Octyl Privacy Policy

Effective date: 3 November 2026 · Version: privacy-2026-11-03

We follow the CCPA for everyone. Whatever state or country you live in, you have the rights the California Consumer Privacy Act (as amended by the CPRA) gives California residents. Section 6 lists each right and exactly how to use it.

The short version

A plain-language summary of how Octyl handles your data. It is not a substitute for the full text below; where they differ, the full text controls. octyl privacy prints the same summary.

• Your code stays yours. Octyl never receives your code, prompts, or file or repo names. Your AI tools talk to their makers directly.
• Receipts say how a run went: model and version, runtime, settings, public extensions, type of work, time, cost, outcome. See the next one before it’s sent: octyl contribute show --next. Everything sent, byte for byte: octyl contribute log.
• Contributing receipts is how Octyl works, on every plan. Every run’s receipt goes to the Reef, linked on our side to a random contributor ID, never your name, email, team or company, and used only to delete your contributions, handle concerns and catch attempts to skew results.
• The Reef is open evaluations. Weekly public results, only for groups of 20+ people and 20+ runs, never attributed to a person, team or organization. We don’t license Reef data today. If we ever do, it will be deidentified aggregates only, and we’ll tell you first.
• You’re in control. Something in a receipt identifies you? octyl contribute report holds it out of the Reef at once, and we reply within 5 business days. Erase: octyl contribute delete removes your receipts from Octyl (raw upload copies expire within 90 days); results already published in the Reef stay, since they’re group totals never tied to you. A copy: octyl contribute export.
• Otherwise, just your account: name, username, email and phone number. Telemetry and crash reports are off until octyl telemetry on, and Octyl turns off your AI tools’ own usage reporting where they offer a way. The web app logs usage and errors. Debugging needs your OK: one issue at a time, deleted within 30 days, never used for the Reef or training.
• Teams: chatter is references, never code; file, branch and agent names are scrambled, notes sealed. The relay sees commit SHAs and line numbers for about 10 minutes. Messages between teammates, and between your phone and computer, are end-to-end encrypted and the relay can’t read them; teammates’ messages wait sealed up to 7 days for devices that are offline. The team trial and referral seats need an ID check by Stripe; we keep only the result, never your ID or photo.
• Your privacy rights: we follow the CCPA for everyone, wherever you live. California: see our Notice of Financial Incentive.

The full text follows.

Octyl Labs, Inc., a Delaware corporation (“Octyl”, “we”) decides how and why the personal data described here is used (we are its “controller”). Contact: privacy@octyl.ai (section 12).

1. Overview

• The octyl program runs on your machine. You need an Octyl account to start agents (only the demo runs signed out). We use the account to unlock your agents, to connect you with teammates, and to receive the short receipt octyl sends after each run. Signed out, octyl sends us nothing except update checks and downloads.
• Your code, prompts, diffs, file paths, repository and branch names and terminal output never go to Octyl through octyl.
• We never collect, store or relay your AI tool credentials (Claude, ChatGPT/Codex, Gemini and others). You sign in to those tools yourself, and they talk to their makers directly.
• Contributing receipts is how Octyl works, on every plan (Free, Pilot, Pro, Team and Enterprise). A receipt says how a run went (model, settings, type of work, time, cost, outcome; never code) and is linked on our side to a keyed pseudonym of your account, never your name, email, team or company. We publish only aggregated results for groups of at least 20 people and 20 runs, never attributed to anyone. We don’t license Reef data today. If we ever do, it will be deidentified aggregates only, and we’ll tell you first.
• Octyl turns off your AI tools’ own telemetry. For every crew member it runs, octyl turns off that AI tool’s own telemetry and usage reporting where the tool offers a way (for example Claude Code’s and Codex’s usage and error reporting, and Gemini CLI’s usage statistics), and sets DO_NOT_TRACK=1 for it. Some tools offer no such setting; their makers’ own policies apply to what those tools send.
• Octyl’s own telemetry and crash reports are off unless you are signed in and turn them on (octyl telemetry on).
• The team relay sees scrambled names and sealed text, not your code.

2. What we collect, by product

2.1 The octyl program

Crash reports are kept on your machine (~/.octyl/crash/) either way. Before storing one, our server replaces home folders with ~, email addresses with [email] and anything that looks like a credential with [redacted].

Turning telemetry off. octyl telemetry off stops sending and discards queued events; OCTYL_TELEMETRY=0 blocks telemetry and crash uploads whatever your setting says. Octyl itself does not read DO_NOT_TRACK: it sets it for the AI tools it runs (section 1).

What octyl does locally (not sent to us). It starts the AI tools you installed, creates git worktrees, and keeps your receipts, a local outcome record (commit SHAs and paths, never uploaded) and local knowledge under ~/.octyl.

Your AI tools. Each agent you run talks to its maker under that maker’s privacy policy. Octyl is not a party to that traffic and does not see it.

2.2 octyl.ai

• Our network provider (Cloudflare) logs requests: IP address, user agent, page requested, time.
• octyl.ai uses no analytics and sets no cookies.
• If you join the waitlist or email us: your email address and what you send.

2.3 Web app (app.octyl.ai)

• Your account (held by Clerk): your name, username, email address and phone number, which you confirm with a code each when you create the account, and how you sign in (GitHub, Google or a passkey). Clerk also keeps the password you set; Octyl never sees it. We use your email and phone number to run your account, keep it secure and check that someone joining a team through an invite is a real person (section 2.7). We don’t send marketing texts.
• Settings and teams: your settings and team memberships; billing records (through Stripe) once paid plans open.
• Product analytics (PostHog): which pages and features you use in the web app, linked to your account, using a cookie and browser storage.
• Cookies: cookies needed for sign-in, and PostHog’s analytics cookie.
• Error reports: for accounts we turn it on for, the web app also sends browser errors, failed requests and the pages visited (never page content) to Octyl’s own servers, where support can read them. Today it is on only for Octyl’s own staff accounts; we will not turn it on for your account without your OK under section 2.6.

2.4 Octyl on your phone

• Pairing. You pair a phone by scanning a code from octyl pair with the phone’s camera, or by pasting it. The camera image is processed on the phone and never uploaded.
• Keys on your phone. The phone creates its own signing key and keeps it, with the pairing keys, in the browser storage on the phone.
• What the phone receives: status updates for your own agents only (agent, state, time, and optionally branch), sealed with a key the relay does not hold.
• What the phone sends: approve or deny decisions and short answers (up to 280 characters), signed by the phone’s key and delivered only to your own octyl.
• Notifications (if you turn them on): your browser’s push service (Web Push) gives us a subscription address. Notifications carry no message text; the phone fetches the sealed update itself.
• No ads and no tracking tools.

2.5 Team relay

When you join a team, octyl sends small coordination messages (“I am editing these lines”) through a relay on Cloudflare.

• What it carries: team, member and agent identifiers; timing; branch names; commit SHAs; line numbers; and scrambled names (keyed hashes, HMAC-SHA256 with a team key) of the repository, file paths and symbols. Notes can be sealed with a key derived from the team key.
• What it never carries: file contents, diffs or prompts. Messages are capped at 4 KiB and content fields are rejected.
• The relay never holds the team key, so it cannot reverse the scrambled names or open sealed notes.
• What the relay can still learn: team and member ids, timing, branch names, commit SHAs, line numbers, how many distinct names appear, and any note you send unsealed.
• Retention: only the latest message per agent, up to 512 per team, each expiring after 10 minutes.
• Messages between teammates are end-to-end encrypted. The relay keeps each one sealed for up to 7 days for a device that is offline (up to 500 per device) and cannot read it.

2.6 Debugging and support data

Beyond what sections 2.1 to 2.5 describe, we collect diagnostic data (for example logs, a local receipt, agent session logs, configuration, or access to a repository) only when you explicitly approve it for one specific issue, after we tell you what we will collect and why. Each approval covers that issue and the data listed in the request only. We delete the data when the issue is resolved or within 30 days, whichever comes first, unless you ask us in writing to keep it longer for that issue or the law requires us to keep it. We never use it for the Reef or to train AI models. We log each request, what was collected, who at Octyl accessed it and when it was deleted, and send you that log on request to privacy@octyl.ai. You can withdraw an approval at any time. Lawful basis: consent. See Terms of Service section 5.4.

If you email support, our support mailbox keeps your message for 90 days.

2.7 Identity checks (team trial and referral seats)

You never need an identity check to use Octyl. You need one only to start the 30-day team trial, for someone you invited to count toward a referral seat, and for your earned referral seats to count. To join a team through an invite you need a confirmed email address and phone number on your account.

• Who checks: Stripe Identity (Stripe, Inc.) checks a government ID and a selfie on a page Stripe hosts. Stripe handles those images and details under its own privacy policy and its agreement with us.
• What Octyl keeps: the result (verified, needs another try, under review), when it changed, Stripe’s session id, the country that issued the ID, and two scrambled fingerprints (keyed hashes): one of your name with date of birth, one of the ID number. We use the fingerprints only to spot one person behind two accounts.
• What Octyl never keeps: the ID image, the selfie, the ID number, your date of birth or the name on the ID. We read the details we need for the fingerprints from Stripe once, compute the fingerprints and drop the details; they are never written to our database or logs.
• Why: to stop abuse of free team seats (one trial per person, one referral per person, no referring yourself). Lawful basis: legitimate interests in preventing fraud; Stripe asks for your consent to the selfie check before it starts.
• If we find a duplicate: the referral it produced is reversed and a person at Octyl reviews it. Write to privacy@octyl.ai to contest it.

3. Receipts in detail

The Receipt Terms (section 3) list every field. In summary: identifiers and versions; the AI tool, model and settings; public extensions by registry id and a count of the others; hardware class for models you run yourself; the type of work; start and end time, duration, exit status; whether commits were made and how many; token counts and estimated cost; size buckets; and later, outcome updates (whether the work landed, was reverted or rewritten, and how many later commits touched the same files).

Never code, diffs, prompts, task text, commit messages, file names or paths, repository or branch names, commit SHAs, terminal output, environment variables or secrets.

Pseudonymous, not anonymous. We store your receipts under a keyed pseudonym of your account (a one-way code made with a secret key), never your name, email, team or company. Only Octyl can link it to your account, and we use that link only to delete your contributions when you ask, handle a concern you report and match outcome updates to their receipt. Receipts stop being linkable to you only once they are combined into published results.

You can always see exactly what was sent. Every byte octyl sent is in a local, append-only log on your machine (octyl contribute log, octyl contribute export). Signed in at app.octyl.ai/reef you can read your most recent receipts exactly as we store them. For everything we hold, write to privacy@octyl.ai.

Report a concern. If anything in a receipt could identify you, your team or your employer, report it (octyl contribute report <receipt-id>, or the button next to the receipt at app.octyl.ai/reef). From the moment the report is stored, that receipt is held out of the Reef. We record the receipt id and the field you point to (never copying the value anywhere new), a person reviews it and answers within 5 business days, and you can follow the status (received, reviewing, scrubbed or no issue found). A scrub removes or redacts the field in the stored receipt and in the next Reef release, and is recorded in an audit log.

4. How we use and share data

• To run Octyl: sign-in, plans, the relay, support, security and abuse prevention.
• To improve Octyl: crash reports and usage events (if you turned them on), receipts, and web app analytics.
• The Reef: published only for groups of at least 20 people and 20 runs, with coarser categories when a group is too small; never attributed to a person, team or organization, and never individual records, contributor IDs, account ids, emails or receipt ids. Published results are frozen: deleting receipts later does not change them.
• No licensing. We don’t license Reef data today. If we ever do, it will be deidentified aggregates only, and we’ll tell you first.
• Service providers (section 8), under contracts that limit their use of the data to providing their service to us.
• Legal and safety: when the law requires it, or to protect rights and safety.
• Business transfers: in a merger, acquisition or sale of assets, with notice to you.

We do not sell or share personal information, as the CCPA defines those words, and we do not use it for cross-context behavioral advertising. Contributing a receipt is not a sale: it is part of how Octyl works (see the Notice of Financial Incentive, section 6A). The Reef contains only deidentified aggregate information.

5. Retention

6. Your rights

We follow the CCPA for everyone. Whatever state or country you live in, you have the rights below. Where the GDPR or UK GDPR applies you also have the rights to restrict processing, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time (without affecting earlier processing). We honour an objection to receipt processing by deleting your receipts and leaving them out of future results; because contributing receipts is part of every plan, new runs keep producing receipts while you use Octyl.

We confirm a request within 10 business days and answer within 45 days (we may extend once by 45 days, and will tell you why). We answer a receipt concern within 5 business days. We may need to confirm your identity first, usually by a message to your account email. An authorized agent may make a request for you with your signed permission. You can also complain to your data protection authority.

6A. Notice of Financial Incentive

Summary. Octyl is offered in exchange for contributing receipts. On every plan, after each agent run, octyl sends Octyl a short receipt about that run. The Free plan (up to 12 agents at once) and the Pilot (up to 12 agents and teams of up to 3, by invitation) cost nothing; paid plans, when offered, add more agents and team features. Every plan contributes receipts, so no price or level of service depends on whether you contribute.

Personal information involved. The receipt fields in section 3: random receipt id, a pseudonym of your account, versions, the AI tool, model and settings, the type of work, times and duration, exit status, commit counts, token counts and estimated cost, size buckets, top languages, and later outcome updates. Never code, prompts, file or repository names, paths, branch names or secrets.

How you opt in. By accepting the Receipt Terms when octyl login shows them (type “yes”). Before you do, octyl contribute show --next shows the exact receipt your next run would send.

How you withdraw, at any time. Start no agents (nothing is sent while you don’t), delete what was sent (octyl contribute delete), or delete your account. Agents already running keep running.

Good-faith estimate of the value of your data. About US$0.02 per member per month.

How we calculated it. We used the expense method allowed by the CCPA regulations: our cost of providing the online services a member uses (sign-in, plan checks, receipt intake, the team relay and email), from our infrastructure cost model, which comes to about US$0.01 to US$0.02 per monthly user at 10,000 to 1,000,000 users; we took the higher figure. Octyl earns no revenue from receipts (no ads, no licensing), so a revenue-based method gives zero.

7. International transfers

Octyl is based in the US and processes data in the US (Amazon Web Services in us-east-1, Cloudflare’s global network). If you use Octyl from outside the US, you send your data to us in the US. Our service providers’ data processing terms include the EU Standard Contractual Clauses and the UK Addendum where they apply.

8. Service providers (subprocessors)

AI tool makers (Anthropic, OpenAI, Google, xAI and others) are not our service providers: you deal with them directly, and Octyl never sends them data on your behalf.

9. Security

TLS in transit; secrets encrypted with a managed key service; short-lived signed tokens for the relay; server-side checks that reject receipts with fields that aren’t allowed; scrubbing of crash reports. No system is perfectly secure; tell us about issues at security@octyl.ai.

10. Children

Octyl is not directed to children and requires users to be at least 18. We do not knowingly collect personal information from anyone under 18. If you think a child has given us data, write to privacy@octyl.ai and we will delete it.

11. Changes

We post changes here and give at least 30 days’ notice of material changes by email or in the Product. A change to the Receipt Terms asks you to accept the new version before new agents start.

12. Contact

Octyl Labs, Inc. · privacy@octyl.ai · legal@octyl.ai