Short version. The AgentWeave website has no analytics, advertising cookies, or account database. AgentWeave Developer Tools stores Google authorization credentials locally and sends them directly to Google APIs only when you ask it to configure Firebase.
1. Scope and publisher
This policy applies to the website at agentweave.secondloop.app and to the Google OAuth flow identified as AgentWeave Developer Tools by SecondLoop.
AgentWeave is an open-source Agent App Framework maintained by the SecondLoop project team. This website provides project information, legal disclosures, and authorization help. Questions may be sent to a@secondloop.app.
2. What the Google authorization flow does
The authorization flow helps a developer select or create a Google Cloud project, enable the APIs needed for Firebase, add Firebase to that project, and configure Firebase Authentication with email and password. It is a developer setup flow, not the login flow used by an Agent App's end users.
Google displays the requested permissions before access is granted. AgentWeave cannot authorize itself and does not receive your Google password.
3. Information processed
Google authorization and project data
- OAuth authorization responses, access tokens, refresh tokens, expiry information, and the selected OAuth client metadata.
- Google Cloud project identifiers, project display names, lifecycle state, and Firebase project configuration returned by Google APIs.
- API enablement and Firebase configuration results required to complete the setup you requested.
Local application data
Authorization state, PKCE verifiers, tokens, and related credential material are stored through the Host's local sensitive-value store. They are not returned through the normal product API or UI and are not uploaded to a SecondLoop-operated credential service.
Website request data
This static website is delivered by Cloudflare Pages. Cloudflare may process standard request information such as IP address, browser and device information, requested URL, timestamps, and security events to deliver and protect the site. The website does not add analytics scripts, advertising pixels, or non-essential cookies.
4. How information is used
Google authorization and project data is used only to:
- complete the Firebase setup action initiated by the developer;
- show setup progress, project choices, and actionable errors;
- refresh authorization when the developer continues an authorized setup; and
- disconnect, retry, or revoke the local authorization state.
We do not use Google user data for advertising, profiling, credit decisions, or training general-purpose AI models.
5. Google API Services User Data Policy
AgentWeave's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Access is limited to the developer-directed Firebase configuration workflow. Google user data is not sold, used for personalized advertising, or transferred to data brokers.
6. Storage and retention
OAuth credentials remain in the local AgentWeave Host's sensitive storage until you disconnect, revoke access, clear the relevant local application data, or the credential expires and cannot be refreshed. Short-lived authorization state is limited to the active setup window and is deleted after completion, cancellation, or expiry.
The website itself does not maintain a user database. Cloudflare may retain operational and security logs according to its service configuration and policies.
7. Sharing and service providers
AgentWeave sends OAuth and project requests directly to Google endpoints needed for authorization, Cloud Resource Manager, Service Usage, Firebase Management, and Identity Toolkit configuration. Cloudflare provides website delivery and security. We do not sell Google user data or share it with unrelated third parties.
Links to GitHub, Google, and other third-party sites are governed by those services' own policies after you follow the link.
8. Your choices and deletion
- Do not begin the Google connection if you do not want to grant the displayed permissions.
- Disconnect or reconfigure Firebase authorization from AgentWeave Developer Tools.
- Remove AgentWeave access from your Google Account connections.
- Clear the local AgentWeave application data or uninstall the application to remove locally held credentials, subject to your platform's backup behavior.
Detailed instructions are available on the OAuth help page.
9. Security
The Desktop authorization flow uses an external browser, a loopback callback restricted to 127.0.0.1, per-request state, and S256 PKCE. Sensitive values use redacted types and Host-controlled storage. No security control is infallible; developers should use dedicated test projects before granting production access.
10. Children and regulated use
AgentWeave Developer Tools is intended for developers and is not directed to children. AgentWeave 0.1.x is not presented as a reviewed solution for regulated or high-risk data. App teams remain responsible for their own privacy, security, retention, and compliance review.
11. Changes and contact
We may update this policy as the framework, authorization scopes, or deployment model changes. The effective date above will be updated when material changes are published.
For privacy questions or deletion assistance, contact a@secondloop.app.