Privacy Policy

1.1 Account Information. When you register for Otto, we collect your name, email address, and a hashed version of your password. We do not store your password in plain text — it is hashed using bcrypt before being stored.

1.2 Profile Information. You may optionally provide additional profile information such as a display name, timezone, or preferences, a profile photo, and the answers you give during setup or in Settings → What Otto Knows about your work (what you do, your businesses and goals, and how you like to work). If you set a PIN for Trash, only a hash of it is kept. This information helps Otto personalize its responses.

1.3 Conversation Data. We store the messages you send to Otto and the responses Otto generates. This history is used to maintain context across sessions so Otto can reference prior conversations and provide more relevant assistance. You can delete conversation history at any time; deleted items sit in Trash for 30 days before they are permanently removed.

1.4 Memory Data. Otto's memory system allows the AI to save facts, preferences, and notes about you that you instruct it to remember (e.g., "remember that I prefer bullet points"). These memories are stored in our database and associated with your account. You can view, edit, and delete all memories from Settings → What Otto Knows. Otto also writes a second, automatic kind of memory: after a conversation goes quiet it distils a short summary of what was discussed and decided, so it can pick the thread up later. These summaries are generated without you asking for them, they can therefore contain anything the conversation contained — including text from an email, a document or a transcript Otto read for you — and they are removed when you delete the conversation and when you delete your account.

1.5 Task and Routine Data. We store tasks you create and schedules/automations ("Routines") you configure, including their prompts, schedules, and execution history.

1.5a Saved Logins. If you ask Otto to remember how you sign in to a website, it keeps the website, the username or email you use there, how you sign in (for example, with Google) and any note you add. It never takes the password: Otto cannot sign in to websites, so it refuses one. A password saved by an earlier version of Otto is kept encrypted and is never used or exported; asking Otto to forget that login deletes it, and so does deleting your account.

1.6 Integration Credentials. When you connect third-party services, we receive and store OAuth access tokens and refresh tokens. These tokens are encrypted using AES-256 encryption at rest. We use them to run the features you have switched on — including the automatic ones described in §3, which read your mail and calendar on a schedule without you asking each time — and to carry out what you ask.

1.7 Content from Connected Services. When Otto accesses connected services on your behalf (e.g., reads your email, checks your calendar), whether because you asked or because an automatic feature ran, the content it retrieves is used to generate a response and is then saved as part of that conversation or routine record, so the exchange still makes sense when you return to it. In practice this means the text of emails, events, and documents Otto reads for you is stored in our database as part of your conversation history. We keep it for as long as you keep that conversation: deleting the conversation or your account deletes it. What a routine read is kept with that routine’s run history, which is deleted automatically after 90 days, when you delete the routine (it waits in Trash for 30 days first), or when you delete your account; a single run cannot be deleted on its own.

1.8 Usage Data. We collect information about how you use the Service, including: features accessed, commands sent, message counts, session duration, and error logs. This data is used for billing, abuse prevention, and product improvement.

1.9 Device and Technical Data. When you access the Service we automatically record your IP address (used for security and rate limiting, and stored with each consent record, with each signed-in device, and in the security log described in §7), your browser's user-agent when you sign in or when a page reports an error, a coarse device type (desktop, mobile, tablet, or extension), the pages you visit within Otto (path only, never query strings), and the site that referred you. This data is used for security, fraud prevention, and analytics.

1.10 Log Data. Our servers automatically record log data when you use the Service, including the date and time of requests, request details, and server response codes. Server logs are held by our hosting provider under its own retention schedule, typically under 30 days; we do not control that window. Inside Otto, records of the actions Otto took for you and usage and analytics events are kept for up to 180 days, and routine run history for up to 90 days, after which a scheduled job deletes them.

1.11 Cookies and Local Storage. The logged-in product sets only the cookies it needs to work, all of them unreadable by the page’s own scripts: otto_session, which keeps you signed in for 7 days and is renewed while you keep using Otto; otto_2fa_pending, which lasts five minutes while you enter a two-factor code; and otto_oauth_state, which lasts thirty minutes while you connect an app such as Google, so the reply from that app can be matched to you. We use local storage for UI preferences (e.g., dark/light mode) and, while a meeting is being recorded, for a working copy of that meeting’s transcript so a crashed tab does not lose it. That working copy stays on your device, is replaced when you analyse or discard the meeting, and expires after twelve hours. Local storage also keeps, on that device only, a copy of the notes you type into a meeting and of the answers you give during setup, so a refresh does not lose them. That copy is not cleared when you sign out, so on a shared computer clear your browser’s site data for Otto when you finish. We do not use advertising cookies anywhere, and the logged-in product (www.runotto.app) sets no analytics cookies at all.

1.11a Analytics on the marketing site. Our public marketing site (www.ottohq.app), which includes the blog, uses two visitor-analytics tools and treats them differently. Fastlane runs on every marketing page to count traffic; it is described in §11 and listed in §5.7, and it is not part of the question below. Google Analytics we ask about first. Nothing from Google Analytics loads until you choose “Allow” on the cookie banner — if you choose “No thanks”, or simply ignore the banner, its script is never fetched, no analytics cookie is set, and Google Analytics receives nothing about your visit. Choosing Allow sets Google’s _ga cookies, which distinguish one visitor from another so a repeat reader is not counted twice. The advertising signals Google offers are switched off on every page load, we run no advertising or remarketing, and we never link any of this to your Otto account — the marketing site does not know who you are. If your browser sends a Global Privacy Control signal we skip the question entirely and never load Google Analytics (§11). You can change your cookie answer on our marketing site at any time; withdrawing also expires the _ga cookies on this device.

1.11b Controlling cookies yourself. You can clear or block cookies through your browser settings at any time, but disabling session cookies will prevent you from logging in.

1.12 Legal Consent Records. Agreeing to Otto takes two checkboxes: one confirming you are 18 or older, and one agreeing to our Terms of Service and this Privacy Policy. Each box you tick adds its own record: the exact sentence you ticked, a fingerprint of that sentence, the version of the documents, the time, your IP address, and your browser’s user-agent. When you agree to a newer version, a new record is added; earlier ones are never overwritten. These records exist for legal compliance; they are removed with the rest of your data when you delete your account.

1.13 Payment Information. If you subscribe to a paid plan, payment information (credit card numbers, billing address) is collected and processed by Stripe, our third-party payment processor. We do not receive or store your full credit card number. We receive only a payment token and basic billing details from Stripe.

1.14 Meeting Recordings. If you send Otto’s notetaker into a meeting, an audio recording of that meeting exists — audio only, never video — for as long as it takes to produce your transcript. The recording is created and held by Recall.ai on our instructions, not on our own systems, and Otto has it deleted once the transcript is saved. Section 4 describes exactly how this works and Section 7 describes exactly how long the recording lives.

1.15 Waitlist and Founding List. If you join the waitlist or the founding list on our website, we keep the name and email address you give us, whether you confirmed it, and your place on the list, so we can invite you; we email you once to confirm your place, and may write to you when a spot opens. These entries do not expire on their own. They are removed if you later create an account and delete it, or when you email team.ottohq@gmail.com and ask.

1.16 Files You Add and Files Otto Makes. When you add a file to a project, Otto keeps the text it reads out of that file, not the file itself, and gives that text to the AI model when you ask about the project. A file you attach to a meeting is kept whole with that meeting. Pictures Otto makes for you, with the request that produced them, and documents and files Otto writes for you are kept in your account. Removing a file from a project or a meeting deletes it at once; everything here is deleted with your account.

We use the information we collect for the following purposes:

• Providing the Service: Processing your requests, executing actions on connected services, maintaining conversation context, and running scheduled routines.
• Personalization: Using your memories, preferences, and history to make Otto's responses more relevant and useful to you specifically.
• Account management: Managing your account, processing payments, sending transactional emails (account confirmations, password resets, billing receipts), and enforcing plan limits.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, abuse, and violations of these Terms.
• Product improvement: Counting how the Service is used across accounts, from the usage events described in §1.8, to improve it. Those events are tied to your account, not anonymized, and are deleted after 180 days (§7); they record which feature was used and whether it worked, never what you wrote. We do not use individual conversation content for this purpose.
• Legal compliance: Complying with applicable laws, regulations, and legal processes, including responding to lawful requests from public authorities.
• Communications: Sending you service-related announcements and updates, and, unless you turn it off, a few getting-started emails in your first week, a reminder the day before your trial ends, and occasional tips and product news. Every one of those carries an unsubscribe link, and the “Tips & product news” switch in Settings → Notifications turns them all off; account, security and billing emails still reach you.
• Support: Responding to your inquiries and providing customer support. Beyond the short operating list of accounts described in §5.7 (first name, spend, last active, and a weekly count of what Otto finished), the person who runs Otto looks at your account only to resolve an issue, and only with your knowledge.

This section is required by Google's API Services User Data Policy and describes exactly how we handle data obtained through Google APIs.

What we access. When you connect your Google account, Otto can use the following — when you ask it to, and, for the automatic features described just after this list, on its own schedule without you asking each time:

• Gmail: read messages, send messages, create drafts, search email. (Otto does not request permission to modify your mailbox, so it cannot mark messages as read or archive them.)
• Google Calendar: read events, create events, update events, delete events, find free time. Otto reads every calendar you have ticked in Google (up to twelve), which can include calendars other people have shared with you and the events on them, together with the email addresses of people invited. When you ask when you and someone else are both free, Otto asks Google for that person’s busy and free times — never the contents of their events.
• Google Drive: Otto can search and read the files in your Drive when you ask it to find or summarise something, and it can create folders, documents and spreadsheets. It reads a file only to answer what you asked. We are narrowing this: Otto is moving to access limited to files it creates and files you open through it, and this page will say so on the day that changes.
• Google Docs/Sheets: read and append content to documents and spreadsheets you own or have access to.
• YouTube: read-only access to your channel and video information, only if you choose to connect YouTube.

What Otto reads on its own. Much of Otto works without you asking each time, which means it reads your Google data on a schedule. Once you connect Gmail and finish setup:

• Inbox sorting and draft replies are switched on for you. About every five minutes, while you have used Otto in the last 14 days, Otto reads the unread mail that arrived in your Primary inbox in the last two hours — each message’s sender, subject and up to about 2,000 characters of its text, plus up to four earlier messages in the same conversation (about 400 characters of each, including your own replies). It sends all of that to Anthropic together with your name and email address, short excerpts of emails you have sent so drafts match how you write (see the next item), what Otto already knows about each sender (their People entry and any open work between you), and the notes Otto kept when you turned down earlier drafts. Anthropic sorts the mail and drafts replies for you to approve. You can switch this off on the Inbox page.
• Your writing style. So that drafts sound like you, about once a week — or again after six hours, if there was not yet enough to learn from — Otto reads up to 25 emails you have sent in the last 90 days. It works out your habits, such as how you greet people, how you sign off and how long you usually write, on Otto’s own servers without sending them to an AI provider. It keeps those notes and up to four short excerpts of your sent emails (about 400 characters each, with email addresses and phone numbers removed) with your account, and sends the excerpts along whenever Otto writes a draft for you to send. Deleting your account deletes them.
• Promises you made and replies you are waiting on. About every ten minutes Otto reads messages you have sent from Gmail (up to ten new ones at a time) and sends them to Anthropic to find promises you made and questions you are still waiting to hear back on. It also updates the People records for the people you wrote to.
• Checks through the day. Every 15 minutes, while you have used Otto in the last 14 days, Otto looks for urgent email, a meeting you should prepare for, and work that has gone overdue, and tells you only when something needs you. Switching off “Check on things through the day” in Settings stops this check and the sent-mail check above.
• Your morning brief and evening close. Every day at 7:00 and at 8:30 in the evening, in your timezone, Otto writes your brief and your end-of-day close from your calendar, recent mail, open work and who is waiting on you, using Anthropic. They are written automatically and kept ready for when you ask, or sent to you if you chose that. You can turn either off from Routines.
• When you first connect. Two one-time reads, so your first day is not an empty page. The moment you connect Google, Otto looks at up to 25 unread messages in your Primary inbox, however old they are — reading the sender, subject and Gmail’s short preview of up to 15 of them — and at up to ten events from each of your calendars for the next seven days, to show what needs you first and to start your People list. That first look is not sent to an AI provider. Then, during setup, Otto reads up to 50 emails you sent in the last 14 days and sends the ones that look like they hold a promise (up to 25, and up to about 6,000 characters of each) to Anthropic to find what you already owe people, and it reads your calendars from a week back to a week ahead (up to 50 events from each calendar).
• Thread checks and People records. About every 30 minutes Otto checks whether email threads it is tracking have been answered, and it keeps People records and relationship statistics up to date from your message history (see “Records Otto derives from your mail” below).

This automatic processing is done by Anthropic under its commercial terms. None of it fails over to another AI provider (§5.1b), and Gmail and Calendar content is never sent to a computer run by Otto’s operator — only to the providers named in §5. Until you accept an updated version of this policy, Otto pauses all of the above for your account (§13).

Limited Use compliance. Otto’s use and transfer of raw or derived user data received from Google Workspace APIs, to any other app, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. “Derived” is deliberate: it covers not just the emails and events Otto reads, but everything Otto builds from them — summaries, extracted commitments, contact records and relationship statistics. Specifically:

• We use Google user data only to provide or improve user-facing features that are visible and prominent in the Otto interface.
• We do not transfer Google user data to third parties except as necessary to provide the Service (e.g., transmitting to the AI model to generate a response), and only to provide features you have turned on or asked for.
• We do not use Google user data for advertising, including retargeting, personalized advertising, or advertising-related analytics.
• We do not allow humans to read your Google user data unless you have explicitly consented, or we are required to do so for security or legal compliance, or it is strictly necessary for technical support and you have affirmatively requested it.
• We do not use Google user data to build user profiles for purposes unrelated to providing the Service.
• We do not sell Google user data under any circumstances.
• We do not use Google user data to develop, improve, or train generalised or non-personalised AI or machine learning models. Otto sends the messages, events or files a feature needs to a model provider to produce that result for you — the ones you ask about, and, for the automatic features above, batches of recent mail. That provider is Anthropic, whose commercial terms forbid it from training on that content; if you deliberately choose another model, OpenRouter routes the request only to providers that do not collect or train on prompts (§5.1a). One more transfer happens without you choosing it: the search embeddings described in §5.1c, which can be computed from memories and conversation summaries built from your mail, are made through OpenRouter under the same do-not-collect instruction. Nothing derived from your Google data — including summaries, extracted commitments, contact records and relationship statistics — is used to train any model, yours or anyone else’s.

Storage of Google data. OAuth access and refresh tokens are stored encrypted in our database. When Otto reads an email, calendar event, or file to answer you or to write a routine such as your morning brief, the content it read is saved as part of that conversation or routine record, so the answer still makes sense when you come back to it later. That means the text of emails Otto has read for you is stored in our database, up to roughly the first 6,000 characters of each message. It is your record: you can see it in the conversation, and it is deleted when you delete that conversation or your account. A routine’s copy goes when its run history ages out after 90 days, when you delete the routine, or when you delete your account. For email triage — the automatic sorting of your inbox — Otto stores only short metadata about recent threads: sender name and address, subject line, the category Otto assigned, and a one-line note explaining why. You can see and correct these. They are kept until you delete your account, which deletes them; Otto does not yet remove older ones on its own.

Records Otto derives from your mail. To do its job, Otto keeps a small set of its own records built from your email and calendar: People entries (name, email address, phone, company and role where Otto can infer them, and notes you or Otto add), plus relationship statistics Otto calculates automatically from your message history — how often each side starts a thread, typical reply times, and whether contact is speeding up or slowing down. It also keeps commitments it detects (a short description of the promise, who it involves, and its due date), reply-watch entries (recipient and subject line of a message you're waiting on), a writing-style profile (your usual greeting, sign-off and length, and up to four short excerpts of emails you have sent), and — when you approve a scheduled or drafted email — the outbound email itself, which is kept for up to 180 days after it is sent, cancelled or fails, and then deleted (§7). These are your records: they are visible in the product, editable, and deleted with your account.

People who are not Otto users. Some of those records describe other people — the contacts you email and meet. They are held on your behalf, and they are visible and editable by you. If a user sends Otto’s notetaker into a meeting you attend, your voice is briefly part of the recording and your words are part of the transcript — the notetaker joins visibly under a name that says it is recording, and says out loud that it is taking notes, so that this does not happen to you without your knowledge — §4 describes exactly how that works and where it falls short. If you are not an Otto user and you believe an Otto user's account holds information about you — a contact record, a transcript of something you said, anything — email team.ottohq@gmail.com and we will locate it and delete it.

Chrome extension. The Otto browser extension is not in the Chrome Web Store yet, so it cannot be installed today; this paragraph describes how it works once it is. The Otto browser extension works only on mail.google.com and calendar.google.com. It reads the email thread or calendar event you have open (and the Google account address shown in the page header, to warn you if it differs from the account connected to Otto), and sends that context to your own Otto account over HTTPS to power summaries, drafts, triage and meeting preparation — nowhere else. It is authenticated by a revocable per-browser credential that you approve on an Otto-hosted authorization page after a plain-language disclosure; nothing is read or sent before that approval. The extension never composes and sends mail silently: a reply it drafts lands in Gmail for you to press Send. If you tap Approve on a pending action in the extension panel, Otto's server carries out the action you approved, which can include sending that message. The extension has no access to other websites, your browsing history, or your Google password. Disconnect any browser in Settings → Extension (shown on a computer); disconnecting revokes its credential immediately.

Revoking Google access. You can revoke Otto's access to your Google account at any time by: (a) disconnecting the Google integration from Settings → Connections in Otto, or (b) visiting your Google Account Security settings at myaccount.google.com/permissions and removing Otto's access. Upon disconnection, we immediately delete the stored tokens for what you disconnected. Gmail, Calendar, Drive, Docs, Sheets and YouTube share one Google sign-in, so Otto asks Google to revoke its access only when you disconnect the last of them; while any one stays connected, Google still lists Otto as having the access you first granted, and Settings says so before you confirm.

Otto’s notetaker (a bot that joins your meeting). You can send Otto’s notetaker into a Zoom, Google Meet, or Microsoft Teams meeting. It only ever goes where you send it, one meeting at a time — there is no ambient capture and no standing schedule. It joins as a visible participant named “Otto — Notetaker (recording)”, records audio only — never video, and says out loud that it is taking notes. When someone new joins, Otto pauses the recording, tells them — out loud if the room has not heard the notice yet, otherwise with a message addressed to them by name in the meeting chat — and then resumes. If the spoken notice cannot be delivered, the recording stays paused; if Otto cannot tell the room at all, it leaves the meeting.

What the notetaker does not guarantee. We would rather be exact than reassuring. When several people join within about a minute and a half of each other, one notice covers all of them, so someone who arrives just after a notice may be recorded for up to about ninety seconds before they are told. People are recognised by their display name, so a second person with the same name as someone already told is treated as already told. The chat message depends on the host allowing chat. And the opening notice is spoken once Otto sees people in the room, so the first moments after it is admitted may be recorded before anyone has heard it. Otto does not check the finished transcript for the notice. None of this replaces your own responsibility: make sure everyone in the meeting agrees to being recorded — many places require the consent of every participant.

Where the notetaker’s recording lives, and for how long. The recording exists for one purpose: to produce your transcript. It is created and held by Recall.ai (Recall Technologies, Inc., listed in §5.7), on Recall’s servers in the United States, and Recall — not Deepgram — performs the transcription on this path. Once the transcript is saved to your account, Otto instructs Recall to delete the recording; a timed backstop deletes it automatically even if that instruction never lands. Deleting a meeting in Otto also deletes any recording still on Recall’s servers, and so does deleting your account (§7).

Platform honesty. The notetaker is subject to each platform’s own rules, so it does not work everywhere: a Google Meet host must admit Otto from the knocking screen before it can join, some Microsoft Teams organizations block outside notetakers entirely, and Zoom support depends on the meeting’s settings and often requires extra setup we haven’t shipped. When the notetaker cannot join, nothing is recorded — Otto tells you rather than working around the platform.

Recording in your browser. Separately from the notetaker, audio you record in your browser or upload is sent to Deepgram for speech-to-text and the resulting transcript is stored in your account, along with notes, summaries, decisions, and action items derived from it. Deepgram also separates the voices it hears, so the transcript can mark who spoke which line; it labels them only as “Speaker 1”, “Speaker 2” and so on, and any real names come from you typing them in. Transcripts naturally contain the words of other people in the meeting. You are responsible for making sure everyone being recorded has agreed to it — many places require the consent of all participants before a conversation may be recorded. Otto shows a reminder before recording starts. Transcripts are yours: you can delete any meeting, and deleting your account deletes them all.

Hearing the other people on a call, and why your browser asks to share a screen. By default Otto hears only your microphone, which captures your half of a conversation. If you tick “Also hear the other people on the call” before you start, your browser opens its own “Choose what to share” picker and warns that the site will be able to see your screen. That warning comes from your browser, not from us, and it appears because capturing another tab’s sound is only possible through the same permission that grants video — there is no audio-only version of it. Otto requests that permission, immediately stops and discards the video track, and keeps nothing but the audio: no image of your screen is ever read, recorded, transmitted or stored. Whichever surface you pick is the one Otto can hear, so choosing “Entire Screen” means every sound your computer makes is transcribed, not just the call. This runs on your own machine rather than sending a bot, and unlike the notetaker it does not announce itself to anyone — telling the other participants is yours to do, and in many places their agreement is legally required before you may record.

We never train on your meetings, and we hold our vendors to the same line. Otto’s own systems store no recording of you at all — no meeting audio and no dictation clip is written to disk or to our database — and we do not train any model on your meetings, transcripts, or notes. What is new: when the notetaker joins a call, Recall holds the recording on its servers until your transcript is saved, then Otto has it deleted, with a timed backstop either way. Recall’s standard data-processing terms restrict it to processing recordings only to provide the service — not for its own purposes, and not to train models. Deepgram runs a Model Improvement Program under which it may otherwise retain customer audio and train its speech models on it; Otto sends an explicit opt-out on every single transcription request, live and uploaded, and pays a higher per-minute rate as a result.

What we can and cannot promise about that. We would rather be precise than reassuring. The opt-out we send applies to each individual request, and Deepgram’s standard terms separately reserve a broad right to use customer content for model training. We are seeking a signed agreement with Deepgram that removes that right for your audio; until we have one, what we can honestly promise is that Otto sends the opt-out on every request without exception, and that Otto never trains on your content itself. Separately, if a live meeting falls back to your browser’s built-in speech recognition (see above), that audio reaches your browser vendor under their terms, which we neither control nor can opt you out of.

Backup transcription uses your browser, which sends audio to its maker. If Otto cannot reach Deepgram during a live meeting, it falls back to the speech recognition built into your browser so the meeting is not lost. That fallback is not Deepgram and is not a sub-processor we control: your microphone audio is sent to your browser vendor — Google for Chrome, Apple for Safari — and is handled under that vendor’s own privacy policy, not ours. The fallback produces no speaker separation. Otto tells you on screen which engine is running and announces the switch when it happens, so you can stop recording if you would rather not use it.

Dictation (speaking to Otto instead of typing). The microphone buttons used to dictate a message or a quick note record a short audio clip and send it to Otto’s server, which forwards it to Deepgram for speech-to-text and returns the words. Otto stores the resulting text, not the audio, and the clip is not written to disk or to our database at any point. The same training opt-out Otto sends on meeting audio is sent on every dictation request. We used Deepgram here deliberately rather than the browser’s own speech recognition: the built-in recognizers do not exist in Safari or Firefox and are unreliable on phones, so dictation would simply not work for most people.

Slack. When you connect Slack, Otto can read messages from channels and direct messages you authorize, and send messages on your behalf. We store your Slack OAuth token encrypted. We do not mirror or index your Slack history; the messages Otto actually reads to answer you are saved in that conversation record, as described in §1.7. When you disconnect Slack or delete your account, Otto asks Slack to revoke its token, unless another Otto account is still connected to the same workspace.

Notion. Notion is marked “Coming soon” in Settings → Connections and cannot be connected yet. When it can, Otto will be able to read and write the pages and databases you authorize, and we will store your Notion OAuth token encrypted.

Other OAuth connections. Discord and Instagram are also marked “Coming soon” and cannot be connected yet; Settings → Connections always shows which services can be connected today. The same rules apply as for Slack and Notion: you grant access explicitly, the token is stored encrypted, and Otto uses it only when you direct it to. Disconnecting deletes our copy of the token and, where the service offers a way to do it, revokes it at the service.

Other integrations. For API-key based integrations, you provide an API key which we store encrypted. We use the key solely to make requests to that service when you direct Otto to. One of these is itself an AI provider: if you connect your own OpenAI key and ask Otto to put a question to GPT or make an image with it, the words Otto sends — which can include email or calendar content from that conversation — go to OpenAI under your own account and your own agreement with OpenAI, not under ours, and our promises about Anthropic in §3 do not cover them.

General principle. For all integrations: we access only what is necessary for the features you use and the requests you make, we store credentials encrypted, we do not share your integration data with other users, and you can disconnect any integration at any time.

We do not sell your personal information. We do not share your personal information with third parties for their marketing purposes. We share information only in these limited circumstances:

5.1 AI model providers. When you send a message to Otto, the content of that message (and relevant context from your conversation history and memories) is transmitted to Anthropic's Claude API to generate a response. Your Gmail and Calendar content is sent to Anthropic when you ask about it and when an automatic feature processes it — inbox sorting and drafts, promise tracking, your morning brief and evening close, and the other features listed in §3. Slack messages are sent when you ask about them, or when you or your teammates message Otto in Slack. Web searches you ask for run through Anthropic’s search tool. Anthropic processes this data subject to its own privacy policy and commercial terms. If you add your own Anthropic or OpenRouter key in the AI Wallet, Otto sends the requests for that provider with your key instead of ours, so they also run under your own account and your own agreement with that provider; removing the key there switches back.

5.1a If you choose a non-Anthropic model. Otto lets you pick other AI models, routed through OpenRouter. If you do, the same context Otto would give Claude goes to that model instead: your name and email, relevant memories and open tasks, and your conversation history — which can include Gmail or Calendar content Otto fetched earlier in that conversation. Every request carries OpenRouter's do-not-collect flag. Precisely what that flag does: it restricts routing to model providers whose policies forbid collecting or training on prompts — it governs who may receive the request, and is not a promise from OpenRouter about its own systems, which operate under OpenRouter's own privacy policy. We would rather describe the mechanism exactly than imply a stronger promise than the flag makes.

5.1b Automatic backup processing. If Anthropic is unavailable, some Otto features retry through OpenRouter (with the same do-not-collect instruction) so the product keeps working. Your Gmail and Calendar content is excluded from this, and so is anything Otto built from it (People entries, promises, notes and summaries drawn from your mail): features that process email or calendar content (inbox triage, reply watching, commitment extraction, meeting follow-up drafts, the browser extension's email tools), and your messages to Otto in Telegram and Slack, never fail over to a second provider — they wait for Anthropic instead. Chat in the app follows the same rule. If your account has ever been connected to Google or to Otto’s browser extension, a chat is never rerouted: during a full outage Otto tells you it couldn’t finish, and your message is kept. For any other account, a rerouted chat cannot use tools, and the text of emails, attachments and web pages Otto read earlier in the conversation is withheld from the backup model. Features that don't involve Google content (for example meeting-transcript analysis, dictation cleanup, or reading a business card you photograph) may use the backup.

5.1c Search embeddings. To power memory search and meeting search, Otto computes text embeddings of your saved memories (titles and notes, which can summarize facts learned from your email), of your meeting notes (titles, summaries, and the note text Otto wrote — not the raw audio), and of the short summaries Otto writes of your past conversations (§1.4, which can contain anything those conversations contained) through OpenRouter, with the same do-not-collect instruction. To find what is relevant each time you message Otto, the text of your message is sent the same way. Embeddings are stored only in our own database.

5.2 Infrastructure providers. We use Railway for hosting and deployment. Railway hosts the database and the application, so your data resides on their infrastructure; access is restricted to the operator's account and to Railway's own personnel under their terms.

5.3 Payment processing. Stripe processes payments. They receive your payment card information and billing details. We do not receive or store full payment card information.

5.4 Legal requirements. We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, prevent fraud, or protect the safety of any person.

5.5 Business transfers. If the Service is ever transferred to another operator, your information may move with it. We will notify you before your information is transferred and becomes subject to a different privacy policy. Data Otto obtained from Google APIs is treated differently and more strictly: it will only be transferred in such a sale with your consent, never on notice alone, because the Google API Services User Data Policy requires it (§3).

5.6 With your consent. We may share your information for any other purpose with your explicit prior consent.

5.6a Links you choose to share. Otto lets you create an unlisted link to a conversation or to a meeting's note document. Anyone who has the link can read that content — no Otto account required — until you revoke it. Both kinds of page show your name as the person who shared it, and so does the short preview a chat app or email client builds when someone pastes the link. Meeting links include the written note only (title, date, summary, notes, decisions, and action items); they never include the recording, the transcript, the attendee list, attachments, or your private jottings. Share links are long random URLs that cannot be guessed, are marked so search engines do not index them, and can be revoked from the shared item at any time; revocation takes effect immediately. You are responsible for who you give a link to while it is active.

5.7 Sub-processors. The following third parties process personal data on our behalf to operate the Service. We select providers that publish data protection commitments and act as processors on our instructions. We do not currently hold a signed data processing agreement with every provider on this list, and we would rather say so than imply otherwise; obtaining them is work in progress and we will update this section as each is in place. All are located in the United States except where noted in the list below.

If you connect optional integrations (e.g., Google, Slack, Notion, Telegram), those providers also receive data as needed to fulfill the requests you direct Otto to make. We update this list when we add or remove a sub-processor; material changes are communicated as described in the "Changes to This Policy" section. To request advance notice of sub-processor changes, email team.ottohq@gmail.com.

Not on this list, but it receives your voice: your own browser. When you dictate, or when a live meeting falls back to the browser’s built-in speech recognition (§4), the audio goes from your device to your browser vendor — Google for Chrome, Apple for Safari. That happens between you and software you installed, so those vendors are not our sub-processors and we have no agreement with them covering it, but you should know it happens. It is listed here rather than hidden because the effect on your privacy is the same either way.

Also not on this list: website icons. When a chat shows a link or a source, your browser loads that website’s small icon from Google’s icon service, which tells Google the website’s domain and your IP address. Nothing else from the conversation is sent. In the same way, when you browse the apps you can connect in Settings, your browser loads some of their logos from Clearbit’s logo service (logo.clearbit.com), which learns the app’s web address and your IP address and nothing about your account.

Also not on this list: blog pictures. Articles on our blog are published through BabyLoveGrowth, and when you open the blog your browser loads their pictures from that service’s file storage (a supabase.co address), which sees your IP address and which picture you loaded. The blog does not know who you are, and nothing from an Otto account goes there.

Also not on this list: the meeting platform. When Otto’s notetaker joins a call, your voice reaches Recall (listed above) by way of the meeting platform — Zoom, Google, or Microsoft — which relays the call’s audio to the notetaker the same way it does to every other participant, under the platform’s own terms. You chose the platform, not us, so it is not our sub-processor — but on the notetaker path it is part of how your voice travels, and you should know that.

We implement and maintain technical and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• AES-256 encryption for OAuth tokens and API credentials at rest;
• bcrypt hashing for passwords with appropriate cost factors;
• TLS/HTTPS encryption for all data in transit;
• Session tokens with expiration and rotation;
• Production database access restricted to the operator and protected by unique credentials;
• Dependency updates and security reviews before significant releases;
• Rate limiting and abuse detection systems.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Active accounts. We retain your personal information for as long as your account is active. Conversation history, memories, and task data are retained indefinitely until you delete them, as they are core to the Service's functionality.

Items you delete inside Otto. Conversations, memories, tasks, routines, and meetings you delete move to Trash, where you can restore them for 30 days. After 30 days a scheduled job removes them permanently.

Meeting recordings (notetaker). A recording made by Otto’s notetaker is the shortest-lived thing in this section, on purpose. It lives on Recall’s servers (§4, §5.7) only until your transcript is saved, at which point Otto instructs Recall to delete it; a timed backstop deletes it automatically even if that instruction never lands. Deleting a meeting in Otto also deletes any recording still on Recall’s servers — that deletion does not wait out the 30-day Trash window, because a recording of other people’s voices should not sit on a vendor’s disk while a note document sits in Trash. Deleting your account does the same.

Deleted accounts. When you delete your account, all associated personal data in Otto’s database — including account information, conversations, memories, tasks, integration tokens, routines and consent records — is permanently deleted within 30 days. Deletion also reaches these vendors: account deletion instructs Recall to delete any meeting recording still on its servers, revokes Otto’s access at Google and — unless another Otto account uses the same workspace — at Slack, and removes connections held by Pipedream. It does not reach copies other vendors keep under their own terms: the history of text Otto had ElevenLabs speak, delivery records at Resend and Postmark for email Otto sent you, messages already delivered to your Telegram chat, and the records Stripe keeps of payments you made (§7, Payment records). There are two exceptions inside Otto too: the next paragraph, and spoken audio, below, which is not tied to your account and expires on its own.

Feedback, reported conversations and emails to Otto. In-app feedback you send, conversations you choose to report to us, and emails you send to Otto’s own address are copied, with your email address, to our operations monitor (§5.7) so we can read and answer them. They are not deleted automatically, and deleting your Otto account does not remove them from that tool today. Email team.ottohq@gmail.com and we will delete them by hand.

Spoken audio Otto generates. When Otto reads something aloud for you — Listen on Today, or answers read aloud if you turned that on — the audio it synthesizes is cached on our server so the same line does not have to be regenerated. That cache holds Otto’s synthesized voice, never a recording of you, and entries are deleted automatically after 90 days. Each clip is filed under a one-way fingerprint of the text and your account, so it cannot be listed by user: it is not returned in a data export and is not removed when you delete your account, and instead runs out its 90 days like every other clip.

Backups. Deleted data may remain in database backups for up to 60 days before being purged from backup systems. Otto’s own nightly backups keep the newest seven copies, so they hold deleted data for about a week; our hosting provider also keeps its own backups of the same storage. Both live with our hosting provider, not on separate infrastructure of ours, with restricted access; Otto’s own copies are compressed rather than separately encrypted.

Signups that were never completed. If you begin creating an account and never confirm your email address, the name, email address and password hash you entered are deleted automatically within about a week.

Logs and activity records. Records of actions Otto took for you, and usage and analytics events, are kept for up to 180 days. Routine run history is kept for up to 90 days. Two records are not on a timer yet and are kept until you delete your account: Otto’s note of each alert it sent you or chose to hold back (the alert’s title and why), and the feed of things worth knowing about your people, such as a reply that went quiet or a birthday coming up. Server and platform logs are held by our hosting provider under its own retention schedule, typically under 30 days.

Security events. A dedicated security log records sign-ins and failed sign-ins, password changes, session revocations, data exports, account deletions, and administrative actions, together with the IP address and browser information of the request. These records exist to investigate account compromise and abuse, and are kept for up to 400 days, then deleted automatically. Your entries are removed immediately if you delete your account. Two kinds of entry are not tied to an account, so they stay for the same 400 days: the record that an account was deleted, which keeps the IP address and browser of that request and a masked form of the email address (its first letter and its domain); and the record of each time a private-preview access code was used to open Otto, which keeps the IP address and browser and, for uses before 2 October 2026, the name the code was issued under.

Payment records. The records of payments you made — invoices, charges and refunds — are held by Stripe (§5.3), which keeps them for as long as financial and tax law requires; deleting your Otto account cancels your subscription but does not erase them there. Otto’s own copy of your plan and your credit history is deleted with your account.

Depending on your location, you may have certain rights regarding your personal information. We honor these rights for all users, regardless of jurisdiction:

Right to access. You can access most of your personal data directly within the Service (conversations, memories, tasks, integrations). You can download a copy of your data yourself at any time from Settings → Export & deletion, or from the screen that asks you to agree to an updated policy, without agreeing; you can also ask for one by emailing team.ottohq@gmail.com.

Right to rectification. You can update your name from Settings → Account, and correct or delete what Otto has learned about you from Settings → What Otto Knows. Otto cannot change the email address on an account from Settings yet; to change it, or for any other correction, contact us at team.ottohq@gmail.com.

Right to deletion ("right to be forgotten"). You can delete your account from Settings → Export & deletion, which permanently deletes your data as described in §7. You can also delete individual conversations, memories, and tasks directly from the app.

Right to data portability. Settings → Export & deletion also offers your data as one machine-readable file, ready for another app to read. If you would rather we sent it, email team.ottohq@gmail.com and we will fulfill the request within 30 days.

Right to withdraw consent. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

Right to object / restrict processing. You may object to certain processing activities or request restriction. Contact us at team.ottohq@gmail.com to exercise these rights.

CCPA rights (California residents). California residents have the right to know what personal information we collect, the right to delete personal information, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising these rights.

To exercise any of these rights, contact us at team.ottohq@gmail.com. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

The Service is for adults and is not directed to children or teenagers. You must be at least 18 years old to create an account and use Otto, and you confirm this with its own checkbox when you agree to the Terms (§1.12).

COPPA (United States). Otto complies with the Children's Online Privacy Protection Act (COPPA). The Service is not directed to children under 13, and we do not knowingly collect, use, or disclose personal information from any child under 13. We do not knowingly create profiles of, or serve content to, children under 13. If we discover that we have inadvertently collected personal information from a child under 13, we will delete that information as quickly as possible and terminate any associated account.

We also do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will close the account and delete its information. If you believe someone under 18 is using Otto, email team.ottohq@gmail.com.

If you are a parent or guardian and believe that a child under 13 has provided us with personal information, please contact us immediately at team.ottohq@gmail.com and we will take steps to delete it.

Otto is operated from the United States. If you are located outside the United States, your information is transferred to, stored, and processed in the United States, which may not give it the same legal protection as your home country.

What makes that transfer lawful today. We currently rely on your agreement to this policy, given when you create your account, together with the data protection commitments our providers publish. That is a thinner basis than we want. We are putting data processing agreements incorporating the European Commission's Standard Contractual Clauses in place with each provider listed in §5.7, and we will name them here once they are signed.

Our lawful basis, purpose by purpose.

• Contract — running the Service: answering you, carrying out the actions you ask for, running your routines, and maintaining your account.
• Consent — the optional things you switch on: connecting a third-party service, recording and transcribing meetings — including sending Otto’s notetaker into a call, where a third party (Recall.ai, §4 and §5.7) records the voices of people in the meeting after the notetaker announces itself out loud — push notifications, marketing email, and analytics cookies on our marketing site (§1.11a). You can withdraw consent at any time by turning the feature off, disconnecting the service, changing your cookie answer on the Privacy Policy page, or emailing team.ottohq@gmail.com.
• Legitimate interests — keeping the Service secure, preventing abuse, and measuring aggregate product usage so we can improve it. Our interest is operating a service that works and is not abused. You can object at team.ottohq@gmail.com and we will honor it.

Automated decisions. Otto sorts your inbox into categories, flags what looks like a commitment, and drafts replies, all automatically. None of this produces a legal or similarly significant effect on you, and nothing Otto drafts is sent without your approval. You can correct any classification in the product, and you can ask a person to review one by emailing team.ottohq@gmail.com.

Complaints. If you are in the EEA, the UK, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority. We would rather you came to us first at team.ottohq@gmail.com, but you do not have to.

EU/UK representative. We have not appointed a representative under Article 27 of the GDPR. Otto is a private preview with a handful of users and is not marketed in the EEA or the UK. If that changes, we will appoint one and name them here.

Some browsers transmit "Do Not Track" signals. We honor these signals for the Service (the logged-in Otto product) — we do not use tracking cookies or cross-site tracking there. Product analytics are based on aggregate usage data from our own systems, not third-party tracking.

Our public marketing site (ottohq.app) uses two third-party website analytics tools, both listed in §5.7, to measure aggregate visitor traffic — pages viewed, referral source, general location. Fastlane runs on every marketing page. Google Analytics runs only for visitors who choose “Allow” on the cookie banner (§1.11a). Neither is used for advertising, retargeting, or cross-site profiling, and neither runs inside the logged-in product.

Google Analytics does not act on “Do Not Track” headers, and we would rather state that than let the paragraph above imply otherwise. We handle it at our end instead: if your browser sends a Global Privacy Control signal, we treat that as a decision and never load Google Analytics, without showing you a banner at all.

If you enable push notifications, we store your push subscription endpoint to deliver notifications from Otto. Delivery necessarily runs through the push service built into your browser — Google for Chrome, Apple for Safari, Mozilla for Firefox — which is not a sub-processor we control. The contents of each notification are encrypted so that service cannot read them, but it does see your device’s endpoint and the timing of every notification we send you (such as routine results, reminders, or alerts you have configured). You can stop push notifications at any time from your browser or device settings, or from Settings → Notifications in Otto. Turning them off in Otto stops us sending them but keeps each device registered, so you can turn them back on without setting the device up again. If you block notifications in your browser or device, the push service tells us the next time we try to send, and we delete that device’s subscription then. Deleting your account deletes every subscription.

We may update this Privacy Policy from time to time. When we make material changes we will show you the updated documents in the app, with what changed in plain words, and ask you to agree before you continue using Otto. The effective date at the top of this page always reflects the version currently in force.

What pauses until you agree. Until you accept an updated version, Otto holds the work it does for you on its own — your morning brief and other routines, inbox sorting and drafts, the sent-mail, thread and through-the-day checks, and the evening journal — and if you message Otto on Telegram, Slack or email it answers with one line asking you to accept the updated terms at runotto.app instead of acting on the message. If your brief or another routine normally arrives on its own, the first time one is held Otto sends you one short message on the channel it would have used, saying it is paused and asking you to accept at runotto.app; that message goes once for each updated version. Reminders you set yourself and messages you scheduled to send still go out, and billing notices still reach you.

If you do not agree to the updated policy, you can stop using the Service and delete your account from Settings. Your data remains yours to export or delete either way.

The version of this policy you agreed to at registration is recorded in our systems. If we make changes that require re-consent under applicable law, we will ask for your renewed agreement.

Otto is operated by an individual in the United States, not by a company, and it offers paid subscriptions under the Terms of Service. For privacy questions, data requests, or a postal contact address if none is shown below, email team.ottohq@gmail.com — that mailbox reaches the person who operates the Service.