Privacy Policy

What data hosted Open Artifacts and this website collect, why, and how long we keep it.

Last updated November 14, 2026

This policy explains what Leo Urbina Consulting LLC (“we”, “us”) collects when you use:

• Hosted Open Artifacts, at open-artifacts.app and its subdomains (“the Service”); and
• this website, open-artifacts.com.

Self-hosted instances aren’t covered. If you run Open Artifacts in your own Cloudflare account, the data stays in that account and you’re the one responsible for it. If you use an instance someone else runs, ask its operator; their policy applies.

Who decides. On the Service, each organization’s workspace (an “instance”) belongs to its owner. The owner and admins decide who’s a member and what’s shared, and we process the instance’s content and member data to run the Service for them.

• For each organization’s content and member data, we’re a processor: we act for the instance’s owner, on their instructions.
• For account, login and billing data, we’re a controller: we decide how it’s used, as this policy describes.

A data processing agreement is available on request at privacy@open-artifacts.com.

What we collect

Your account

• Your email address and name, from Google login or from the email you enter for a login code. You can set a separate display name.
• From Google login, your Google account id and your Google Workspace domain. We don’t read or keep your profile picture.
• Your role (owner, admin, member or guest), your status, and when you joined and were last active.
• For login codes, we keep only a one-way hash of your email and of the code, never the code itself, and codes expire after 10 minutes.

We store no passwords.

What you and your agents publish

• The files of every artifact and every version of it, uploads, and thumbnail images of artifacts.
• Each artifact’s title, description and text, so you can search it. Search covers only artifacts you can open.
• Who published each version, and the name of the AI agent that published it.
• Sharing: the email addresses you share with, and their roles.
• Live data that viewers write in live pages, with the writer’s account id, or an anonymous id for viewers who aren’t logged in. We don’t store their IP address with it.

Connected AI agents and tokens

When you connect an AI agent, we keep:

• the name it registered with, and the version it reports;
• whether it runs on a computer or as a hosted service, and that service’s host name;
• the browser family and operating system family you approved it from (for example “Chrome on macOS”);
• when it was last used, how many versions it published, and any label you give it.

We don’t keep your IP address or full browser details for this. For personal access tokens we keep a label and a one-way hash, never the token itself.

Activity records

• An audit log of changes to the instance: who did what (for example, changed a role or a space), recorded with account ids.
• Service logs for running and fixing the Service. They contain ids and event types. We remove email addresses, links and tokens from error messages, and we don’t log IP addresses.
• To limit abuse, we count login code requests per email and per network. These counters use one-way hashes, and they’re deleted after a day.

Billing

Payments are processed by Stripe. You type your card, billing email and address into Stripe’s own checkout, so Stripe holds them and we never see your card. On our side we keep your plan and its dates, the ids Stripe gives us for your account and subscription, which accounts counted as creators each month (as internal ids, not names or emails), and whether each invoice was paid.

Setup events

To see whether new accounts get set up, we record the first time each of these happens on a hosted instance: you sign up, an agent connects, you name it, a first page is published, an agent replies to a mention, and you answer an ask. Our servers send each event to PostHog with the instance’s id, its plan and the time. We don’t send what you publish, what you write in comments, your name or your email address. No tracking script runs in your browser.

Cookies and browser storage

The Service uses only cookies it needs to work. All are HttpOnly, Secure and SameSite=Lax:

The Service also keeps a few things in your browser’s local storage: an anonymous id, so live pages can tell your edits apart if you aren’t logged in, and display preferences such as the theme. Artifacts are served from a separate host that sets no cookies.

This website (open-artifacts.com) sets no cookies and has no analytics or tracking beacon.

Google user data

This section describes how we use data from Google APIs.

Open Artifacts’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Google

• What we ask for: the openid, email and profile scopes.
• What we use: your Google account id, your email address (only if Google has verified it), your name, and your Google Workspace domain.
• Why: to sign you in, to check that you belong to the organization’s domain, and to show your name to people you work with.
• How it’s stored: in the instance’s database on Cloudflare, described below. We use Google’s ID token once, to sign you in, and don’t keep it. We don’t keep any Google access token or refresh token for login.

Google Workspace directory (only if your organization connects it)

An admin who is a Google Workspace super admin can connect the organization’s directory, so membership follows Google. Nothing is read from the directory before they connect it and confirm.

• What we ask for: read-only access, through these scopes:
  • admin.directory.user.readonly: each user’s id, primary email, whether they’re suspended or an admin, and the organization’s customer id;
  • admin.directory.group.readonly: groups’ ids, emails, names and member counts, and each group’s members (id, email and type);
  • admin.directory.domain.readonly: used once, when the directory is connected, to confirm the connecting admin’s domain is a verified domain of their Google organization. Nothing from it is stored;
  • admin.reports.audit.readonly: to notice user and group changes within minutes, such as someone suspended or added to a group. Nothing from it is stored;
  • plus openid and email, to confirm who connected it.
• Why: to add and remove members, keep their access in step with Google groups, and remove access when someone leaves.
• What we store: which Google user each member is, their status, group ids and emails, group memberships, the customer id and domain, and who connected the directory and when.
• How often: we check for changes every 2 minutes and do a full check every hour.
• The refresh token: encrypted (AES-GCM) with a key only that instance holds, and stored in the instance’s database.
• We never change anything in Google. Every scope is read-only.
• Disconnecting: the owner can choose Disconnect in Settings, Directory, while logged in themselves (not through a token or an AI agent). That revokes our access at Google and deletes the stored token, and we email the owner to confirm. Members stay, and are managed in Open Artifacts from then on. Deleting the instance also revokes our access at Google. You can also remove Open Artifacts at any time in your Google Admin console, under Security, API controls.

What we never do with Google data

We don’t sell Google user data. We don’t use it for advertising, and we don’t use it to develop, improve or train AI or machine learning models. We don’t transfer it to anyone except as needed to run the Service (to the providers listed below), to comply with the law, or with your organization’s permission. People at Leo Urbina Consulting LLC don’t read it, except with your permission, for security or abuse investigations, or when the law requires.

How we use your data

We use data only to:

• run the Service: sign you in, store, show, share and search your artifacts, and run live pages;
• send the emails the Service needs: login codes, invitations, share notices, and directory alerts. An invitation or share email includes the sender’s name and the artifact’s title, and replies go to the sender;
• keep the Service secure: limit abuse, investigate problems, and keep the audit log;
• comply with the law.

We don’t sell your data, show ads, or use your content to train AI models. The Service doesn’t send your content to any AI model.

AI agents you connect. A connected agent acts as you, and can read what your account can read. What it reads goes to that agent and its model provider, under their terms and privacy policy, not ours.

Where it’s stored, and who processes it

Everything is stored with Cloudflare, on its global network: the database (D1), files (R2), key-value storage (KV) and live data (Durable Objects). Each instance has its own database and storage. We don’t choose a region; Cloudflare places the data.

The providers that process data for us:

Fonts are served by us, not by a third party.

How long we keep it

Removing people, and deleting an instance

• When someone is removed from an instance, by an admin or because they left the Google directory, their access ends at once, their tokens and agents are revoked, and they’re logged out. Their name and email stay in the instance’s member list, marked as removed, so work they published still shows who made it. If they were removed because they left the Google directory, their email is replaced with a placeholder. Their past live-data edits stay, with their account id. The removed record is kept while the instance exists, and is deleted with it.
• When an owner deletes an instance, we delete its artifacts, files, members, settings and database, and revoke our access to its Google directory. We delete the owner’s email 30 days after an instance is deleted. We keep the instance’s former address reserved so it can’t be reused by someone else.

Your choices and rights

• You can see and change your name in your profile, and delete your artifacts at any time.
• Your organization’s owner and admins can remove members and revoke agents and tokens. The owner can also disconnect the directory and delete the instance.
• Wherever you live, you can ask us to access, correct, delete or export your data, or object to how we use it. Email privacy@open-artifacts.com. If your account belongs to an organization, we may need to involve its owner. We reply within 30 days.
• These rights include those under the GDPR (EU), the UK GDPR (United Kingdom) and the CCPA (California). If you’re in the EU or the UK, you can also complain to your local data protection supervisory authority. Under the CCPA, we don’t sell or share your personal information, and we won’t treat you differently for using your rights.
• You can revoke Open Artifacts’ access to your Google account at myaccount.google.com/permissions.

Children

The Service isn’t meant for anyone under 16, and we don’t knowingly collect their data.

Security

Artifacts run in a sandbox on a separate host, so they can’t read your session or the dashboard. Login sessions are signed and expire, tokens and codes are stored only as hashes, and the Google directory token is encrypted. Our security model has the details.

Changes

If we change this policy in a way that matters, we’ll tell instance owners by email or in the app at least 30 days before it takes effect. The date at the top shows the latest version.

Contact

Leo Urbina Consulting LLC, 8913 Bar K Ranch Road, Leander, Texas 78645, USA.

• Privacy: privacy@open-artifacts.com
• Security: security@open-artifacts.com
• Anything else: hello@open-artifacts.com