Privacy Policy

CodeWorks Labs LLC d/b/a AgentOne ("we," "us," or "our") operates the AgentOne desktop application and the website located at www.agent-one.dev (collectively, the "Service"). CodeWorks Labs LLC is a limited liability company organized under the laws of the State of Oklahoma. This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.

The AgentOne desktop application is open source, so you can review exactly what data it handles in its public source code.

1. Information We Collect

1.1 Account Information

When you create an account, we collect the following:

• Name - provided by you or your OAuth provider.
• Email address - used for authentication and account communications. If Discord does not provide an email, we store a non-routable placeholder for your account.
• Profile image - if provided via an OAuth provider (Google, GitHub, or Discord), or uploaded directly by you.
• Password - if you sign up with email and password, stored in hashed form. We never store or have access to your plaintext password.

1.2 Session and Authentication Data

When you sign in, we collect and store session data including:

• Session tokens and expiration timestamps.
• IP address and user agent string of the device used to sign in.
• Last login method (e.g., email, Google, GitHub, Discord).

1.3 Chat History Sync

Your chat history and messages are synced to our servers and stored so they can be accessed across your devices. This sync is a core feature of the Service and occurs automatically when you are signed in. Chat data is associated with your account and stored on our servers.

1.4 Synced Settings

If you enable settings sync in the desktop application, your application preferences (such as theme, text scale, tool configurations, and other non-sensitive settings) are transmitted to and stored on our servers so they can be synchronized across your devices. Settings sync is optional and can be disabled at any time. Installed extensions and their configurations, and scheduled agents, are not included in settings sync and remain on your device.

1.5 API Key Sync

You may separately opt in to API key sync, which allows your third-party API keys to be synced across your devices. If you enable this feature, your API keys are encrypted before transmission and stored on our servers in encrypted form. API key sync is entirely optional, requires separate opt-in from settings sync, and can be disabled at any time. When disabled, synced API keys are deleted from our servers.

1.6 Profile Images

You may upload a profile image directly, in addition to receiving one from an OAuth provider. Uploaded profile images are stored on our servers and associated with your account.

1.7 Website Analytics

We use Google Analytics on www.agent-one.dev to collect usage data such as page views, button clicks, browser or device context, and general geographic region. This data helps us understand how the website is used and improve it.

The AgentOne desktop application does not collect usage analytics. Desktop usage analytics were removed in AgentOne 1.1, and the application no longer sends usage data to Google Analytics or any other analytics service.

1.8 Billing and Usage Data

If you purchase a paid plan or credits, payments and subscriptions are processed by our payment provider, Polar. Polar collects your payment details directly; we do not receive or store your full payment card number. We receive information about your subscription, plan, and credit balance so we can provide the features you paid for.

When you use AgentOne-provided models, we record usage information for each request, such as the model used and the number of input, output, and cached tokens, and share it with Polar to meter your credit usage. This usage information is also used to show your credit balance and per-chat usage in the application. It does not include the content of your prompts or responses.

2. Information Stored Locally

The following data is stored on your device and is not transmitted to our servers unless you opt in to the corresponding sync feature:

• API keys - stored in your operating system's secure credential store (keyring/keychain) by default. If you opt in to API key sync, your keys are encrypted and stored on our servers to enable cross-device access (see section 1.5).
• Application settings - stored in local storage unless you opt in to settings sync.
• Extensions - installed extensions and their configurations, including any credentials you enter for them, are stored on your device and are not synced between devices.
• Scheduled agents - the title, prompt, schedule, and model settings of each scheduled agent are stored in a file on your device. Each scheduled agent is also registered with your operating system's built-in scheduler (launchd on macOS, systemd timers on Linux, or Task Scheduler on Windows) so it can open AgentOne when a run is due. Scheduled agents are not sent to our servers. Chats created by scheduled runs are handled like any other chat.
• Model and extension lists - downloaded copies of the available AI model and extension lists are saved on your device.
• Application logs - diagnostic logs are written to files on your device and are not uploaded to our servers.

Notifications from the desktop application, which may include a preview of an AI response, are displayed through your operating system's notification system.

Chat history and messages are synced to our servers when you are signed in (see section 1.3). A local copy is also maintained on your device.

AgentOne provides its own hosted AI models as the default experience. When you use AgentOne-provided models, your prompts and conversations are processed through our infrastructure and routed to the underlying AI providers. You may also connect to third-party AI providers directly using your own API keys, in which case those interactions are between you and those providers. We do not monitor the content of conversations processed by third-party providers using your own keys.

3. How We Use Your Information

• To create and manage your account.
• To authenticate you across the website and desktop application via device authorization.
• To send transactional emails such as email verification and password reset messages.
• To synchronize your chat history across your devices.
• To synchronize your application settings across devices (if you opt in).
• To synchronize your API keys across devices in encrypted form (if you separately opt in).
• To provide access to AgentOne-hosted AI models and process your requests through our infrastructure.
• To process payments, manage subscriptions, and meter credit usage for AgentOne-provided models.
• To store and serve your uploaded profile image.
• To improve, maintain, and operate the Service.

4. Third-Party Services

We use the following third-party services:

• Google, GitHub, and Discord OAuth - for social sign-in. When you sign in with one of these providers, it may share your name, email, and profile image with us in accordance with its own privacy policy.
• Resend - for sending transactional emails (email verification, password resets).
• Neon - for hosting our PostgreSQL database in the United States.
• Polar - for payment processing, subscription management, and metering credit usage of AgentOne-provided models.
• Google Analytics - for website usage analytics. The desktop application does not use Google Analytics.
• GitHub and the MCP Registry - the desktop application periodically (about every 24 hours) downloads the public AI Model Directory from GitHub and the public extension list from the official MCP Registry. These requests do not include your account information, but, like any web request, these services receive your IP address and basic request details.

AgentOne provides its own hosted AI models by default, which route your requests through our infrastructure to underlying AI providers. The desktop application may also connect to third-party AI providers (such as OpenRouter, Groq, Google Generative AI, and Cerebras), local models (such as through Ollama or LM Studio), and extensions (MCP servers) using API keys and configurations you provide. When using your own API keys or extensions, these connections are made directly from your device; we do not proxy, intercept, or log these requests. Your use of third-party AI providers and extensions is governed by their respective terms and privacy policies.

5. Data Retention

We retain your account information, synced chat history, synced settings, and synced API keys (if opted in) for as long as your account is active. Session data is retained until the session expires or you sign out. If you delete your account, all associated data on our servers (account information, sessions, chat history, synced settings, synced API keys, and uploaded profile images) will be permanently deleted. Locally stored data on your device (API keys, settings) is under your control and is not affected by account deletion on our servers.

6. Data Security

We take reasonable measures to protect your information. Account passwords are hashed before storage. API keys are stored in your operating system's secure credential store by default. If you opt in to API key sync, your keys are encrypted before transmission and stored in encrypted form on our servers. Chat data synced to our servers is stored securely. Server-side data is hosted on Neon's managed PostgreSQL infrastructure in the United States. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

• Disable settings sync - you can turn off settings sync at any time in the desktop application.
• Disable API key sync - you can turn off API key sync at any time. When disabled, your synced API keys are deleted from our servers.
• Delete synced chats - you can delete your synced chat history from within the desktop application.
• Delete your account - contact us to request account deletion and removal of all server-side data, including synced chats, settings, API keys, and profile images.
• Manage local data - you can delete your local chat history, API keys, and local settings directly from the desktop application at any time.
• Manage scheduled agents - you can pause, resume, edit, or delete scheduled agents at any time from the Scheduled Agents page in the desktop application. Deleting a scheduled agent removes it from your operating system's scheduler; chats it already created are kept until you delete them.
• Manage extensions - you can remove installed extensions and their configurations on each device at any time.
• Opt out of website analytics - you can use browser extensions or settings to opt out of Google Analytics on the website.

8. Children's Privacy

The Service is not intended for anyone under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions about this Privacy Policy or your data, contact us at [email protected].