Privacy Policy

Effective date: October 20, 2026

ONI ("we," "us," or "our") operates Oni.bot ("Oni"), available at oni.bot. Oni gives you a workspace with AI teammates, led by a teammate called Oni, that do tasks for you on a cloud computer with a browser and desktop. You can watch them work, take control of the computer at any time, and approve or deny their actions. This Privacy Policy describes what information we collect, how we use and share it, and the choices you have.

By using Oni, you agree to the practices described in this policy. If you do not agree, please do not use our service.

1. Information We Collect

Account Information

You sign in through our sign-in provider, Clerk. When you sign in, we receive and store:

• Your email address and the account identifier issued by Clerk
• The name you choose to be called and your time zone
• Your workspace's name, its members and their roles

Clerk handles your sign-in method. We do not receive or store your sign-in password.

Your AI Model Account

Teammates run on your own AI model account. You connect it either by signing in with ChatGPT (OpenAI) or by entering a Claude API key (Anthropic). We store the resulting sign-in tokens or API key encrypted, and use them only to make model requests for your tasks. We do not resell model access, and we do not run your teammates on an account of our own.

Your Work in Oni

To do the work you ask for, we store:

• Your chats and tasks with teammates, and the teammates' replies, titles and results
• Teammates you create or edit: their names, instructions, skills, tools and settings
• Files you upload and files teammates produce (artifacts)
• Routines and schedules you set up, and inbox watches
• Approval requests and your decisions, and an activity log of the steps teammates take
• Model usage counts for your tasks

Your Cloud Computer

Each workspace has its own cloud computer. While teammates work, they take screenshots and read the pages open in its browser. The computer keeps its own storage, which holds workspace files, uploads, downloads and the browser's profile (for example, cookies of sites a teammate or you signed in to on that computer). When you watch or take control, the screen is streamed to your browser.

Connected Apps

You can connect apps such as Gmail, and add remote MCP servers that give teammates more tools. For each connection we store which account or server it is, its settings, and the access credentials, which are encrypted. A connected app account is private to the person who connected it: teammates use it only on that person's tasks unless they choose to share it with the workspace. Workspace owners and managers can see that a private account exists so they can disconnect it, but cannot use it. How we handle Gmail data is described in Section 3.

Saved Logins

You can save website logins (a label, the sites it may be used on, a username, a password and an optional one-time-code seed) so teammates can sign in to sites for you. Saved logins are sealed with AES-GCM encryption. When a teammate needs to sign in, our servers type the value directly into the page on an allowed site. Teammates see only the label and the allowed sites. The username, password and code are never shown to the AI model, and are kept out of tool results, logs and the screenshots we keep.

Alerts

If you turn on alerts, we store the web push subscription your browser gives us so we can send notifications to your device. If you opt in to text messages, we collect the information described in Section 4.

Usage and Technical Data

We automatically collect:

• IP addresses, used for rate limiting and security
• Request and error logs, and performance data needed to run the service
• A session record for each signed-in browser

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain Oni, including running your teammates and your cloud computer
• Send the content of your tasks to the AI model provider you connected, so your teammates can work
• Carry out actions in connected apps and on websites that you or your teammates start, with the approvals your settings require
• Run your routines and inbox watches, and send the alerts you turned on
• Authenticate you, keep each workspace's data separate, and enforce who may use what
• Monitor service health, debug issues, and prevent abuse
• Communicate with you about your account, service updates, or security notices
• Comply with legal obligations

Your AI Model Provider

To do a task, teammates send what they are working on (your messages, instructions, screenshots and page text from the cloud computer, file contents, and email or app data they read for the task) to the provider you connected, OpenAI or Anthropic, under your own account with them. That provider handles this data under its own terms and privacy policy and the settings of your account with it, including whether it keeps or trains on your data. We encourage you to review those settings. Saved-login values are never sent to the model.

We do not sell your personal information. We do not use your content to train AI models.

3. Google User Data (Gmail)

If you connect a Gmail account, you grant Oni permission, through Google's sign-in, to:

• Read your email (gmail.readonly) — so teammates can search, read and summarize messages for tasks you give them, and so an inbox watch you set up can check for new mail and tell you about important email
• Create drafts (gmail.compose) — so a teammate can prepare an email as a draft before it is sent
• Send email (gmail.send) — so a teammate can send an email for you. By default a teammate asks for your approval before sending

We use Gmail data only to provide these features you asked for. The email content a teammate reads for a task is sent to the AI model provider you connected, under your own account, only to perform that task, and may appear in that task's history in Oni. The access tokens for your Gmail account are held, encrypted, by a connection service (Nango) that we run on our own infrastructure, and are never shown to the AI model or placed on your cloud computer.

Oni's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to others except as necessary to provide or improve those features (such as sending it to the AI model provider you connected to perform your task), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not use Google user data to serve advertisements, including retargeting, personalized or interest-based ads.
• We do not sell Google user data, and do not use it to determine creditworthiness or for lending purposes.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.
• No person at ONI reads your Google user data unless you give us your affirmative agreement to view specific messages, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymized for internal operations.

You can disconnect Gmail at any time in Oni, which stops all later access, or remove Oni's access from your Google Account permissions page.

4. Text Messages (SMS)

Oni can send text messages from your teammates to the account holder's own mobile number: progress updates, questions that need your answer, requests to approve an action, results, and alerts from your inbox watches. Texts are sent only if you opt in.

What We Collect

• Your mobile phone number
• Your consent to receive texts, including the date and time you gave it and how (ticking the opt-in box in Settings and confirming a code we text you)
• Opt-out and help requests you send, and the texts we send and receive with you

How We Use It

We use your number and consent records only to send you the texts you signed up for, to process your replies (for example, approving an action), to honor opt-outs, and to keep a record of your consent. We send texts through our messaging provider, which receives your number and the message content only to deliver them.

No Sharing for Marketing

Mobile numbers and SMS opt-in and consent data are not sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described in this policy and will not be shared with any third parties, except the messaging provider that delivers our texts.

Your Choices

Message frequency varies. Message and data rates may apply. Reply STOP to any text to opt out, or turn texts off in Settings. Reply HELP for help, or contact support@oni.bot.

5. Data Storage and Security

Our servers, databases and cloud computers run on Fly.io, currently in the United States. Your data is stored in:

• PostgreSQL — accounts, workspaces, teammates, chats and task history, approvals, activity, routines, and encrypted credentials
• S3-compatible object storage — files you upload and files teammates produce
• Your workspace's cloud computer — its own storage volume with workspace files, downloads and the browser profile
• Server logs — access and application logs

We protect your data with encryption in transit (TLS), AES-GCM encryption of stored secrets (model tokens and keys, app and MCP credentials, saved logins), HTTP-only secure session cookies, and strict separation between workspaces. Each cloud computer runs on its own private network with no route to our databases or to other workspaces, and commands on it run in a sandbox. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Specifically:

• Account and workspace data — retained until you delete your account, then deleted within 30 days
• Chats, task history, files and the cloud computer's storage — retained until you delete them or your account, then deleted within 30 days
• Connections, saved logins and push subscriptions — deleted when you disconnect or remove them
• Unfinished uploads — expire after 24 hours if never confirmed
• Server logs — retained for up to 90 days for operational purposes
• Text message consent records — kept while texts are on, and afterwards for as long as we need to show that you agreed to them

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

7. Third-Party Services

We use the following third-party services to operate Oni:

• Fly.io — hosting for our servers, databases and your workspace's cloud computer.
• Tigris — S3-compatible object storage for uploaded and produced files.
• Clerk — sign-in and account authentication, including bot protection on the sign-in page provided through Cloudflare.
• OpenAI or Anthropic — the AI model provider you choose and connect with your own account. It receives task content as described in Section 2, under your agreement with it.
• Google — if you connect Gmail, we exchange data with Google's Gmail API on your behalf, as described in Section 3.
• Nango — open-source connection software that holds connected-app access tokens. We run it ourselves on our own infrastructure.
• TypeSafe — a model that helps teammates find the element or point on the screen they mean to click. It receives the page address, the names of on-page elements and, for screen clicks, a screenshot of the cloud computer.
• Your browser's push service — delivers web push alerts to your device (for example, the service run by your browser's maker).
• MCP servers you add — receive the requests teammates make to their tools, under that server operator's own terms.
• Twilio — delivers text messages if you opt in to them.

We do not currently use third-party analytics, advertising, or tracking services. If this changes, we will update this policy accordingly.

8. Cookies and Local Storage

Oni uses only essential cookies and local storage necessary for the service to function:

• A session cookie that keeps you signed in
• Security tokens that protect against cross-site request forgery
• Cookies set by Clerk to sign you in
• Local storage for setup progress and interface preferences

We do not use advertising cookies, third-party tracking cookies, or analytics cookies. Because we only use strictly necessary cookies, no cookie consent banner is required under most jurisdictions.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access

You can request a copy of the personal data we hold about you.

Correction

You can update your name, time zone and workspace settings in Oni at any time, or by contacting us.

Deletion

You can request deletion of your account and all associated data. You can also remove connected apps, MCP servers, saved logins, routines, uploads and alert subscriptions yourself in Oni at any time.

Data Portability

You can request an export of your data in a structured, machine-readable format.

Objection and Restriction

You can object to or request restriction of certain processing activities where applicable under law.

To exercise any of these rights, contact us at privacy@oni.bot. We will respond to verified requests within 30 days.

10. GDPR Compliance (European Economic Area)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance — processing necessary to provide the Oni service you signed up for
• Legitimate interests — service security, fraud prevention, and service improvement
• Legal obligations — compliance with applicable laws and regulations
• Consent — where required, such as for text messages and alerts

Your data is transferred to and stored in the United States. We rely on Standard Contractual Clauses and other appropriate safeguards for cross-border data transfers where required.

You may lodge a complaint with your local data protection authority if you believe your rights under the GDPR have been violated.

11. CCPA Compliance (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:

• Right to know — you can request details about the categories and specific pieces of personal information we have collected
• Right to delete — you can request deletion of your personal information
• Right to opt-out — we do not sell personal information, so this right does not apply. We also do not "share" personal information for cross-context behavioral advertising
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

12. Children's Privacy

Oni is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@oni.bot.

13. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email and, where required by law, the relevant supervisory authorities within 72 hours of becoming aware of the breach.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on our website prior to the change becoming effective. The "Effective date" at the top of this page indicates when this policy was last revised.

Continued use of Oni after changes take effect constitutes acceptance of the revised policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: