Privacy

Effective 2026-09-03, updated 2026-09-06.

Ogen is an MCP server: your agent asks it a live question, and Ogen answers by reading your own bound sources when the agent asks. This page describes exactly what we keep to make that work, and what we deliberately never keep.

What we store

Your account and key

A SHA-256 hash of your API key — never the key itself, once it's shown to you the one time it's minted.
For a free-tier signup: a keyed hash of your email address — a hash computed with a secret key the pod holds, never the address in plain text — and a one-way keyed fingerprint of the network address the signup came from — never the address itself. Both exist so we can enforce one free key per email and a daily limit per network address; because the hash is keyed, the address can't be recovered or guessed by hashing a candidate address, and each fingerprint can only ever be compared to another fingerprint. Both are deleted after 30 days.
Your tenant id, key tier (free / pro), and an optional label you gave the key.

What you bind

Bindings: the key names you've asked Ogen to track, and where each one's live source is — a pointer, not the data at that pointer.
For a bound HTTPS source: the URL, and any request headers you gave us (an auth token, typically) — encrypted at rest with AES-256-GCM. The headers exist in plain text only for the instant of the outbound read.
Registered actions: the action kind, which key it depends on, and how costly it is to reverse (read / reversible / expensive) — never the action's own business logic.
If you register an approver: that person's name, and their email address — encrypted at rest with AES-256-GCM. It exists in plain text only for the instant of addressing a hold notice or a sign-in link to them, and is never shown back to a caller. Everywhere else we keep track of that person — the record of which day their daily summary already went out, and the activity line saying they decided something — we hold their name or a one-way fingerprint of the address, never the address itself.
If you turn on Ogen Assist: the model-provider API key you gave us — encrypted at rest with AES-256-GCM, never returned — plus the model id and daily cap you chose. Cleared the moment you turn Assist off.

Activity records

Day-bucketed counts only — how many reads resolved, came back ambiguous, or were unavailable; how many actions were held for a person; how many values were caught changing; nothing about their content.
Pending confirmations: a held action's kind, key, and a status (waiting / confirmed / rejected) with timestamps — enough to show you the one decision waiting on a confirm link. A decided one records the approver's registered name, never their address — that's what "Confirmed by …" and the activity line beside it both show you. Proof that the right person's own sign-in link was actually clicked lives separately, as a one-way hash of that link's one-time token; it is never an address, and nobody can read one back out of it.
With Ogen Assist on: one draft per held action — an explanation, what each source said, the open questions — kept only while that hold is waiting. It is deleted when the hold is decided or expires, and every open draft is deleted when you turn Assist off. This is the one case where values from your sources are sent outside Ogen: to your own model provider, on your own key, and to nowhere else.
A billing ledger of processed payment events (kind, amount, currency, the Stripe identifiers) — receipts, never anything about how pricing or entitlement is decided.
A Team/Licensed contact-form submission: the name, email, phone and message you send us through the "Talk to us" form — and, as with a signup, a one-way keyed fingerprint of the network address it came from rather than the address itself, kept only to limit how many submissions one sender can make in a day. Deleted after 180 days.

What we do not store

The actual rows read from your live source — the address, the order status, whatever value your binding resolves to — are pulled when the question is asked, used once to answer it, and discarded. Ogen keeps the pointer, never the pointed-to value. A later question re-reads your source fresh; it is never answered from a cache of what we saw last time.

Who processes what

Vercel hosts the application and its functions — everything you send to Ogen passes through it. Ogen runs in one region: the United States (Virginia), at us.ogenhq.com. Your requests are handled there. (A second region in Europe was retired on 2026-10-07; it held no customer data. eu.ogenhq.com now redirects to us.ogenhq.com.)
Supabase (Postgres) holds everything listed under "What we store," above. There is one database, in the United States (Virginia). It keeps a read-only copy in Frankfurt, used only so reads keep working if the Virginia database cannot be reached; the copy is fed from the Virginia database and holds nothing the primary does not.
Stripe processes Record/Team payments; we keep only the receipt-shaped ledger row, never your card details.
Resend delivers transactional email — a minted free key, receipts, that kind of thing.
Anthropic, or whichever model provider you choose — only if you turn on Ogen Assist, and only using YOUR OWN key (BYOK): the held action and what each source said are sent to that provider, on your key, to draft the explanation described under "Activity records," above. Never used, and nothing is sent anywhere, while Assist is off.
Amazon Web Services (S3, us-east-1) holds an encrypted nightly database backup, for disaster recovery only — never read in the ordinary course of answering a request.

Retention

Account, key, binding and activity records are kept for as long as your account is active. Billing records — the payment ledger of what was charged, when, and against which account — are kept for at least seven years, because tax law requires it, and are not deleted when an account is deleted. A contact-form submission is kept only as long as it takes us to respond to it and for a short window after — no longer than 180 days in any case, whether or not it was answered. Sign-up records for a free key — including the keyed fingerprint standing in for the network address the request came from — are kept for 30 days. The Live list on your tenant page — which key was read or which action ran, and how it came out, never a value — is kept for 30 days. A nightly database backup (the AWS S3 row, above) is retained on a rolling window and used only to restore the service after an incident, never read otherwise.

Lawful basis

We process what's described above to perform the contract you enter into by using Ogen (running the MCP server, answering your requests, billing a paid plan) and, for the free tier's per-IP and per-email caps, our legitimate interest in keeping the free tier usable for everyone. Where you submit the contact form or turn on Ogen Assist, that is your own choice — you can stop either at any time (Assist: turn it off, per-request; contact: nothing recurring is created).

The free tier's daily cap

A free key is capped at a fixed number of calls per day, reset at UTC midnight. That cap exists to keep the demo usable for everyone; it has nothing to do with what's described above.

Deletion

To delete your data yourself — your keys, your bindings, your activity records, all of it — call DELETE /v1/tenant with any live key of your tenant; it schedules deletion 24 hours out, and POST /v1/tenant/undelete cancels within that window. See the docs. You can also ask us to do it for you: use the "Talk to us" form on the pricing section of the landing page. We don't publish an address; the form reaches the team directly. A request like that is honoured across every record that holds your address — anything you sent us through that form, a key you asked for, an invitation, a signed-in identity, an address registered so a hold could reach you, and the notices sent to it. Where a record has to survive for its own sake — an entry in the activity log that shows something happened, or a billing receipt — the address is removed from it rather than the record being dropped.

Your data, downloaded

You can download the personal data we hold about your account yourself — your contact email, your keys' labels and roles, your registered approvers, and the signed-in identities linked to your tenant. It's an API call rather than a button in the console: ask your key for GET /v1/export?scope=personal, using an owner key or a signed-in session, and the answer is the file itself.