Privacy Policy
Effective date: October 20, 2026
Porch (porch.okibi.ai) is operated by Computer Agent Labs, Inc., a Delaware corporation with its principal place of business in California ("we," "us"). This policy explains what Porch collects, why, how long it is kept, and who processes it.
Questions or requests: hello@okibi.ai.
What Porch is
Porch gives AI agents temporary public web addresses ("inboxes") that record the HTTP requests sent to them. Agents connect to Porch over the Model Context Protocol (MCP), and the people and services they work with send requests to the inbox addresses. Porch has no user accounts.
What we collect
Requests sent to an inbox. When anyone sends a request to an inbox address, Porch stores it so the agent that created the inbox can read it: the HTTP method, path, query string, headers, body (up to 256 KB), the time it arrived, and the sender's IP address. Headers can include things like the sender's browser (user agent). What a request contains is decided by whoever sends it; Porch does not inspect or use the contents for anything other than handing them to the agent.
Approval links. When a person answers an approval link, Porch stores their choice along with the request details above. Opening an approval page is not recorded.
Agent activity. When an agent creates an inbox, Porch records the IP address the MCP connection came from (used only to enforce capacity limits), the time, and the inbox's settings, such as its lifetime and any custom responses the agent configures. Porch stores only a one-way hash of each inbox key, never the key itself.
Operational logs. Our servers log events such as "inbox created" or "inbox deleted" with inbox identifiers and timestamps. These logs never contain inbox keys, request headers, bodies, query strings, or the IP addresses of request senders.
Load balancer access logs. The load balancer in front of Porch records one line per HTTP request: the time, the client's IP address, the method and URL (including the path and query string), the response status and size, and the user agent. It does not record headers (other than the user agent) or bodies. We use these logs to keep Porch secure, investigate abuse, and understand traffic in aggregate, and they are deleted automatically after 14 days.
Aggregate usage counts. We keep daily totals, such as how many inboxes were created, which tools were called, the names and protocol versions MCP clients report (for example "claude-code"), and the hostnames that custom redirect responses point to, so we can operate Porch and detect abuse. These counts are not linked to individuals.
Porch does not use cookies, analytics, advertising, or tracking scripts, and its pages load no third-party resources.
How we use it
We use this information only to provide Porch: to deliver captured requests to the agent that owns an inbox, to enforce limits, to keep the service secure and reliable, and to investigate abuse. We do not sell personal information, use it for advertising, or use captured requests to train AI models.
Who can see it
- The agent holding the inbox key can read everything captured by that inbox. Anyone who has an inbox's address can send requests to it, so do not send sensitive information to an inbox unless you trust the agent that gave you the address.
- Service providers that host Porch for us and process data only on our instructions: Amazon Web Services (servers, in the United States) and Convex (database, in the United States).
- Legal and safety. We may disclose information if required by law, or if necessary to protect the rights, property, or safety of our users, the public, or us, including to investigate abuse of Porch.
How long we keep it
Porch is designed to forget:
| Data | Kept for |
|---|---|
| A captured request | At most 4 hours, and deleted sooner if its inbox is deleted or fills up |
| An inbox and its settings | Until the agent deletes it, 4 hours after its last use, or the lifetime the agent chose (at most 7 days), whichever comes first |
| Operational logs | 30 days |
| Load balancer access logs | 14 days |
| Aggregate usage counts | Kept indefinitely; they contain no personal information beyond the hostnames redirects point to |
Deleted data may remain in backups maintained by our service providers for a short period before it is overwritten.
Security
Porch is served only over HTTPS. Reading an inbox requires its secret key. Custom pages are served in a browser sandbox, and Porch never makes outbound requests on an agent's behalf. No system is perfectly secure; if you believe you have found a vulnerability, email hello@okibi.ai.
Your choices and rights
Because captured requests are deleted within hours, we usually hold nothing about you by the time a request reaches us. Depending on where you live, you may have rights to access, correct, or delete personal information we hold (for example under the California Consumer Privacy Act or the GDPR). To make a request, email hello@okibi.ai with the inbox address and the approximate time of the request. We will verify and respond as the law requires.
Children
Porch is not directed to children under 16, and we do not knowingly collect their personal information.
Changes
We may update this policy. We will change the effective date above and, for material changes, note them on porch.okibi.ai.
Contact
Computer Agent Labs, Inc. ยท hello@okibi.ai