Active Agent Active Agent
Active Agent
Star Sign In

Privacy Policy

Last updated October 23, 2026

This policy explains what Active Agent ("we", "us") collects when you use activeagents.ai, activeagent.dev and the hosted platform behind them (the "Service"), why we collect it, and what you can ask us to do with it. The open-source gems run inside your own application and send us nothing unless you configure them to.

What we collect

Account details. When you create an account we store your email address, your name, and, if you give them, your company and role. If you sign up with a password we store a salted hash of it, never the password itself.

Sign in with Google or GitHub. If you sign in with Google we receive your Google account's email address, name and profile picture through Google's sign-in service. If you sign in with GitHub we receive your GitHub username, display name and the email addresses on your GitHub account. We use this to create or sign in to your Active Agent account and to show who you are inside your workspace. We never post to your Google or GitHub accounts, and we do not read your Google data or your GitHub repositories as part of sign-in. You can disconnect either provider from Settings at any time.

Traces and telemetry. The platform's purpose is to receive the traces your application sends it: which agent ran, which model it used, how long each step took, token counts, costs, tool calls and errors. Prompts, completions and tool arguments are included only when you turn on capture_bodies in your application's configuration; it is off by default. You decide what your application sends.

Sandboxes and sessions. If you run agents in a hosted sandbox, we keep the session's transcript, the commands it ran and the files it produced so you can review them.

Billing. Payments are processed by Stripe. Stripe collects your card details directly; we store only the Stripe customer and subscription identifiers, your plan, and your invoice history.

Usage and device information. Like most services we log the pages you request, your IP address, browser type and the time of each request, and we use a session cookie to keep you signed in. We use Cloudflare Turnstile on the sign-up form to tell people from bots; it may set its own cookies according to Cloudflare's privacy policy.

Email. We send transactional email (verification, password resets, invitations, billing) through Resend. The newsletter is separate and double opt-in: you only receive it after confirming your address, and every issue has an unsubscribe link.

How we use it

  • To run the Service: signing you in, showing your traces, running your sandboxes, billing your workspace.
  • To support you when you write to us.
  • To keep the Service secure, including rate limiting and abuse prevention.
  • To understand how the Service is used, in aggregate, so we can improve it.

We do not sell your data, and we do not use the contents of your traces, prompts or sandbox sessions to train AI models.

Google user data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the email address, name and profile picture from Google sign-in only to create and sign in to your account and to identify you inside the Service. We do not share this information with third parties except as needed to run the Service, and we do not use it for advertising.

Who else sees it

We use a small number of providers to run the Service, each of which processes data only on our instructions:

  • Google Cloud (hosting and databases, United States)
  • Stripe (payments)
  • Resend (email delivery)
  • Cloudflare (bot protection on sign-up)
  • Google and GitHub (sign-in, only if you choose them)

People you invite to your workspace see the traces, agents and sandboxes in that workspace, and the names and email addresses of its members. We may also disclose information when the law requires it or to protect the Service and its users.

How long we keep it

Traces are kept for the retention period of your plan and are then deleted. Your account, workspace and billing records are kept while your account exists. When you delete your account we delete your personal data within 30 days, except for records we have to keep for tax or legal reasons.

Your choices

  • Edit your name, company and role from Settings.
  • Connect or disconnect Google and GitHub from Settings.
  • Ask us for a copy of your data, a correction, or deletion of your account by writing to hello@activeagents.ai.
  • Unsubscribe from the newsletter with the link in any issue. Transactional email about your account continues while your account exists.

If you are in the European Economic Area, the United Kingdom or another place with data-protection rights, you can exercise those rights through the same address, and you have the right to complain to your local supervisory authority.

Security

Data is encrypted in transit and at rest. Passwords are hashed. API keys are shown once and stored hashed. Access to production systems is limited to the people who operate the Service. No system is perfectly secure, and if we learn of a breach that affects you we will tell you.

Children

The Service is for businesses and developers and is not directed at children under 16. We do not knowingly collect personal data from them.

Changes

When we change this policy we update the date at the top and, for changes that matter, email account holders before they take effect.

Contact

Questions about this policy go to hello@activeagents.ai.