Privacy Policy

Auten is a product of MB Icecode (company code 306190890), registered in Panevėžys, Lithuania. For anything in this policy, contact us at [email protected]. MB Icecode is the data controller for the personal data described below.

We keep as little as possible. The data tied to your account is:

• Account details: your email address, and your name if you sign in with Google.
• Service data: your API key, your plan, subscription status, and how much runtime you have used.
• Payment data: handled by Stripe. We store your Stripe customer and subscription identifiers, never your full card number.
• Technical logs: basic server logs (such as IP address and timestamps) kept briefly for security and abuse prevention.

Auten is built local-first. The following never reaches our servers or the AI model:

• Your passwords and secrets. When a login is needed, Auten asks you in your terminal and stores the value in your operating system's keychain. If a secret appears on screen, it is replaced with a placeholder before the AI model sees it.
• Your activity. The history of what Auten does on your device and any routines it learns are written to your own computer, not ours.

To carry out a task, the instruction you type and the on-screen context needed to perform it are sent through our gateway to an AI model provider that generates the next action. This happens only to run the task you asked for. We do not build a stored profile of your activity from it. Secrets are redacted as described above before this step.

• Performance of a contract: to provide the service, your account, and billing.
• Legitimate interests: to keep the service secure and prevent abuse.
• Consent: for analytics and marketing cookies and optional product emails. You can withdraw it at any time.

We use a small set of trusted processors, only as needed to run Auten:

• Stripe: payment processing.
• Google: sign-in (if you use it), and Google Analytics for usage statistics if you allow analytics cookies.
• Meta: the Meta Pixel measures our ads, only if you allow marketing cookies.
• Our AI model provider: to generate the actions that carry out your tasks.
• Our email provider: to send sign-in links and account emails.
• Our hosting provider: to run the service.

We do not sell your personal data.

We keep account data for as long as your account is active. When you delete your account, or ask us to, we remove your personal data except where we must keep records for legal or accounting reasons (for example, invoices).

Under the GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, email [email protected]. You also have the right to complain to the State Data Protection Inspectorate of Lithuania.

Some of our processors may process data outside the European Economic Area. Where they do, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

When you first visit, a cookie banner lets you accept all, reject all, or choose by category:

• Necessary: keep you signed in, protect the site and remember your cookie choice. Always on.
• Analytics: Google Analytics statistics about how the site is used.
• Marketing: Google Ads and Meta Pixel measurement of our ads.

Until you allow a category, its tags run in consent-denied mode (Google Consent Mode v2) and set no cookies. You can change your choice any time with Cookie settings.

We protect your data with encryption in transit, restricted access, and secret storage on your own device rather than ours. No system is perfectly secure, but keeping the most sensitive data off our servers is a core part of the design.

If we make material changes, we will update this page and the date above, and where appropriate notify you by email.