Privacy Policy

How Auto collects, uses, and protects your information.

Effective date: November 3, 2026

This Privacy Policy describes how On Auto, Inc. ("Auto", "we", "us", or "our") collects, uses, and shares information when you use on.auto, the Auto platform, and related services (collectively, the "Service"). The "hosted Service" is the part we run for you: Auto Studio, the hosted Auto Runtime, and the systems that support them. The self-hosted edition of Auto Runtime runs on your own infrastructure.

Information we collect

Information you provide

Account information: name, email address, and authentication credentials when you sign up.
Project data: the playbooks, functions, workflows, runs and other content you create in the Service.
Communications: messages you send to us via support channels, Discord, or email.

Information collected automatically

Usage data: pages visited, features used, clicks, and session duration.
Device and browser information: browser type, operating system, screen resolution, and language preferences.
Log data: IP address, access times, and referring URLs.

We use PostHog for product analytics and session recording to understand how the Service is used and to improve it. When you sign in to Auto Studio, PostHog receives your name, email address and organization, so our team can see who uses the Service. In the hosted Service, PostHog also receives application logs and a record of each model call made through our AI gateway: the model, token counts, cost, latency and any error, but not the prompt or the response. Records sent before November 2, 2026 also held each call's input and output, which could include prompt content and data from accounts you have connected (see AI model providers); they are kept as described under Data retention.

Website and install counts

We use Scarf to count how many organizations visit our website and install Auto Runtime:

Website and documentation visits: each page of on.auto, including its documentation, loads a small image from static.on.auto, which Scarf operates. The only page information sent is the address of the page you are viewing, without its query string. The image sets no cookies. Scarf uses the request's IP address to look up the organization the address belongs to, and does not store the IP address. We do not load the image if your browser sends a Do Not Track signal.
Docker image pulls: when you pull the Auto Runtime image through docker.on.auto, Scarf counts the pull the same way.
Auto Runtime start ping: when Auto Runtime starts, it sends an anonymous ping to get.on.auto, which Scarf counts the same way. The ping contains the runtime version, operating system, CPU architecture, Node.js version, how the runtime was installed (npx, Docker or from source) and a random install ID. To turn it off, set DO_NOT_TRACK=1, SCARF_NO_ANALYTICS=true or USAGE_PING=false in the runtime's environment. When you open Auto Studio from the runtime, Studio may receive that random install ID.

Information from third parties

If you sign in via a third-party provider (such as GitHub or Google), we receive your name, email address, and profile information as permitted by your account settings with that provider.

Connected accounts and Google user data

A playbook may connect to an account of yours with Google (such as Google Search Console, Google Analytics, Google Ads, Gmail, Google Drive, Docs, Sheets or Slides), GitHub, Slack, Zoom or Microsoft, through that service's own sign-in. You choose the connection and allow it on the provider's consent screen, with the permissions it lists. Auto then receives an access token and, where the provider issues one, a refresh token, and nothing else from your account at that moment.

These services act on your direction. They are not our sub-processors. The sign-in runs through Auto's hosted consent service, which holds the tokens, sealed, for at most 10 minutes while it passes them to your runtime. The hosted Auto Runtime then keeps them in your organisation's own objects.

Access. Auto's functions call the provider's APIs only within the playbook you connected, with the permissions you allowed, when that playbook runs or when you or your AI agent ask it to.
Use. The data a call returns is used to perform the function you asked for and to show you its result in Auto Studio. We do not use data obtained through Google APIs to develop, improve or train generalised artificial intelligence or machine learning models. Where a playbook's reasoning function sends such data to an AI model provider (see AI model providers), it does so only to produce the result you asked for.
Storage. Tokens are stored encrypted and are used by the hosted Auto Runtime alone. What a function returns is kept in your organisation's runtime ledger as part of the playbook's run history, and goes with the playbook when you retire it.
Sharing. We do not sell this data, use it for advertising, or share it with anyone except the service providers that host the Service, under obligations to protect it, or when the law requires.
Revocation. You can revoke a connection at any time from Studio, under Settings, Connections, or from your Google Account's third-party access settings. Auto then deletes its tokens and stops calling the provider.

Auto's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

We use the information we collect to:

Provide, maintain, and improve the Service.
Authenticate your identity and manage your account.
Respond to your support requests and communications.
Analyze usage patterns to improve product quality and reliability.
Send transactional emails (account confirmations, security alerts, service updates).
Detect, prevent, and address technical issues or abuse.

We do not sell your personal information.

We may share your information only in the following circumstances:

Service providers: with vendors who help us operate the Service, under obligations to protect your data. For the hosted Service these are Cloudflare (hosting, storage, queues and billing emails), Clerk (authentication and invitations), Fly.io (AI gateway, its database and cache), PostHog (product analytics with the name and email address of people who sign in, application logs, and records of model calls from the AI gateway, without prompts or responses), Stripe (billing), GitHub (code hosting and database exports), Scarf (website and install counts), Better Stack (uptime monitoring), Slack (internal alerts and notices) and the AI model providers listed under Sub-processors.
Legal requirements: when required by law, legal process, or to protect the rights, property, or safety of Auto, our users, or the public.
Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to affected users.
With your consent: when you explicitly authorize sharing.

Sub-processors

The hosted Service uses the following sub-processors to process data on our behalf.

Sub-processor	Purpose	Location
Cloudflare	Hosting, storage and queues for the hosted Service; email for billing notices	Primarily United States
Clerk	Customer authentication, and invitations sent by email	United States
Fly.io	Hosts the AI gateway, which routes model calls to model providers; its database (virtual keys and spend logs with user ids) and a short-lived response cache	United States
PostHog	Product analytics with the name and email address of people who sign in, application logs, and records of model calls from the AI gateway, without prompts or responses (US cloud)	United States
Stripe	Billing; receives the account owner's email	United States
GitHub	Code hosting; nightly database exports run on GitHub-hosted runners	United States
Scarf	Website, image-pull and start-ping counts; processes IP addresses	United States
Better Stack	Uptime probes; no personal data	United States
Slack	Internal alerts, and internal notices when someone signs up or reaches a milestone, with their name, email address and organization; no request data	United States
Anthropic	AI model provider	United States
OpenAI	AI model provider	United States
Google (Vertex AI)	AI model provider, global location	Global
xAI	AI model provider	United States

AI model providers

When a playbook runs, the prompt content and any connected-account data the playbook uses may be sent through our AI gateway to the selected provider or a fallback provider, to produce a result. Fallback chains send a request to another provider when one fails. We send only what the call needs.

The AI gateway also sends PostHog a record of each call, without its input or output, as described under Information we collect. The gateway's response cache holds responses for 300 seconds.

Anthropic, OpenAI, Google and xAI do not train on API data under their terms, which we review annually.

Where hosted data is stored

Hosted data is stored primarily in the United States, in Cloudflare's US jurisdiction. Some data is stored or processed elsewhere:

A globally replicated key-value store holds an encrypted display name.
Older-generation objects, a storage bucket and queues in Cloudflare's EU jurisdiction still exist, and we are working to remove them.
Google Vertex AI uses a global location.

Because of this, and because some providers operate outside your country, your information may be transferred to and processed in countries other than your own, including the United States. We rely on the contractual safeguards of our providers for those transfers.

The self-hosted edition of Auto Runtime runs on your own infrastructure and stores nothing with us, apart from the anonymous start ping described in Website and install counts, which you can turn off.

Data retention

We retain your account and project data for as long as your account is active or as needed to provide the Service. We delete live data within 30 days of a deletion request or account deletion, except where retention is required by law. Some copies outlive that period:

Database exports: nightly exports are kept for 90 days under a deletion lock.
Point-in-time recovery: recovery copies are kept for 30 days by our hosting platform.
Audit and ledger records: these keep a pseudonymous id, not your name or email.
Analytics: PostHog events are kept for 1 year on the free plan or 7 years on the paid plan. Person profiles can be deleted.
AI gateway: database snapshots are kept for about 5 days, and cached responses for 300 seconds.
Billing: Stripe keeps customer records under Stripe's terms.

Data security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, but we work to protect your data using encryption in transit and at rest.

Your rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your personal information.
Export your data in a portable format.
Opt out of analytics tracking.

To exercise any of these rights, contact us at privacy@on.auto. To request deletion, you can also use the data deletion request form.

We do not charge for these requests and will not treat you differently for making one. We respond within 30 days, or sooner where the law requires it. If we need more time, we will tell you why within that period.

Request deletion of your data

Use this form to ask us to delete the personal information we hold about you. You do not need an Auto account to make a request.

You can also email hello@on.auto.

What happens after you submit

We log your request. Each request is recorded with a unique reference, the email address it came from, and the date and time it was received. You receive an email receipt.
We verify your identity. We confirm the request with the email address you provided before deleting anything, so nobody can delete your data on your behalf without your knowledge. Authorized agents must provide written permission from you.
We delete your data. We delete or anonymize your account, project data, communications, and analytics records from our own stores, and we ask Clerk and PostHog to delete the data they hold about you. The other sub-processors listed above, including the AI model providers, have no per-person deletion process, so they delete data on their own retention schedules. The copies described under Data retention are removed when their retention periods end.
We confirm completion. We email you when the request is complete, normally within 30 days of verification.

We may keep information when the law requires it, to resolve disputes, to prevent fraud or abuse, or to keep a record that we honored your request. When we decline any part of a request, we tell you which part and why.

How we track requests

We keep a log of every deletion request, including when it was received, when the requester was verified, what actions were taken, and when it was completed or declined. We keep this log for at least 24 months. It contains only the details needed to show that each request was handled, never the deleted data itself.

Cookies and tracking

The Service uses essential cookies for authentication and session management. We use PostHog for analytics, which may set cookies to distinguish users and track sessions. The Scarf image on our website sets no cookies. You can disable non-essential cookies in your browser settings.

Children's privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy, contact us at:

On Auto, Inc. Email: privacy@on.auto