Privacy Policy
ExperLab ("we") operates the 100doo VS Code extension, the 100doo desktop app, 100doo Remote (app.100doo.com), and the related websites (ai.experlab.com, experlab.com, 100doo.com), and complies with the Personal Information Protection Act of Korea and related laws. This policy explains what personal information we process, why, how long we keep it, and how we protect it.
- 100doo runs on your computer. Your source code, prompts, and task history are never sent to our servers.
- What you exchange with AI agents goes directly from your computer to the AI services you choose.
- We collect no usage telemetry, use no advertising or tracking cookies, and have no user accounts.
- Our servers process information in only four cases: ① visiting our websites ② multi-device remote monitoring (optional) ③ public design voting (optional) ④ email inquiries.
1. What we process, why, and for how long
| Context | Information | Purpose | Retention |
|---|---|---|---|
| Website visits (ai.experlab.com, experlab.com, 100doo.com, app.100doo.com) |
IP address, access time, requested URL, browser information (User-Agent), referrer | Serving the sites, troubleshooting, detecting security threats | Rotated within a per-service log size limit (about 30 MB); the oldest entries are deleted automatically when the limit is reached |
| Multi-device remote monitoring (relay.100doo.com — only if you turn it on) |
Device identifier (randomly generated), hash of the connection key, device public key, first registration and last connection time Connection log: IP address, time, connection event, part of a hash of the device identifier |
Relaying connections between your devices, preventing unauthorized registrations and excessive connections | Device record: deleted automatically after 90 days without use Connection log: same as website visits |
| Public design voting (vote.100doo.com — only if you publish a round) |
Publisher: uploaded design files, round details, an install token used to limit publishing Voters: voter token (cookie), chosen design, optional name and comment, vote time Invite mode: invitee names entered by the publisher |
Publishing designs, collecting votes, preventing duplicate votes | Design files and votes are deleted automatically 14 days after the round is created |
| Email inquiries | Email address, message content | Answering inquiries and privacy requests | One year after the inquiry is resolved |
Where a law requires longer retention, we keep the information for the period that law requires.
2. What we do not receive
The following stays on your computer or goes directly to services you choose. We never receive or store it.
- Work data — source code, prompts, task history and logs, and run metrics are stored only on your computer (
~/.agent-orchin your home folder and.agent-projectsin your repository). - API keys — AI service API keys you register are kept in VS Code SecretStorage (your operating system's keychain) and are never sent to us.
- AI service sign-ins — the extension and app do not handle sign-in credentials for Claude, Codex, or other CLIs; they use the official CLIs as installed. When showing Grok or OpenCode plan usage, your computer queries that company's servers directly, and nothing comes to us.
- Content sent to AI services — code and conversations handled by agents go directly from your computer to the AI services you choose (Anthropic, OpenAI, xAI, DeepSeek, Zhipu AI, Upstage, Google, opencode, servers you register yourself, and so on), under each service's own privacy policy.
3. Sharing with third parties
We do not provide or sell personal information to third parties, except where a law specifically requires it or investigative authorities request it through procedures set by law.
4. Processors
We use the following processor to run our services.
| Processor | Task | Server location |
|---|---|---|
| The Constant Company, LLC (Vultr) | Hosting the website, relay, and voting servers | Republic of Korea (Seoul region) |
5. International transfers
Our servers are located in the Republic of Korea (Seoul), and we do not transfer personal information abroad.
When you use the following external services directly, those companies process information under their own policies.
- Desktop app downloads, automatic updates, and app bug reports: GitHub, Inc. (USA). Turn automatic updates off by adding
"autoUpdate": falseto~/.agent-orch/app-config.json. - Extension installs and questions: Microsoft Visual Studio Marketplace (USA) and Open VSX (Eclipse Foundation).
6. Deletion
Personal information is deleted without delay once its retention period ends. Device records and votes on our servers are deleted automatically after their set periods, and connection logs are deleted oldest-first as they reach their size limits. Electronic files are deleted so they cannot be recovered; we keep no personal information on paper.
7. Your rights
You may ask at any time to access, correct, delete, or stop the processing of your personal information. Email the privacy officer below and we will handle your request without delay. Because we have no user accounts, we may ask for details such as a device identifier or a voting round address to find the information. You can also exercise these rights through a legal representative or an authorized agent.
You can also act on your own:
- Turning off remote monitoring or unpairing a device stops relay connections; the device record is deleted automatically after 90 days.
- You can close a published voting round from the extension; email us if you need it deleted immediately.
- Clearing site data for app.100doo.com or vote.100doo.com in your browser removes what is stored there.
Our services are not directed at children under 14, and we do not knowingly collect their personal information.
8. Security measures
- All connections are encrypted with TLS (HTTPS and WSS).
- Messages between your devices pass through the relay sealed with session keys the devices create, and the relay neither stores nor logs their content. Connection keys are kept only as hashes.
- For compatibility with earlier versions, a connection method in which the relay can see connection credentials still exists. We will block it once the switch to the new method is complete.
- Logs record only connection details and errors, and device identifiers appear only as partial hashes.
- Server access is limited to the minimum number of people needed to operate the services.
9. Cookies and browser storage
- Websites (ai.experlab.com and others) — no cookies. Only whether you closed the language banner is kept in your browser's localStorage.
- 100doo Remote (app.100doo.com) — display settings and device pairing information are kept in your browser's storage (localStorage and IndexedDB) and are not sent to our servers.
- Public voting (vote.100doo.com) — a voter token cookie (
dgv) prevents duplicate votes.
You can block or delete cookies and site data in your browser settings. Some features, such as voting and remote pairing, will then not work.
10. Privacy officer
For privacy questions, complaints, or remedies, contact:
- Name and title: To decide: representative's name (Representative, also serving as privacy officer)
- Email: privacy@experlab.com
11. Remedies
For advice or reports about privacy violations, you can contact these Korean authorities:
- Personal Information Dispute Mediation Committee: www.kopico.go.kr, +82-1833-6972
- Personal Information Infringement Report Center: privacy.kisa.or.kr, 118 (in Korea)
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr, 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr, 182 (in Korea)
12. Changes to this policy
We announce changes on this page at least 7 days before they take effect, or 30 days before for changes that significantly affect your rights.