Privacy policy

Last updated 4 October 2026

Agent Army is a private creative workspace operated within Coco Milo Holdings. This policy explains the public website and the Google sign-in and file inbox being prepared for authorised access.

Public website

These public pages do not have registration forms, advertising trackers or analytics scripts, and do not set application cookies. Hosting and security services may process connection information, such as IP addresses and requested pages, to deliver and protect the website.

Google sign-in

When sign-in is available, Google supplies an identity token containing an account identifier, email address, verification status and potentially basic profile information. We use this to verify the permitted account and establish a session. We retain the stable Google account identifier. The permitted email address is held in restricted application configuration. Profile photos and Google identity tokens are not retained in application records.

Sign-in does not request access to Gmail messages, Google Drive files, contacts or calendars. Google account information is not sold, used for advertising, or used to train AI models. Google operates its own account and sign-in services under Google's privacy policy.

Files and creative work

The private inbox is designed to store files you choose to upload, their names, sizes, upload times and integrity checks. The purpose is authorised review and creative work. Uploaded files are not automatically published. An authorised operator can access them to carry out the requested work.

When the workspace owner authorises a task using a connected AI service, relevant creative materials may be processed by that service under its own terms. The inbox does not automatically send uploads to a generation provider. Google sign-in information is not supplied to media-generation services. Do not upload passwords, API keys or customer personal records.

Cookies and retention

The planned private inbox uses essential cookies for sign-in. A browser-bound login challenge expires after five minutes. A signed-in session lasts up to 30 days, unless you sign out, clear cookies or access is revoked. Session records are kept on the server and excluded from the inbox backup snapshots.

Uploaded files have no automatic expiry and remain until an authorised removal request is carried out. The Google account identifier is retained while the account is authorised. Backup copies, where maintained, can remain separately after active records are removed; contact us about the scope of a deletion request.

Access and service providers

Access is limited to the permitted account and authorised operators maintaining the service. Hosting providers deliver the website, and Google verifies sign-in. Provider processing can occur outside your country. This private rollout does not offer public account registration or automated account deletion.

Your choices and requests

You can request access to, correction of, or deletion of information held by Agent Army, and ask to have account access disabled. Privacy questions and requests can be sent to the company's Data Protection Officer at nicholas@cardarc.app. Include Agent Army in the subject and do not send passwords or API keys. The company policy provides a response within 30 days.

See the company personal data protection policy for the wider policy. We will update this page when Agent Army's data practices change.