Armos is a PII masking layer for AI applications, operated by Dhroov Gupta ("we", "us", "Armos") from India. This policy explains what data we collect when you use armos.dev, the Armos Python/Node SDK, or the @armos/mcp Claude Code integration — and what we do with it.
The short version: we collect the minimum necessary to run the service. We never store your prompts, responses, or the actual PII that Armos masks. Audit logs contain only metadata — entity types and counts.
Waitlist email — If you submit your email on armos.dev, we store it to contact you about early access and product updates. You can ask us to delete it at any time.
Usage metadata (proxy users) — When a request passes through the Armos proxy, we write an audit log entry containing: entity types detected (e.g., NAME, EMAIL), entity count, model name, and provider. We do not log prompt text, response text, or the actual values that were masked. The PII itself is never stored anywhere in our system.
API key hash (registered users) — We store the Argon2id hash of your API key for authentication. The plaintext key is never written to disk or database.
Analytics — armos.dev uses Vercel Analytics, which collects anonymous page view data (page URL, referrer, country-level location, browser type). No personally identifiable information is collected by analytics. See Vercel's privacy documentation for details.
Email: to reach out about Armos updates, early access, or your enquiry. We do not sell or share your email with any third party.
Usage metadata: to provide the dashboard (audit log, entity counts), detect abuse, and improve detection accuracy. This data is associated with your app ID, not your personal identity.
Analytics: to understand which pages are useful and how traffic arrives. Aggregated and anonymous.
We use the following third-party infrastructure to operate Armos:
Each provider processes data only as necessary to deliver the service. We do not use your data for advertising or share it with data brokers.
Waitlist email: retained until you request deletion or we launch and migrate to a proper CRM, whichever comes first.
Audit log entries: retained for 90 days by default. Enterprise plans can configure custom retention.
Redis vault entries: expire automatically after the session TTL (default 24 hours). Nothing persists after expiry.
API key hashes: retained for as long as your account is active. Deleted when you delete the app.
Regardless of where you are located, you can ask us to:
Email dhroov@armos.dev with the subject line "Privacy Request". We do not require you to fill out any form and will respond within 5 business days.
API keys are stored as Argon2id hashes — we cannot recover your plaintext key. Vault entries are encrypted with AES-256-GCM(HKDF(api_key, token)); the encryption key is derived per-request and never persisted. Even in the event of a database compromise, vault contents are unreadable without the original API key.
We use HTTPS everywhere. No sensitive data is transmitted over unencrypted connections.
Armos is a developer tool. We do not knowingly collect data from anyone under 18 years of age.
We may update this policy as the product evolves. Material changes will be noted at the top of this page with a revised date. Continued use of Armos after a change constitutes acceptance of the updated policy.
Questions, requests, or concerns — email dhroov@armos.dev. We aim to respond within 2 business days.