Privacy Policy

• Name, email address, and email verification status.
• Profile image, if you upload one or import it from an OAuth provider.
• Authentication credentials: magic-link email tokens, OAuth account identifiers (Google), and account session tokens.
• Account state, role, and access grants.

• Stripe customer and subscription identifiers, plan tier, billing cycle, renewal date, and cancellation flags.
• Invoice records, including amount, status, and a link to the invoice hosted by Stripe.
• Usage summaries: monthly totals of AI usage, turn counts, and budgets against your plan’s limits.

We do not collect or store your full payment card details. Stripe collects and processes payment data directly; we only receive tokenized references and metadata.

• Projects, files, and documents you create — including their full content (text, HTML, and ProseMirror JSON), version history, titles, and folder structure.
• Conversations with the AI, including your prompts, uploaded context, intermediate model responses, and final outputs.
• Margin notes and annotations, including references to files and conversations.
• Files you upload, including extracted metadata (word count, summaries, key points) used to make them searchable within the Service.
• Saved prompts and writing samples you choose to store.

We keep personalization data — preferences you configure and information derived from your writing and your use of the Service — to personalize the Service for you. Your personalization data is never shared with other users and never used in identifiable form outside your account. When it informs how we evaluate and improve the Service, we use it only in de-identified form that cannot reasonably be linked back to you. You can reset or delete it at any time from your account settings.

• Activity events: which features you use, when, and in connection with which project or file. We use these to operate the Service, investigate issues, and improve reliability.
• Session identifiers, request identifiers, and timestamps.
• Device and browser information: IP address, user-agent string, device type, operating system, language, and timezone.
• Error and performance data reported through our monitoring tools.
• Onboarding and last-active timestamps (for re-engagement and account-health signals).

If you use dictation, we send your audio to a third-party speech-to-text provider (see § 6) for transcription. The resulting transcript is stored in your workspace; raw audio is retained only transiently as required to produce the transcript.

If you email us for support, feedback, or other reasons, we retain the content of that correspondence along with your email address so we can respond and follow up.

If you connect a third-party integration, we store the OAuth or API credentials needed to access it, information identifying the connected account, and metadata needed to operate the feature. Depending on the integration, Akston may import or synchronize content, publish content you select, analyze audience information, or let the AI search, read, create, or update content when you ask it to use a connected tool. We access each integration only within the scopes you authorize and for features you enable. Some enabled integrations perform scheduled synchronization rather than waiting for a separate action each time.

• Writing workflow. Google Drive and Notion can import or synchronize documents; Readwise, Zotero, and Mendeley can import research materials; and X can publish content you select.
• Audience and performance. You can provide a public YouTube channel or connect YouTube Analytics so Akston can analyze channel content and performance information and generate creator insights for your account.
• Agent tools. When you connect Slack, Linear, Asana, ClickUp, Notion, or Google Drive, the AI can search and read authorized content to complete your requests. Akston asks before the AI posts, creates, or updates content in a connected service.

When you connect Readwise, we use the access token you provide to import the books, articles, source metadata, highlights, locations, tags, and notes in your Readwise export. The token is encrypted at rest and is not returned to the browser after it is stored. Imported highlights become searchable Sources in your Akston workspace; imported notes remain annotations rather than source text. Later syncs request records updated since the last successful sync and include upstream deletions. Disconnecting stops future Readwise access but keeps the Sources, annotations, and citations already imported into Akston until you delete them or your account.

Substack stats via the browser extension are different: Akston does not store a Substack password or OAuth token. The extension reads your own publication’s stats in the browser using your existing Substack session and pushes metrics to Akston. See “Browser extension” below.

The official Akston browser extension is an optional companion that moves material you can already access in Chrome into your workspace. It has one purpose: read from a tab you already have open or a publication you administer, and write that material into your Akston account. It does not inject ads, rewrite pages, or record a browsing history while you move between sites.

• Page import (URL, title, and rendered content). When you click Import this page on the current tab, the extension reads that page’s canonical URL (without fragment or credentials), the page title, a cleaned clone of the rendered HTML (scripts, styles, frames, and embeds are stripped from the clone), the length of the visible text, any selected text, and a capture timestamp. This is a deliberate capture of the page you are looking at, not a server fetch of the public URL. Capture runs only on that explicit action. The extension downloads a bounded index of hashes for your saved Akston source URLs and hashes the current canonical URL locally to show whether it is already saved. It does not send Akston the URLs of pages you merely visit. For supported pages, the saved source may instead contain PDF bytes, a YouTube transcript with its title and channel, posts authored by the focal X-thread author, or a cleaned Substack article. The same explicit-save rule applies.
• Own-publication Substack stats. When you click Import your publication, the extension requests access to Substack, uses your existing signed-in browser session, and discovers every publication you own or administer. It immediately reads post information and performance data from those publications’ canonical Substack endpoints — post titles, public post URLs, views, likes, comments, shares, subscriber deltas, and related metrics — and writes them into your Akston performance log. We do not collect subscriber names, emails, mailing-list membership, or payment details from Substack. We do not import article text or read other people’s publications.
• Keeping that import current. After the first import, the extension re-reads the same data from the same endpoints when you open Akston or visit a connected publication. It does this through small scripts bundled in the extension and registered only on those publications’ Substack hosts and on akston.ai. Updates are limited to about once every six hours per publication, except when you click Sync now or open your publication’s own Substack stats page. The extension does not run these updates on a timer or open tabs to do them. Disconnecting Substack in the extension Options stops them and removes the extension’s Substack access.
• Tokens. Pairing mints a scoped Akston access token and a rotating refresh token. Both are stored only in chrome.storage.local on your device — never in chrome.storage.sync, never in a content-script message, and never in the page DOM. Access tokens are short-lived (typically about one hour). Refresh tokens last 90 days, rotate on every use, and are stored on our servers only as a hash. Disconnect sends a revoke request and deletes the local credentials even if the network call fails. Reuse of an already-rotated refresh token revokes the connection.
• Local queues. If a stats write cannot be delivered immediately, the extension may keep up to three payloads in chrome.storage.local for at most 48 hours. If a page save cannot be delivered, it may keep up to five requested captures, each at most about 1.5 MB, for at most 48 hours. During first-time pairing it may keep one pending capture for at most 30 minutes. A queued capture can include cleaned HTML or small PDF bytes. Items are removed after delivery, expiry, or explicit discard; queue status and retry controls remain available in the extension.
• Local saved-page index. The extension may keep up to 10,000 SHA-256 hashes of canonical saved-source URLs, together with opaque source and file identifiers, in chrome.storage.local. It refreshes this index after connection, browser startup, and confirmed saves. The current tab URL is hashed locally and is not sent to Akston merely because you visited the page. Disconnect or uninstall deletes the local index.
• Sharing with project collaborators. A saved page becomes a workspace source. If you file it into a project you share, or it is otherwise readable under that project’s permissions, selected collaborators can read the captured URL, title, and content. Stats land in your performance log and follow ordinary workspace access, not a separate public feed.
• Deletion. Disconnect in the extension Options page revokes the refresh token and clears local credentials, the publication connection, pending captures, and local queues. Uninstalling the extension deletes its local storage. It does not delete sources or stats already written to Akston — delete those files in the workspace, or delete your account (§ 7), or email team@akston.ai. Chrome site settings can also revoke the optional Substack host grant.

The extension transmits this data to Akston over HTTPS. We use it only to provide that single purpose and related operational needs (authentication, security, and reliability). Chrome Web Store Limited Use restrictions that apply to this extension are described in § 3.

When you connect Zotero or Mendeley, we access the library and collections you authorize and may import citation metadata, folders, PDFs or other attachments, annotations, and highlights as Sources in your Akston workspace. We store the credentials, account metadata, collection selections, and sync state needed to operate the import. Disconnecting stops future access but does not delete material already imported into Akston; you can delete those Sources or your account at any time.

Notion supports two features. You can link authorized Notion pages with Akston documents for synchronization, or allow the AI to search and read authorized pages and databases and, after confirmation, create or update content. We store the connected account information, credentials, page identifiers, and synchronization state needed for the features you enable.

If you provide a public YouTube channel, we process publicly available channel and video information. If you separately connect YouTube Analytics, we receive OAuth credentials, connected-account metadata, and private channel performance information available within the scopes you authorize. We use this information to generate and store creator insights and related performance summaries for your account.

When you choose Google sign-in or connect Google Drive and Google Docs, we access Google user data only after you grant permission and only for the user-facing features you initiate.

• Data accessed. For Google sign-in, we receive your Google account identifier, name, email address, and profile image. For Google Drive and Google Docs, we request the following scopes: openid, profile, email, https://www.googleapis.com/auth/drive.readonly, and https://www.googleapis.com/auth/documents.readonly. With those scopes, we may access OAuth access tokens and refresh tokens; token-expiration and scope metadata; Drive file metadata needed to show file pickers, search results, or recent files (such as file ID, name, MIME type, modified time, owner display names and email addresses, icon link, web view link, and parent folders); file permissions and metadata when you ask the agent to inspect them; and the content of the specific Google Docs, DOCX, or PDF files you select or ask the agent to read. For Google Docs imports, this can include document text, structure, tabs, images, suggestions, comments, quoted comment text, replies, authors, and timestamps.
• Data usage. We use Google sign-in data to authenticate you and connect your account to the Service. We use Google Drive and Google Docs data to display files you can choose from, import selected files into Akston, preserve selected document formatting, images, comments, and suggestions, and let the agent search, read, download, or inspect Drive files only when you ask it to use your connected Drive. The Google Drive integration is read-only; Akston does not create, modify, or delete files in your Google Drive. We do not use Google user data to train or improve generalized AI or machine-learning models, and we do not use it for advertising.
• Data sharing. We do not sell Google user data, share it for advertising, or transfer it to data brokers or information resellers. We send requests to Google APIs and Google’s Drive MCP endpoint to perform the read-only actions you initiate. If you import Google content into Akston as a source, Akston may route the relevant content to a model provider to generate the source overview automatically, and may later do so when you ask an AI feature to process that content. The relevant selected content may be routed to the model providers described in § 4 and § 6; Google OAuth tokens are not shared with model providers. We may also process Google user data with the infrastructure, database, monitoring, and security subprocessors described in § 6, strictly to provide and protect the Service.
• Storage and protection. Google OAuth tokens are stored in our integration-token database, not in browser session tokens, and are encrypted at rest using AES-256-GCM. Google user data is transmitted over TLS, access is limited by account permissions and least-privilege operational controls, and decrypted tokens are not returned through customer-facing GraphQL APIs. We do not allow employees or contractors to read Google file content except when you ask us for support involving specific content, when necessary for security or abuse investigation, or when required by law.
• Retention and deletion. We retain Google OAuth tokens while the integration remains connected. You can disconnect Google Drive and Google Docs at any time from account settings; disconnecting revokes the Google tokens where supported and deletes our stored integration-token record, which stops further access. Copies of Google content that you import into Akston are retained as workspace content under § 7 until you delete them, delete your account, or request deletion by emailing team@akston.ai.

If you join the waitlist, we collect your email address and any information you submit in the waitlist form. If you visit the marketing site, we collect standard server logs (IP address, user-agent, referrer, timestamps).

The official Akston browser extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We limit use of extension user data to the practices disclosed in this policy and to providing or improving the extension’s single purpose (importing a page you can already read, or your own Substack publication’s posts and performance, into your Akston workspace), including related operational purposes such as maintaining, securing, or measuring the reliability of those features. We do not sell extension user data; we do not use it for personalized advertising, credit, or lending; and we do not allow humans to read it except with your consent for a support request, when aggregated and anonymized for internal operations, when needed for security or abuse investigation, or to comply with law.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We may use your interactions with the Service created after September 1, 2026 — your conversations with the AI, including your prompts, the AI’s responses and working traces, and the context from your workspace that accompanies them — together with related usage data, to improve the Service, including to train, fine-tune, and evaluate the AI models that power it. The following limits always apply:

• Prospective only. We do not train on interactions created before September 1, 2026 unless you have separately granted us express permission covering that earlier content. Any such grant is recorded and applies only to the fixed period it describes.
• Opt-out. You can opt out at any time in your account settings (see § 8). Interactions from opted-out accounts are excluded from all future training runs.
• Exclusions. We never use Google user data (see § 1), dictation audio, content imported from connected integrations, content or metrics imported through the browser extension, or your personalization profiles as training data.
• Providers train nothing of their own. Where we use a provider’s fine-tuning service, the resulting model is exclusive to Akston; we contractually prohibit providers from using your content to train their own generalized models.
• Deletion. Unless the content is covered by an express permission grant, deleting content or your account removes it from future training runs. Models already trained are not retrained, but we do not retain deleted content in recoverable form in our training datasets.

We rely on a small number of vendors to operate the Service. Each acts under a contract that requires them to protect your data, use it only to provide their services to us, and comply with applicable law. See § 6 for the current list.

When you connect an integration, direct the AI to use a connected tool, or use an export, sharing, synchronization, or publish feature, we exchange the content and metadata needed to perform that function with the connected service. You control which services to connect and which features to enable. Some integrations continue scheduled synchronization after you enable it; you can stop future access by disconnecting the integration.

We may disclose data when we reasonably believe it is necessary to (a) comply with applicable law or legal process, (b) enforce our Terms of Service, (c) investigate fraud, abuse, or security incidents, or (d) protect the rights, property, or safety of Akston, our users, or the public. We will give you notice of legal requests for your data unless the request prohibits us from doing so or we believe giving notice would be harmful.

If Akston is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred to the successor or acquirer. Any successor must honor this Privacy Policy or give you reasonable notice and the opportunity to delete your data before any materially different policy applies.

We may share aggregated or de-identified data that cannot reasonably be used to re-identify you — for example, overall usage statistics or model performance benchmarks. We will not attempt to re-identify such data.

We retain your account and workspace data for as long as your account is active so you can continue to use the Service. You can delete individual projects, files, conversations, or your entire account from your settings at any time.

If you cancel your subscription or we cancel it for non-payment, paid features remain available through the end of the billing period. After that, your account stays active with basic access. You can continue to view and edit existing projects and access projects shared with you according to your collaboration permissions, but paid AI features are unavailable.

We retain projects you own for at least 90 days after paid access ends. After that, we may delete those projects and their User Content from our live systems. Projects owned by other users are not deleted merely because your subscription ended. You are responsible for exporting anything you want to keep.

Deleted data may remain in encrypted backups for a limited period (typically up to 35 days) before being overwritten in the ordinary course. Backups are not used for any purpose other than disaster recovery.

We retain the following beyond account deletion to the extent required by law or necessary for legitimate business purposes:

• Billing and tax records, for the period required by applicable law (typically seven years in the United States).
• Records necessary to enforce our agreements, defend against legal claims, or respond to subpoenas.
• Abuse-prevention records (such as terminated-account identifiers) for as long as needed to prevent re-abuse.

Extension access tokens are short-lived and are replaced on refresh. Hashed refresh tokens are kept until they expire (90 days, reset on rotation), until you disconnect the extension, or until we revoke the connection (for example after refresh-token reuse). The on-device stats queue holds at most three payloads for at most 48 hours. The offline page queue holds at most five captures of about 1.5 MB each for at most 48 hours, and first-time pairing may hold one pending capture for at most 30 minutes. Delivered pages are retained as workspace sources under the rules above until you delete them or your account.

To delete your account and associated data outside of the normal flow, email team@akston.ai with “Account deletion” in the subject line. We will verify the request and confirm when deletion is complete.

You can access and export your workspace content at any time from the Service. You can delete projects, files, and your account from your settings. If you cannot accomplish something through the Service, email team@akston.ai.

You can update your name, email, and other account details in your settings. Contact us if you need help correcting data you cannot edit directly.

You can unsubscribe from product updates and marketing emails at any time using the unsubscribe link in those emails or in your account settings. We will continue to send you essential transactional emails (billing, security, policy changes) for as long as you have an account.

If you enable browser push notifications, you can disable them in your browser settings or in the Service’s notification settings.

You can disconnect any third-party integration at any time from your account settings. Disconnecting revokes our stored OAuth tokens and stops further data exchange with that service.

In the extension Options page you can disconnect from Akston (revokes the pairing token and clears local credentials) and manage your connected Substack account. You can also remove the extension in Chrome, which deletes its local storage, or revoke the optional Substack host permission in Chrome site settings. Delete a saved page in the workspace to remove that capture from Akston.

You can reset the personalization data described in § 1 from your account settings, or delete specific writing samples individually.

You can opt out of the model training described in § 4 at any time from your account settings or by emailing team@akston.ai. Opting out takes effect immediately for future training runs and does not affect your access to any feature or the quality of AI outputs you receive. Opting out does not withdraw an express permission grant you have separately made; those grants are permanent by their terms.

In the last 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act (CCPA/CPRA):

• Identifiers: name, email, account identifier, IP address, device identifier.
• Commercial information: subscription and billing records.
• Internet or network activity: pages visited, features used, session data, referral URLs.
• Audio data: dictation recordings you submit for transcription.
• Professional information that you voluntarily provide (e.g., experience level, writing types, audiences).
• Inferences: personalization profiles (voice, style, preferences) derived from content you provide.
• User content: writing, documents, conversations you create in the Service, and pages or publication stats you send from the official browser extension.

We collect this information for the purposes described in § 2 and share it with the categories of recipients described in § 5 and § 6.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

You have the right to:

• Know what personal information we have collected about you, why, and with whom we have shared it.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (not applicable to us — see above).
• Limit our use of sensitive personal information (not applicable — we do not use sensitive personal information for purposes that require this right).
• Non-discrimination: we will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised your rights.

Email team@akston.ai with “California privacy request” in the subject line and tell us which right you want to exercise. We will verify your identity (usually by confirming you control the email on file) and respond within the timeframes required by law (typically 45 days, with a possible 45-day extension). An authorized agent may submit a request on your behalf with your written authorization.

California Civil Code § 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Some browsers send a “Do Not Track” (DNT) signal. There is currently no industry standard for responding to DNT signals, and we do not alter our data practices based on them. We do not permit third parties to collect personally identifiable information about your activity on the Site over time and across third-party websites.

We use a small set of cookies and similar technologies that are strictly necessary to operate the Service:

• Authentication cookies that keep you signed in.
• Session and security cookies used to route requests and protect against fraud.
• Preference cookies that remember things like your theme.

We do not use third-party advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; doing so may prevent you from signing in or using the Service.