We do not make decisions with legal or similarly significant effects based solely on automated processing of personal information. Plan quotas and access checks implement the service you choose.
5. Cookies, browser storage and analytics
Sign-in uses cookies necessary for sessions and security. Login sessions last up to 30 days and may be renewed during continued use; signing out invalidates the session. A language-preference cookie remembers your explicit language choice for up to one year. Browser storage also supports device trust, preferences and session caches, and can be cleared in browser settings.
The website and console do not configure advertising trackers or third-party marketing analytics scripts. Cloudflare processes necessary request information for networking, security and operational monitoring. If we introduce analytics or marketing technologies that require consent, we will update this Policy and obtain that consent before enabling them. Browser Do Not Track settings do not disable strictly necessary service processing.
6. Providers and sharing
We share necessary information only to deliver the service, comply with law, protect rights or follow your explicit consent.
| Provider or recipient | Data and role |
|---|---|
| Cloudflare | Website, connectivity and database hosting; network requests, security information and service metadata |
| GitHub / Google | Identity authorization through your selected sign-in provider, under its own policy |
| Waffo Pancake and payment partners | Checkout, subscriptions, payments, refunds, transactions and legally required billing information |
| Devices you authorize | Remote instructions, conversations, files and necessary connection information |
| Agents and model providers you choose | Prompts, files and tool context sent by your agent under its configuration and their respective policies |
Waffo Pancake and its payment partners handle full payment-card numbers and security codes. ReignHub servers do not store them. We receive identity and transaction status necessary to complete orders and supply access.
We may disclose necessary information in response to lawful court or regulatory demands, or to address security incidents and protect legal rights. If a merger, acquisition or service transfer changes the controller, we will notify affected users and require continuing protection obligations.
7. Security
Official Web and API access uses HTTPS/WSS; conversations and attachments use device-to-device end-to-end encryption. Pairing private keys stay on devices. Cloud credentials receive hashing or appropriate protection, and service access is controlled by permissions.
Protect your accounts and devices and review pairing trust regularly. Authorized controllers can read content they are permitted to access. If a personal-data breach occurs, we notify authorities within applicable legal deadlines and affected users promptly where required by law.
8. Retention and deletion
Canceling a subscription does not delete your account or device directory. Retention is as follows:
| Category | Retention |
|---|---|
| Account information, third-party authorization and device ownership | While the account is used; verified deletion requests are handled within 30 days, except records that law requires us to retain |
| Expired login sessions and temporary authorization | Expire at their stated lifetimes and are removed by cleanup; login sessions last up to 30 days |
| Transaction, billing and refund records | For the active subscription and thereafter only as needed for applicable statutory tax/accounting retention periods or unresolved payment disputes; non-required personal data is deleted or de-identified |
| Support communications | Up to 12 months after resolution, except disputes or legal holds |
| Necessary security and audit records | Up to 90 days, except extensions necessary for investigations or legal requirements |
| Deleted data in database backups | Database recovery history rotates out within 30 days after deletion; recovery access is restricted |
| Device session caches and attachments | Until you clear local data, uninstall the app or the browser reclaims storage; cloud account deletion does not remotely erase other devices |
Legally retained data is restricted to its retention purpose, not account reactivation or marketing. Cloudflare, identity and payment providers may independently retain records under their legal obligations; consult their policies too.
9. Your rights and requests
Contact liwei2633@gmail.com to request access, copies, correction, deletion, restriction or a portable copy of personal data, or to object or withdraw consent where applicable. We may request necessary identity verification to protect your account; we will not ask for pairing private keys or full card details.
We respond within 30 days. If law permits an extension or exception, we explain the reason and expected timing. You may complain to a competent data-protection authority where you live. Withdrawal does not affect prior lawful processing or processing necessary for contractual and legal obligations.
You can view and remove account devices on the account page. To stop a controller's access, also revoke its pairing trust on the host.
10. International processing
Cloudflare operates a global network. Identity and payment providers may also process information outside your country. Service metadata and information you supply to those providers may therefore be processed internationally.
We use transfer bases and safeguards required by applicable law, such as applicable data-processing agreements, adequacy decisions or standard contractual clauses. Device-to-device conversations and attachments remain end-to-end encrypted. Contact our privacy email for information about arrangements applicable to you.
11. Age requirement
The official service is intended for users aged 18 or older, not children. If you believe an underage user supplied personal information, contact liwei2633@gmail.com so we can investigate and take deletion or restriction measures.
12. Notices and third-party services
We may send necessary sign-in, security, billing, service and policy notices. Account email is not enrolled in marketing by default. Any optional marketing will have required consent and an unsubscribe method.
Agents, model providers, sign-in and payment services may have their own terms and privacy policies. This Policy covers ReignHub official-service processing, not independent third-party processing.
13. Policy updates
This is version 1.0, last updated and effective 2026-11-14. Material changes are announced on the website or to your account email at least 14 days in advance, except where law requires immediate effect. We seek separate consent for new processing purposes where required.
14. Contact
Controller: liwei. Privacy and data requests: liwei2633@gmail.com. Support, billing and refunds: liwei2633@gmail.com.
For service use, cancellation and refunds, see the Terms of Service.