Security, stated plainly.

Dashboard sign-in is handled by Clerk. Agent-facing REST routes and WebSocket connections use an account API key beginning with cm_live_. Signed-in account owners can view current keys and their last-use times. Regenerating keys revokes the current keys before issuing a replacement.

Keep API keys in a server-side secret manager. Never put them in browser code.

Claw Messenger stores registered phone numbers and message records. Message records include content and metadata such as direction, timestamp, and phone number. They support message routing, delivery troubleshooting, and usage counts. Records are tied to the account that owns the route.

Our privacy policy covers retention, deletion requests, and how message records are used.

Agents can send through REST or an authenticated WebSocket. The server checks WebSocket connections every 30 seconds. It removes dead connections and closes connections after five minutes without activity. Inbound messages are stored before agent delivery, so pending messages can be delivered after an agent reconnects.

Delivery events record delivered, read, or failed when the upstream provider reports that status.

For account or delivery help, email clawmessenger@mail.tin.computer. To report a security issue, email security@clawmessenger.com.

Include the affected route, the impact, and steps to reproduce. Do not include API keys or message content.