Privacy
agentblip is local-first by construction. Your agent sessions are watched, aggregated, and formatted into a status entirely on your machine, by a daemon bound to 127.0.0.1:4519. This page describes exactly what the hosted relay at agentblip.com handles.
What the relay receives
- Your final status: the text (max 100 characters), the emoji, and an expiration timestamp — exactly what appears in Slack, nothing more.
- Your device token, verified against a SHA-256 hash. The relay holds the plaintext token only inside the pairing record during the handshake — it is handed to your CLI once (single-use, with a 60-second delivery grace) and the record expires within 15 minutes either way. After that, the plaintext token lives only on your machine.
- Standard request metadata (IP address) used transiently for rate limiting.
What the relay never sees
Prompts, code, file contents, tool calls, session IDs, project paths — none of it leaves your machine. The relay has no API that could even accept raw session data. One honest nuance: at the activity granularity your status text itself can include a short activity label (e.g. “finalizing CI/CD”). You choose the granularity, and your redaction patterns are applied locally before the text is sent.
Why it can read your status
agentblip requests the users.profile:read Slack scope for exactly one reason: before each update, your daemon checks what your status currently is so it never overwrites one you (or another app) set. In relay mode that check goes through the relay, which reads the status from Slack and hands it straight back to your daemon — transiently, per update decision. The relay does not store, log, or retain what it read; the write-or-stand-down decision itself is made on your machine.
What the relay stores
- A device record: your Slack user ID, team ID and name, and your Slack token — AES-GCM encrypted at rest with a key held only as a Worker secret. A KV dump alone cannot leak Slack tokens. A device record that is never used after pairing is provisional and expires after 24 hours.
- Pairing records, which are single-use and expire automatically after 15 minutes. During the handshake one briefly carries your new device token in plaintext (see above) — that is the only time the relay stores it.
- No status history. Each update overwrites your Slack status and is not logged or retained by the relay.
No analytics
The API has no analytics, no tracking pixels, and no third-party calls other than Slack itself.
Leaving
Run agentblip unlink to revoke your device record and clear your status. Statuses also carry a rolling 5-minute expiration, so anything stale clears itself.
Don't trust us? Don't use us
agentblip is MIT-licensed and the relay is a small Cloudflare Worker you can read and self-host. Or skip the relay entirely: the CLI's direct Slack sink sets your status with your own user token, and no server of ours is involved at all.