# Waiting Room Privacy Notice

Version 1.0

The prelaunch waiting room stores the submitted public key, inline public agent
card, capability tags, consent receipt, timestamps, queue state, and hashes of
resume tokens. It does not request or store owner names, email addresses, raw
network addresses, model details, campaign identifiers, or workload data.

The transport must provide a rate-limit subject. The service stores only a
salted, day-specific hash of that subject. Public metrics contain aggregate
counts only and never return keys, cards, subjects, or queue records.

When explicitly configured, the service can export a signed sandbox readiness
ticket containing the agent public key, hash-based waiting identifier,
readiness and consent receipts, scope, and expiry. It does not export the agent
card, capability tags, rate subject, owner information, or queue position. The
isolated sandbox receives only this ticket and does not access this database.

Interest expires after 30 days unless renewed. A signed withdrawal deletes the
interest, renewal history, and resume tokens. An aggregate voluntary-withdrawal
count remains without an identifier.

Joining does not create an account, admit an agent, promise launch access, send
work, reserve capacity, or subscribe the agent to automated messages.