ato

Last updated

Privacy Policy

This Privacy Policy explains how [SERVICE OPERATOR NAME] (“Ato”, “we”, “us”, or “our”) handles information when you use ato.run, including its website, PWA, APIs, shared experiences, managed execution features, and supported integrations.

This policy applies whether you use ato.run with an account or through a guest or shared link.

1. Information We Process

Depending on how you use ato.run, we may process the following categories of information.

Account and authentication information

Examples include:

  • account identifier, display name, and email address;
  • authentication provider information;
  • login and session metadata;
  • security and authorization records; and
  • account settings and access grants.

Guest and participation information

If you use ato.run without an account, we may create temporary or pseudonymous identifiers needed to operate a guest session or shared activity.

We may process participation status, session identifiers, connection metadata, and other information needed to let multiple users participate in an experience.

Software, source, and application content

When you create, import, run, or manage software through ato.run, we may process:

  • source files and application assets;
  • app titles, icons, descriptions, and other metadata;
  • configuration and operation definitions;
  • application state and saved data;
  • files or content you intentionally place inside an application; and
  • public, private, or link-sharing settings.

The specific content processed depends on the application and features you use.

Operations and connected-client data

If you connect an AI client, MCP client, coding agent, or other integration, we may process:

  • authorization scopes and resource-specific grants;
  • requests to read or write application data;
  • operation names, arguments, results, status, and idempotency information;
  • identifiers needed to route the request to the correct application instance; and
  • audit and security metadata associated with those requests.

We do not give a connected client broader access merely because it is connected. Access is limited by the permissions and resource-specific grants supported by the Service.

Activity and collaboration data

For shared activities, we may process information such as:

  • participant identifiers and presence;
  • control or interaction events;
  • shared application state;
  • synchronization events and sequence information;
  • invitations, participation grants, and expiration data; and
  • technical information needed for realtime connectivity.

Information entered into a shared application may be visible to other participants according to the application's behavior and sharing settings.

Device, network, and usage information

We may process:

  • IP address;
  • browser, device, operating-system, and app information;
  • timestamps and request identifiers;
  • pages, features, and actions used;
  • error, performance, and diagnostic information;
  • security and abuse signals; and
  • approximate region inferred from network information where needed for security, capacity, or execution routing.

If you contact us, submit a report, or make a privacy request, we process the information you provide and related correspondence.

2. Credentials and Secrets

Some features may require OAuth tokens, API credentials, connection information, or other secrets.

We separate credentials and authorization material from public or shared application content where the architecture supports it, and we do not intentionally publish a creator's private credentials as part of a shared application or activity.

However, you are responsible for not placing credentials or confidential information directly into source files, public fields, application data, prompts, or other content that is designed to be shared.

Recipients who continue or operate shared software may be required to provide their own credentials.

3. How We Use Information

We use information to:

  • provide, operate, secure, and maintain ato.run;
  • authenticate users and manage guest access;
  • create, run, save, share, and synchronize software experiences;
  • enforce permissions and resource-specific consent;
  • connect Controllers, Runners, integrations, and participants;
  • prevent fraud, abuse, unauthorized access, and security incidents;
  • troubleshoot errors and improve reliability and performance;
  • understand aggregate feature usage and improve the Service;
  • respond to support, legal, privacy, and intellectual-property requests; and
  • comply with applicable law.

Where applicable, the legal basis for processing may include performance of a contract, consent, compliance with legal obligations, and legitimate interests recognized under applicable law.

4. Public and Shared Information

Your selected visibility setting affects who may access your content.

Private

Private content is intended to be accessible only to you and users or clients you authorize.

Specific people or account-based sharing

Content may be accessible to selected accounts or participants according to the access grant.

Anyone who obtains a valid sharing link may be able to access the linked content, depending on its settings. Treat bearer-style links as sensitive.

Public

Public content may be viewed by anyone and may be indexed, cached, linked to, or redistributed by third parties.

Changing a visibility setting or revoking a link restricts future access through ato.run, but it cannot guarantee deletion of copies already obtained by third parties.

5. AI Clients and Third-Party Integrations

When you authorize a third-party AI client, MCP client, or other integration, ato.run may disclose the application data or operation results necessary to fulfill the authorized request.

The third party's own privacy policy and terms then govern how it handles information it receives.

Before authorizing an integration, review the requested access and the provider's policies.

We do not sell your conversation or application data to AI-client providers merely because you connect them to ato.run.

6. Service Providers

We may use service providers for infrastructure, hosting, storage, authentication, networking, security, analytics, monitoring, and support.

These providers may process information on our behalf to provide their services.

We require service providers to handle information consistently with applicable law and appropriate contractual or technical safeguards.

7. International Processing

ato.run and its service providers may process information in countries or regions other than where you live.

Where applicable law requires additional measures for international transfers, we will use an available lawful mechanism, provide required information, or obtain consent as appropriate.

8. Retention

We retain information only for as long as reasonably necessary for the purposes described in this policy, including service operation, account management, security, abuse prevention, dispute handling, and legal compliance.

In general:

  • account information may be retained while your account remains active and for a limited period afterward where necessary;
  • application content and saved data may remain until you delete them, delete the relevant application or instance, or the applicable retention feature expires;
  • public or shared content may remain until it is deleted, unpublished, or revoked;
  • security, audit, and abuse records may be retained longer when needed to investigate incidents or comply with legal obligations; and
  • backups and caches may take additional time to expire after primary deletion.

We may anonymize or aggregate information so that it can no longer reasonably identify you.

9. Data Use for Product Improvement and AI Training

We may use operational and aggregated usage information to improve ato.run, measure reliability, prevent abuse, and understand feature performance.

We do not use private or limited-share application content, saved application data, connected-client operation payloads, or private activity content to train generalized AI models or license such content as a dataset unless you separately and explicitly opt in.

If we introduce a program for research datasets, model training, benchmarking, or commercial data licensing, participation will require a separate opt-in and additional terms or disclosures.

10. Cookies and Local Storage

ato.run may use cookies, browser storage, and similar technologies for authentication, security, preferences, guest sessions, application functionality, and analytics.

Where required, we will provide additional notice or choice for non-essential technologies.

Your browser may allow you to block or delete cookies or local storage, but doing so may prevent some features from working.

11. Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, and alteration.

These measures may include access controls, authorization scopes, isolation, encryption in transit, logging, rate limits, and security monitoring.

No system can guarantee absolute security.

If you discover a security issue, use the process described in our Security Policy.

12. Your Rights and Requests

Depending on applicable law, you may have rights to request:

  • confirmation of whether we hold personal data about you;
  • disclosure or access;
  • correction or updating;
  • deletion or cessation of use;
  • restriction or objection;
  • data portability where applicable; or
  • withdrawal of consent where processing is based on consent.

To make a request, use Contact us.

We may need to verify your identity before completing a request.

13. Children

ato.run is intended for users who are 18 years of age or older.

Do not use ato.run if you are under 18.

If you believe a person under 18 has provided personal information to ato.run, contact us.

14. Changes to This Policy

We may update this Privacy Policy as the Service evolves.

If a change materially affects how we handle personal information, we will provide reasonable notice where required by law.

The effective date at the top of this page shows when the current policy applies.

15. Privacy Contact and Operator Information

Personal information handling business operator: [SERVICE OPERATOR NAME]

Address: [OPERATOR ADDRESS]

If the operator is a corporation, representative: [REPRESENTATIVE NAME]

Privacy and disclosure requests: Contact us

Information about procedures for disclosure, correction, suspension of use, deletion, and related requests should be available through the contact channel above.

Related policies: Terms, Acceptable Use, Security, and IP Policy.