Privacy Policy

• Name, email address, and email verification status.
• Profile image, if you upload one or import it from an OAuth provider.
• Authentication credentials: magic-link email tokens, OAuth account identifiers (Google), and account session tokens.
• Account state, role, and access grants.

• Stripe customer and subscription identifiers, plan tier, billing cycle, renewal date, and cancellation flags.
• Invoice records, including amount, status, and a link to the invoice hosted by Stripe.
• Usage summaries: monthly totals of AI usage, turn counts, and budgets against your plan’s limits.

We do not collect or store your full payment card details. Stripe collects and processes payment data directly; we only receive tokenized references and metadata.

• Projects, files, and documents you create — including their full content (text, HTML, and ProseMirror JSON), version history, titles, and folder structure.
• Conversations with the AI, including your prompts, uploaded context, intermediate model responses, and final outputs.
• Margin notes and annotations, including references to files and conversations.
• Files you upload, including extracted metadata (word count, summaries, key points) used to make them searchable within the Service.
• Saved prompts and writing samples you choose to store.

To tailor outputs to your individual style, the Service may extract and store the following from writing samples you provide or content you create within Akston:

• Voice profile: signature patterns, vocabulary notes, tone indicators, topics, and audience characteristics derived from your writing.
• Philosophical profile: observations and synthesized themes drawn from your writing samples.
• Preferences you configure: experience level, typical writing types, target audiences, and publication outlets.

This personalization is isolated to your account and not shared with or used for the benefit of other users. You can reset or delete it at any time from your account settings.

• Activity events: which features you use, when, and in connection with which project or file. We use these to operate the Service, investigate issues, and improve reliability.
• Session identifiers, request identifiers, and timestamps.
• Device and browser information: IP address, user-agent string, device type, operating system, language, and timezone.
• Error and performance data reported through our monitoring tools.
• Onboarding and last-active timestamps (for re-engagement and account-health signals).

If you use dictation, we send your audio to a third-party speech-to-text provider (see § 6) for transcription. The resulting transcript is stored in your workspace; raw audio is retained only transiently as required to produce the transcript.

If you email us for support, feedback, or other reasons, we retain the content of that correspondence along with your email address so we can respond and follow up.

If you connect a third-party integration (such as Google Drive, X, or Substack), we store the OAuth tokens needed to access that integration and metadata about the content you choose to import, export, or publish through it. We do not access the integration beyond the scopes you authorize and the specific actions you initiate.

When you choose Google sign-in or connect Google Drive and Google Docs, we access Google user data only after you grant permission and only for the user-facing features you initiate.

• Data accessed. For Google sign-in, we receive your Google account identifier, name, email address, and profile image. For Google Drive and Google Docs, we request the following scopes: openid, profile, email, https://www.googleapis.com/auth/drive.readonly, and https://www.googleapis.com/auth/documents.readonly. With those scopes, we may access OAuth access tokens and refresh tokens; token-expiration and scope metadata; Drive file metadata needed to show file pickers, search results, or recent files (such as file ID, name, MIME type, modified time, owner display names and email addresses, icon link, web view link, and parent folders); file permissions and metadata when you ask the agent to inspect them; and the content of the specific Google Docs, DOCX, or PDF files you select or ask the agent to read. For Google Docs imports, this can include document text, structure, tabs, images, suggestions, comments, quoted comment text, replies, authors, and timestamps.
• Data usage. We use Google sign-in data to authenticate you and connect your account to the Service. We use Google Drive and Google Docs data to display files you can choose from, import selected files into Akston, preserve selected document formatting, images, comments, and suggestions, and let the agent search, read, download, or inspect Drive files only when you ask it to use your connected Drive. The Google Drive integration is read-only; Akston does not create, modify, or delete files in your Google Drive. We do not use Google user data to train or improve generalized AI or machine-learning models, and we do not use it for advertising.
• Data sharing. We do not sell Google user data, share it for advertising, or transfer it to data brokers or information resellers. We send requests to Google APIs and Google’s Drive MCP endpoint to perform the read-only actions you initiate. If you import Google content into Akston and later ask an AI feature to process that imported content, the relevant selected content may be routed to the model providers described in § 4 and § 6; Google OAuth tokens are not shared with model providers. We may also process Google user data with the infrastructure, database, monitoring, and security subprocessors described in § 6, strictly to provide and protect the Service.
• Storage and protection. Google OAuth tokens are stored in our integration-token database, not in browser session tokens, and are encrypted at rest using AES-256-GCM. Google user data is transmitted over TLS, access is limited by account permissions and least-privilege operational controls, and decrypted tokens are not returned through customer-facing GraphQL APIs. We do not allow employees or contractors to read Google file content except when you ask us for support involving specific content, when necessary for security or abuse investigation, or when required by law.
• Retention and deletion. We retain Google OAuth tokens while the integration remains connected. You can disconnect Google Drive and Google Docs at any time from account settings; disconnecting revokes the Google tokens where supported and deletes our stored integration-token record, which stops further access. Copies of Google content that you import into Akston are retained as workspace content under § 7 until you delete them, delete your account, or request deletion by emailing team@akston.ai.

If you join the waitlist, we collect your email address and any information you submit in the waitlist form. If you visit the marketing site, we collect standard server logs (IP address, user-agent, referrer, timestamps).

We rely on a small number of vendors to operate the Service. Each acts under a contract that requires them to protect your data, use it only to provide their services to us, and comply with applicable law. See § 6 for the current list.

When you connect an integration (Google Drive, X, Substack, or similar) or use an export, sharing, or publish feature, we share the specific content you select with that destination. You control what to share and when.

We may disclose data when we reasonably believe it is necessary to (a) comply with applicable law or legal process, (b) enforce our Terms of Service, (c) investigate fraud, abuse, or security incidents, or (d) protect the rights, property, or safety of Akston, our users, or the public. We will give you notice of legal requests for your data unless the request prohibits us from doing so or we believe giving notice would be harmful.

If Akston is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred to the successor or acquirer. Any successor must honor this Privacy Policy or give you reasonable notice and the opportunity to delete your data before any materially different policy applies.

We may share aggregated or de-identified data that cannot reasonably be used to re-identify you — for example, overall usage statistics or model performance benchmarks. We will not attempt to re-identify such data.

We retain your account and workspace data for as long as your account is active so you can continue to use the Service. You can delete individual projects, files, conversations, or your entire account from your settings at any time.

If you cancel your subscription or we cancel it for non-payment, paid features remain available through the end of the billing period. After that, your account stays active with basic access. You can continue to view and edit existing projects and access projects shared with you according to your collaboration permissions, but paid AI features are unavailable.

We retain projects you own for at least 90 days after paid access ends. After that, we may delete those projects and their User Content from our live systems. Projects owned by other users are not deleted merely because your subscription ended. You are responsible for exporting anything you want to keep.

Deleted data may remain in encrypted backups for a limited period (typically up to 35 days) before being overwritten in the ordinary course. Backups are not used for any purpose other than disaster recovery.

We retain the following beyond account deletion to the extent required by law or necessary for legitimate business purposes:

• Billing and tax records, for the period required by applicable law (typically seven years in the United States).
• Records necessary to enforce our agreements, defend against legal claims, or respond to subpoenas.
• Abuse-prevention records (such as terminated-account identifiers) for as long as needed to prevent re-abuse.

To delete your account and associated data outside of the normal flow, email team@akston.ai with “Account deletion” in the subject line. We will verify the request and confirm when deletion is complete.

You can access and export your workspace content at any time from the Service. You can delete projects, files, and your account from your settings. If you cannot accomplish something through the Service, email team@akston.ai.

You can update your name, email, and other account details in your settings. Contact us if you need help correcting data you cannot edit directly.

You can unsubscribe from product updates and marketing emails at any time using the unsubscribe link in those emails or in your account settings. We will continue to send you essential transactional emails (billing, security, policy changes) for as long as you have an account.

If you enable browser push notifications, you can disable them in your browser settings or in the Service’s notification settings.

You can disconnect any third-party integration at any time from your account settings. Disconnecting revokes our stored OAuth tokens and stops further data exchange with that service.

You can reset the voice and personalization data described in § 1 from your account settings, or delete specific writing samples individually.

In the last 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act (CCPA/CPRA):

• Identifiers: name, email, account identifier, IP address, device identifier.
• Commercial information: subscription and billing records.
• Internet or network activity: pages visited, features used, session data, referral URLs.
• Audio data: dictation recordings you submit for transcription.
• Professional information that you voluntarily provide (e.g., experience level, writing types, audiences).
• Inferences: personalization profiles (voice, style, preferences) derived from content you provide.
• User content: writing, documents, and conversations you create in the Service.

We collect this information for the purposes described in § 2 and share it with the categories of recipients described in § 5 and § 6.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

You have the right to:

• Know what personal information we have collected about you, why, and with whom we have shared it.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (not applicable to us — see above).
• Limit our use of sensitive personal information (not applicable — we do not use sensitive personal information for purposes that require this right).
• Non-discrimination: we will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised your rights.

Email team@akston.ai with “California privacy request” in the subject line and tell us which right you want to exercise. We will verify your identity (usually by confirming you control the email on file) and respond within the timeframes required by law (typically 45 days, with a possible 45-day extension). An authorized agent may submit a request on your behalf with your written authorization.

California Civil Code § 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Some browsers send a “Do Not Track” (DNT) signal. There is currently no industry standard for responding to DNT signals, and we do not alter our data practices based on them. We do not permit third parties to collect personally identifiable information about your activity on the Site over time and across third-party websites.

We use a small set of cookies and similar technologies that are strictly necessary to operate the Service:

• Authentication cookies that keep you signed in.
• Session and security cookies used to route requests and protect against fraud.
• Preference cookies that remember things like your theme.

We do not use third-party advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; doing so may prevent you from signing in or using the Service.