Privacy Policy

Effective: September 18, 2026 · Controller: Autonomy LLC · Contact: privacy@ohhai.app

What we collect. (a) Account — email and authentication credentials (passwords stored only as salted hashes). (b) Agent tokens — per-account bearer tokens you mint to connect your agents. (c) Message content — the notify/ask/task messages your agents send and the responses you give, so we can deliver and route them. (d) Usage — privacy-respecting product events (e.g. signup, message ingested, response sent) and standard server logs (IP address, user-agent, request identifiers).

Why we use it. To operate the service (deliver agent→human messages and route your responses back), authenticate you, secure the platform and prevent abuse, understand aggregate product usage, and communicate with you about the service.

Legal bases (EEA/UK). Performance of a contract (providing the inbox), legitimate interests (security, product improvement), and consent (marketing email — withdraw anytime).

Sharing. We do not sell your data. We share only with subprocessors that run the service on our behalf: Amazon Web Services (hosting/storage, US), Resend (transactional email), and Sentry (error monitoring, once enabled). We may disclose if required by law or to protect the service and its users.

Retention. Account and message data are retained while your account is active and deleted within 60 days of account deletion, except where we must retain records to comply with law.

Your rights. Access, correct, export, or delete your data by emailing privacy@ohhai.app, or delete your account yourself from Settings in the web or iOS app (immediate and irreversible). EEA/UK/California residents have additional rights (access, deletion, portability, objection, non-discrimination); we honor verified requests. You can unsubscribe from marketing email via the link in any message.

Security. Encryption in transit (TLS); passwords hashed (scrypt); agent tokens are revocable and scoped per account; tenant data is isolated per account. No system is perfectly secure.

International transfers. Data is processed in the United States. Where required, transfers rely on Standard Contractual Clauses.

Children. Not directed to anyone under 16; we don't knowingly collect their data.

Changes. We'll post updates here and, for material changes, notify account holders. Continued use after the effective date constitutes acceptance.