Privacy policy
This page explains what OTTO keeps, where it lives and who can see it. If anything here is unclear, write to privacy@tryotto.dev.
Who runs OTTO
OTTO is run by the operator of tryotto.dev, a sole proprietor in British Columbia, Canada ("we"), reachable at hello@tryotto.dev. We are responsible for the personal information OTTO handles. Questions go to privacy@tryotto.dev.
What OTTO stores
- Your conversation with OTTO on every channel you use: Discord, Telegram, email, phone, the desktop app, the portal, Shortcuts and MCP clients.
- What OTTO remembers for you: the people, facts, commitments, plans, reminders and routines you share with it, and the life log you choose to send it (for example health, location, finance or work records).
- Your workflows and runs: their steps, inputs, results, logs and the files your agents produce.
- Your account: your name, email address and the workspaces you belong to (through Clerk).
- Secrets and integration tokens for services you connect, encrypted before they are stored.
- Usage and cost records for models, sandboxes, calls and integrations, so budgets and limits work. These leave out your messages, prompts and secrets.
Where it is stored
Everything OTTO keeps is stored with Amazon Web Services in the us-east-1 region (Northern Virginia, United States). Agent work on your own machines happens on those machines, and your runs report results and logs back to OTTO.
Who can see your OTTO Core data
Only you. Your conversation with OTTO, its memory, your people, commitments, plans and life log are private to you. The owner and admins of your workspace cannot see them, and neither can other members. When OTTO answers in a shared Discord server, it cannot read your personal records there.
Shared work is different. Workflows and runs belong to the workspace, and members see them according to their role. A run you make private is visible only to you.
Secrets and accounts
- You enter a secret, such as an API key or a password, only through a one-time link or a signed-in form in the portal or CLI. OTTO never asks for one in chat, by email or on a call.
- Each secret is encrypted with a key used for nothing else, and it is never written to logs, analytics or messages.
- Logins for your Claude and ChatGPT subscriptions stay on the machine where you registered them. They never go to the cloud or to a cloud sandbox.
Our access
OTTO is run by one person, who administers the systems it runs on. We look at your data only:
- when you ask us for help;
- to investigate abuse or a security problem;
- when the law requires it.
We do not read your private OTTO Core data for any other reason.
Analytics and tracking
- This website has no analytics, no tracking pixels, no cookies and no visit logs.
- Inside OTTO we record which features are used and what they cost, to run your budgets and improve OTTO. Those records leave out your messages, prompts and secrets.
- We never sell your data or use it for advertising.
Service providers
OTTO relies on these companies. Each receives only what its job needs.
| Provider | What it does for OTTO |
|---|---|
| Amazon Web Services | Hosting, databases and files, encryption keys, email, and the search index for OTTO's memory (Amazon Bedrock), in us-east-1 |
| Clerk | Sign-in, accounts and workspace membership |
| Upstash | Short-lived coordination data, such as presence and rate limits |
| Surplus | The language model behind OTTO Core, used with your workspace's own key |
| OpenRouter | A backup route to language models when Surplus is unavailable |
| Twilio | Phone calls with OTTO, including speech-to-text (Deepgram) and text-to-speech (ElevenLabs) on calls |
| Discord | Messages with OTTO, if you link your account |
| Telegram | Messages with OTTO, if you link your account |
| E2B | Cloud sandboxes for agent work when your machines are busy, used with your workspace's own key |
| ImprovMX | Delivery of email sent to our @tryotto.dev addresses |
Services you connect receive what you ask OTTO to send them, under their own terms: GitHub, Linear, Google (Gmail, Calendar, Drive), Notion, Sentry, Home Assistant, ElevenLabs or OpenAI voices for the desktop app, an on-chain data provider such as Alchemy, model routers you add, AWS accounts for test environments, remote MCP servers and APIs you add yourself. Your agents run Claude Code, Codex and OpenCode on your own machines with your own logins.
Google user data
When you connect Gmail, Google Calendar or Google Drive:
- OTTO uses that data only to provide the features you turn on;
- it never uses the data for advertising and never sells it;
- it never uses the data to train AI models;
- people read it only with your permission, to investigate abuse or a security problem, or when the law requires.
OTTO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
| Data | Kept |
|---|---|
| Your conversation with OTTO | 13 months |
| Call transcripts | 90 days |
| Agent run transcripts and prompts | 90 days |
| What OTTO remembers for you, and your life log | Until you delete it, or leave the workspace |
| Workflows, runs and their files | Until you or the workspace delete them |
| Notifications and past reminders | 90 days |
| Finished tasks | 1 year after they finish |
| Usage events (no message content) | 13 months |
| Records of changes to a workspace | 1 year |
| Incoming webhooks, email and integration responses | 14 to 30 days |
| System logs | 30 days |
| Database backups | 35 days |
| Deleted or replaced files | 30 days |
| Disaster-recovery copies in a separate account | Up to 90 days |
| A secret's previous value after you change it | 7 days |
Deleting your data
- Items. You can ask OTTO to forget something, or delete memories, people, life-log entries and runs yourself in the portal.
- Leaving a workspace. Your private OTTO Core data is erased 7 days after you leave or are removed.
- Deleting a workspace. Its data is erased 30 days after the deletion.
- Backups. They expire on the schedule above.
- Your account or a whole workspace. To delete either, email
privacy@tryotto.devfrom the address you sign in with. We confirm when it is done.
Your rights
Wherever you live, you can ask to see, correct, export or delete your personal information. Email privacy@tryotto.dev from the address you sign in with. We answer within 30 days, and we may ask you to confirm your identity first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
Security incidents
If a breach of security creates a real risk of significant harm to you, we tell you and the regulators the law names, as soon as we can.
Children
OTTO is for people 18 and over.
Changes
When this policy changes, the date at the top changes. If a change matters to how your data is used, we tell you in OTTO before it applies.
Contact
Privacy questions go to privacy@tryotto.dev. To report a security issue, see Contact and security.