AI NetShell Privacy Policy

Version 2.2, effective 2026-10-04.

Applies to: the AI NetShell Windows desktop application, the AI NetShell account website, account and entitlement services, and hosted-AI broker described below.

This policy describes the information practices of PACKET 365 LLC for the AI NetShell product and services in scope above. Product-specific details control over general summaries, and this policy will be updated if a material production data flow changes.

The short version

AI NetShell is designed so the desktop application, not an AI model, owns the connection to your network devices.

With respect to network configuration data: No background configuration upload, and no standing hosted copy of your network. AI analysis sends only the redacted command output you trigger, and only when you run it. An AI request also includes the question you ask and the conversation, model instructions, and tool context needed to answer it. Depending on the AI option you choose, that request goes directly to Anthropic or OpenAI, or through the AI NetShell Cloudflare broker and then to the selected AI provider.

This promise concerns Packet 365's background behavior and application storage. User-triggered AI requests still leave the workstation and are processed in transit, and our infrastructure and AI providers may process or retain them under their applicable policies as described below.

Who operates the service

AI NetShell is operated by PACKET 365 LLC, an Illinois limited liability company registered in Cicero, Illinois, USA. In this policy, “AI NetShell,” “we,” “us,” and “our” mean PACKET 365 LLC. Contact methods are listed at the end of this policy.

Information handled by AI NetShell

The account website uses Clerk for sign-in. The desktop app does not embed Clerk; it opens the account flow in the system browser and receives a device-enrollment grant after the user signs in and approves the device.

The current account page offers social sign-in through Google, Microsoft, or GitHub. Clerk supplies a Clerk user identifier and session identifier. When needed for display, the account service requests the user's first and last name and email address from Clerk and derives a sanitized display label. If no usable name or email is available, the service uses a generic label. The service stores the Clerk user identifier, an AI NetShell billing-account identifier, the sanitized display label, account and device identifiers, status, and creation timestamps. The display label is also included in the signed entitlement token delivered to the app.

PACKET 365 LLC determines why account information is used for AI NetShell. Clerk and each social identity provider also process sign-in information under their own terms and privacy notices, which are presented or linked in the sign-in flow. The attributes returned depend on the provider and the permissions shown during sign-in; AI NetShell uses only the account and display information described above.

2. Account device credential (`adc1`)

After browser approval, the account service issues an adc1 device credential. This is an AI NetShell account credential for the installed app; it is not a router, switch, firewall, or SSH password.

When you approve a device, we also record the computer's name and the approximate location (city and region) of the connection at that moment, so you can recognize your devices on the account page. We do not store the IP address with the device record. The app also sends a machine fingerprint, a one-way hash of a stable identifier of your Windows installation, which we keep with the device record so a repeat sign-in from the same computer does not create a duplicate device. The identifier itself is never sent.

The full adc1 credential is stored locally in the operating system's protected credential store (Windows Credential Manager in the Windows build). The app receives it when it exchanges the browser-approved enrollment grant, then sends it over HTTPS to the AI NetShell account service when it refreshes the credential or requests a new entitlement token. The service stores current and retired secret hashes. To make credential rotation recoverable after a lost response or restart, the service can temporarily retain recoverable pending or initial secret material until the applicable replay/enrollment cleanup runs. Revocation erases recoverable plaintext material while retaining the records needed to recognize and refuse a revoked credential.

Recoverable enrollment and rotation material is kept only for the configured enrollment or replay window and is deleted when that window ends or the device is revoked. Credential hashes and device records are kept while the device or account is active and afterward only as reasonably necessary to reject revoked credentials, investigate abuse, resolve disputes, or comply with law. Copies in backups and security logs remain until overwritten or deleted through the applicable ordinary retention cycle, unless a legal hold or security investigation requires longer retention.

3. Signed entitlement token (`aet1`)

The AI NetShell broker issues a signed aet1 entitlement token. The app stores tokens in the OS credential store and presents them to the AI NetShell hosted-AI broker as bearer credentials.

The token contains an opaque account ID, app-device ID, credential generation, entitlement ID when applicable, tier, capabilities, sanitized display label, plan version, and issue/not-before/expiration/offline-window timestamps. It does not contain network-device credentials or configuration output. Tokens normally expire after one hour and carry an offline-use window of up to 7 days; a known revocation is not treated as grace.

An offline app cannot learn of a new server-side revocation until it reconnects. The signed offline window is therefore a maximum period of residual offline use, not a promise of real-time revocation while offline. We do not intentionally place full bearer tokens in application logs; normal request metadata and security records are retained only as described in the retention section below.

4. Network connection data and device credentials

The desktop app locally handles connection information such as device names, hostnames or IP addresses, ports, vendor/OS tags, groups, host-key fingerprints, and discovered CDP/LLDP facts. SSH and other device credentials are stored in the OS credential store or are supplied through the authentication method selected by the user. Native SSH is implemented and owned by the desktop host.

AI NetShell does not intentionally send router, switch, firewall, SSH, RDP, serial, or API credentials to an AI model. Provider API credentials and account credentials are resolved by the desktop host and are not exposed as model tools.

Raw terminal output can be visible locally to the operator. The app also stores local artifacts needed for features the user enables, including inventory, discovery records, redacted snapshots, change history, audit records, case notes, and exports. Local retention depends on the feature and on when the user deletes the relevant local data.

Local data remains on the workstation until the user deletes it through the app or operating system, or removes the applicable profile or storage. Uninstalling the app may not remove every user-created export, local history, OS credential entry, or copy included in a workstation backup. Users should remove those items separately when they want them deleted. OS credential storage reduces exposure but cannot protect credentials from a compromised user account, operating system, or device.

5. AI questions, redacted device output, and responses

AI analysis begins only when the user runs an investigation or other AI action. The request can include:

the user's question and incident details;
the AI conversation and tool-call context;
model and tool instructions;
redacted output from the device commands the user caused the investigation to run; and
locally derived, redacted context that the user caused the AI workflow to use, such as a relevant snapshot, standard, or change-history excerpt.

Redaction runs before device output is placed in the model-facing request. It is designed to replace recognized passwords, keys, tokens, community strings, cloud credentials, and similar secrets. Redaction reduces risk but cannot guarantee that every sensitive value in every vendor-specific output format will be detected.

The route depends on the selected AI option:

Your own Anthropic API key, or a ChatGPT account sign-in: the desktop app sends the request directly to Anthropic or OpenAI.
Included AI (AI credits): the desktop app sends the request to the AI NetShell Cloudflare broker. The broker authenticates the entitlement token, applies entitlement, model, rate, concurrency, size, and credit controls, forwards the request to Anthropic using AI NetShell's provider credential, and meters provider-reported token usage.

The broker code does not create an application database copy of prompts, completions, or network configurations. It necessarily handles request and response bodies in transit, and non-streaming responses are buffered long enough to meter the response. This is the basis for the narrower promise: no background configuration upload and no standing hosted copy of the network, not a claim that AI data never leaves the workstation.

Our infrastructure and AI providers may log, retain, review, or process request and response data for service delivery, security, abuse prevention, or legal compliance under their own applicable terms and settings. Their processing may occur in countries other than the user's country. Packet 365 does not control provider-side retention, and a provider's practices may change. The “no standing hosted copy” statement means Packet 365 does not create an application-database copy of prompts, completions, or network configurations; it does not mean that transit processing or provider retention never occurs.

6. Purchases, subscriptions, and entitlement records

Purchases and subscription checkout are handled through Lemon Squeezy. AI NetShell sends Lemon Squeezy an opaque billing-account ID, checkout-attempt ID, selected store/product variant, and checkout expiry. Lemon Squeezy handles the checkout and payment details.

AI NetShell receives and stores the entitlement and transaction information needed to provide and administer access, including Lemon Squeezy customer, order, subscription, product, variant, license, plan, trial, renewal, expiration, status, and event timestamps. The current entitlement record also stores payment-card brand and last four digits received from Lemon Squeezy; it does not store a full payment-card number or card security code. Hosted-AI credit balances and provider-reported input/output token counts are used for metering and fraud/abuse controls.

Lemon Squeezy is the merchant and seller of record for purchases and handles payment collection, invoicing, applicable global tax, fraud screening, and transactional refunds under its Buyer Terms and privacy notice. Packet 365 uses the card brand and last four digits it receives only for billing support, reconciliation, fraud prevention, and enforcement of the one-trial rule. Those limited card details are kept with the associated transaction or security record as long as reasonably necessary for those purposes and legal obligations; Packet 365 does not receive or store the full card number or security code.

7. Telemetry, analytics, diagnostics, and service logs

The reviewed desktop build contains no general background product-analytics or crash-reporting upload. The app has internal audit and measurement events, but those are not the same as a vendor analytics feed. A developer-only usage log is written locally only when a specific environment variable names a local file. The AI NetShell website uses Cloudflare Web Analytics, a cookieless measurement service. It does not set cookies or use local storage. For each page view it records the page and host, the referring site, the visitor's country, device type, browser and operating system, the response status, and page-performance timings, and Cloudflare reports these to us only in aggregate. We use this to understand which pages people read and to improve the site.

Hosted services still process operational data needed to answer and protect requests. Depending on production platform settings, this can include timestamps, route and status, request IDs, IP address and user-agent or other HTTP metadata, rate-limit state, structured error records, entitlement state, token usage, credit reservations, charges, and balances. The broker logs metering/parser and service errors; the reviewed code does not intentionally log AI prompt or completion bodies in those messages.

Access to hosted-service logs and support exports is limited to people and providers that need it to operate, secure, or support the Service. Retention varies by record type and platform setting and is limited to what is reasonably necessary for those purposes, legal compliance, and dispute resolution. If Packet 365 enables background product analytics or crash-body reporting, it will update this policy and obtain consent where required before using that data.

8. Agreement acceptance records

When a user accepts the Terms of Service at account sign-up, or accepts a new version later, the account service records evidence of that acceptance: an event identifier, the Clerk user identifier, which agreement and exact version (including a cryptographic fingerprint of the document text presented), the acceptance timestamp and the surface it happened on, and the assent-control wording version. Immutable copies of every published agreement version are retained.

When any user (including a user with no account) accepts the desktop End User License Agreement at first run, an acceptance receipt (EULA version and fingerprint, acceptance time, app build, and a per-installation identifier) is stored locally on the user's machine only; nothing is sent to AI NetShell. If that user later signs in to an account, the app uploads the existing local receipt and associates it with the account, recording both the original local acceptance time and the server receipt time.

These records exist so both sides can prove what was agreed to and when; they are kept for the life of the account or agreement plus the period needed for legal claims, and they are not used for marketing or analytics.

Server-side acceptance records and immutable agreement versions are retained while the agreement or account remains active and for ten years after it ends or the account closes, whichever is later, unless a longer period is required for a legal hold, dispute, or applicable law. A local EULA receipt remains on the workstation until the user removes it or it is uploaded after sign-in. Packet 365 uses these records to perform and enforce the agreement, maintain legal claims and defenses, and comply with recordkeeping duties.

Why information is used

AI NetShell uses the information above to authenticate accounts and app installations; approve, list, and revoke enrolled app devices; issue and verify entitlements; operate requested AI analysis; connect the desktop app to user-selected network devices and providers; meter hosted AI; process purchases and refunds; prevent abuse; maintain security and reliability; keep evidence of agreement acceptance for legal enforcement; and provide support when the user asks for it.

Where a legal basis is required, Packet 365 processes account, entitlement, AI-request, support, and purchase information as necessary to enter into or perform its agreements with the user; processes tax, transaction, and other records to comply with legal obligations; and processes security, fraud, abuse-prevention, service-integrity, and agreement-evidence records for its legitimate interests in protecting users, the Service, and legal rights. Packet 365 relies on consent where applicable law requires consent, and that consent may be withdrawn for future processing without affecting processing already lawfully completed.

When information is shared

Information is shared only as needed for the routes described above: with Clerk and the selected social identity provider for website sign-in; Lemon Squeezy for checkout, payment, tax, fraud, subscription, and entitlement events; Cloudflare for account and hosted service delivery; and Anthropic or OpenAI when the user initiates AI analysis. Network traffic also goes to the user's own network devices and any endpoint the user expressly configures.

Packet 365 may also disclose information to vendors that provide hosting, delivery, monitoring, support, communications, security, or incident- response services, subject to contractual and legal safeguards appropriate to their role. Information may be disclosed when reasonably necessary to comply with law or valid legal process; protect a person, Packet 365, users, or the Service; investigate fraud or abuse; or complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. For international transfers, Packet 365 uses a legally recognized transfer mechanism where required.

Retention and deletion

Packet 365 keeps personal information only as long as reasonably necessary for the purpose described in this policy, including providing the Service, maintaining security and fraud controls, keeping agreement and transaction evidence, resolving disputes, and complying with law. Short-lived sessions, tokens, handoffs, enrollment material, and replay material expire or are cleared according to their technical lifecycle. Account identity mappings, active device and entitlement records, and support records are ordinarily kept while the account or relationship remains active. Transaction, tax, refund, fraud, revocation, and agreement records may remain after closure for the applicable legal, accounting, security, and claims periods; agreement-acceptance records follow the ten-year period stated above.

When deletion is appropriate, active records are deleted or de-identified. Copies may remain temporarily in ordinary backups, and records subject to a legal hold, security need, dispute, or statutory retention duty are kept until that reason ends. Closing an AI NetShell account does not require Lemon Squeezy or an identity provider to delete records that it keeps under its own terms or legal duties.

User choices and privacy rights

Users can choose whether and when to run AI analysis, which AI route to use, which app device to approve or revoke, and whether to retain local exports and histories. Provider and account credentials can be removed from the app through the applicable sign-out/profile controls.

Depending on where a user lives, the user may have rights to request access, correction, deletion, restriction, objection, or a portable copy; withdraw consent; opt out of processing treated by local law as a sale, sharing, or targeted advertising; and appeal a denied request. Packet 365 will verify a request proportionately and may ask an authorized agent for proof of authority. We will respond within the period required by applicable law, explain any denial and available appeal, and will not discriminate against a user for exercising a privacy right. A request may be limited where an exception applies, including security, fraud prevention, legal compliance, or legal claims.

AI NetShell is not directed to children under 13, or a higher minimum age where local law requires it, and Packet 365 does not knowingly collect their personal information. If we learn that such information was collected without legally valid authorization, we will delete it as required. The reviewed product does not use advertising cookies; any future non-essential cookie or similar technology will be disclosed and subject to required choices before use.

Security

AI NetShell uses technical controls including OS credential storage, HTTPS for account and provider traffic, signed entitlement tokens, native SSH host-key checking, redaction before model-facing output, and a two-phase enforcement engine for governed AI writes. No system can be guaranteed completely secure.

Packet 365 uses administrative, technical, and organizational safeguards designed to be reasonable for the nature of the information and the risks described here. These measures reduce risk but do not guarantee security. If a breach triggers a legal notification duty, Packet 365 will provide the notice required by applicable law.

Changes to this policy

Packet 365 may update this policy to reflect changes in the Service, law, or information practices. The updated policy will state its effective date. For a material change, Packet 365 will provide advance notice through the website, account, application, or another reasonable channel and will seek consent where applicable law requires it. Prior published versions will be retained so users can identify the policy that applied at a given time.

Contact

Privacy requests: use the support or privacy contact provided in the AI NetShell application or account portal. Postal contact: PACKET 365 LLC, Cicero, Illinois, USA. Security reports: use the private security-reporting contact provided in the AI NetShell application or on the AI NetShell website.