Privacy Policy

OneWorld AI, Inc. provides the Services and is responsible for the personal information described in this Privacy Policy. When you use the Services through an organization, that organization decides how the Services are configured for its members, and we process the organization's content in accordance with our agreement with it. Questions about how your organization uses the Services should be directed to its administrators.

Information you provide:

• Contact Information: First name, last name, email address, phone number, and company name (if any).
• Account Information: Email address, sign-in identity, and organization and team membership.
• User Content: Any personal information in what you provide to or generate with the Services, including the prompts, agent replies, tool output, files and images in the AI coding sessions you run in or sync to the Services, file uploads, feedback, and outputs like generated code and specifications.
• Billing Information: Your organization's balance, top-ups, usage and payment history. Card details are collected and stored by our payment processor, not by us.
• Communications: Any communications that we exchange, including support requests, survey responses or feedback.

Information collected automatically:

• Synced Sessions: When you connect a computer, the App reads the session records that supported coding agents (such as Claude Code, Codex and opencode) keep on that computer, and uploads the sessions whose working folder is inside a project folder you connected, together with their attachments, images, and files the session refers to. Your organization may also allow sessions outside a connected folder to be uploaded when you select them.
• Device and Project Information: Your computer's name and identifier, the App version, and for each session its project, working folder relative to the project, git repository and branch, title and timestamps.
• Usage and Technical Information: Logs, error reports and diagnostic information from our web app and the App, and the cookies described in Section 8.

Information from other sources:

• Connected Services: Information we receive from services you or your organization connect, including repository content, pull requests, issues, commits, reviews and comments from GitHub or GitLab (which include the public profile information of the people who authored them, such as name, email address and profile details), and messages in Slack or Lark threads where OneWorld participates.
• Assessments: If you take part in an assessment, your name, email address, the sessions and files you submit, timing information, and the grade your reviewer publishes. If the assessment runs in Canvas, we also receive your Canvas user identifier and course enrollment.

Note: Personal information does not include information that has been de-identified, anonymized or aggregated.

• To provide the Services: This is necessary to perform our contract with you. It includes storing and displaying your sessions, running agents in cloud sandboxes, posting session updates to Slack or Lark threads you connect, and, where your organization turns them on, generating session summaries and building your organization's analytics workspace for search (Ask) and reports (Insight). These features process User Content and connected-service data with AI models, including converting it into search embeddings.
• To run assessments: To deliver assessment invitations, record submissions, let reviewers evaluate them, and, where an assessment runs in Canvas, publish grades and course announcements to Canvas through the instructor's connected account.
• To bill for the Services: To meter usage, apply charges to your organization's balance and process top-ups.
• To provide support and send Service communications: Based on our legitimate interests in ensuring you have the best use of the Services.
• To keep the Services safe and secure: To detect and prevent abuse, fraud and security incidents, and to maintain the effective operation of the Services.
• To comply with legal obligations: We may disclose information when reasonably necessary to comply with law enforcement, governmental requests, court orders, or tax authorities.
• To improve the Services: We use User Content to train, fine-tune, and improve our models only where you have explicitly opted in. Absent your opt-in, your User Content is not used for model training. We may use de-identified and aggregated usage information to improve our developer tooling.

We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We disclose personal information to:

• People you share with: A new session is visible only to you unless you or your organization's settings share it with specific people, your team, your organization, or anyone signed in who has its link. People you mention in a shared session, and members of your organization who reply to a session in a connected Slack or Lark thread, can see that session.
• Your organization: Its administrators control your organization's settings, including whether session sync is on, how new sessions are shared, whether administrators can view new sessions, and whether summaries and the analytics workspace are enabled. Administrators may be able to access certain information, including your User Content, and control your account.
• Assessment reviewers and course instructors: The people reviewing an assessment can see what you submit. For assessments run in Canvas, your grade is published to the Canvas course.
• Services you connect: When you or your organization connect Slack, Lark, GitHub, GitLab or Canvas, we send them the information needed for that connection, such as session messages and files posted to a Slack or Lark thread, or branches, commits and pull requests created in your repository.
• Service providers: Who help us provide the Services, including Google Cloud and Firebase (data storage, analytics, embeddings and AI models), Vercel (application hosting), Cloudflare (real-time connection relay), E2B (cloud sandboxes in which agents run your code and repositories), WorkOS (sign-in and organization management), Sentry and Grafana (error reporting and logs), Stripe (payments), Firecrawl (web pages an agent is asked to read), and AI model providers including Anthropic, OpenAI, Google and DeepSeek, which receive the prompts and content an agent or summary is working on.
• Professional advisors, authorities, and regulators: To respond to legal processes, comply with reporting obligations, prevent fraud, and protect the rights and safety of us or others.
• Acquirers: If we are acquired, merged, or reorganized, your personal information could be transferred in connection with that transaction.

We retain your personal information as needed to provide our Services to you, comply with legal obligations, or protect ours or others' interests, and delete it when it is no longer needed for these purposes or when you request deletion.

• Archiving a session hides it and stops further changes. A session that runs on your computer can be restored; archiving a session that runs in a cloud sandbox is permanent, and the sandbox and its files are deleted.
• Deleting a session permanently removes it and the content, attachments and sharing we store for it. We keep a record of the deleted session's identifier and organization so it is not recreated. If the session still exists on your computer and you keep using it, the App may upload it again.
• After deletion, copies may remain for a limited time in our analytics workspace backups (up to 30 days), operational logs, and statistics already published to your organization, which are not recalculated. Messages already posted to a Slack or Lark thread are held by that service and are not removed by deleting the session.

We implement commercially reasonable technical, administrative, and organizational measures intended to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, these measures are not a guarantee of absolute security, and you acknowledge that your use of our Services is ultimately at your own risk. Because sessions are uploaded as recorded, avoid placing passwords, keys or other secrets in agent sessions on a computer you have connected.

We store and process personal information primarily in the United States. AI model providers and other service providers may process it in other countries where they operate. To facilitate our operations, your personal information may be transferred, stored, and processed throughout the world, including the EU, UK, and the US. We rely upon certain legal mechanisms, including the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, to facilitate the international transfer of European personal data.

We use only cookies that are necessary to run the Services, such as those that keep you signed in and remember the organization you last used. We do not use advertising or third-party analytics cookies.

The Services are not intended for children, and we do not knowingly collect personal information from children. Users must be at least 18 years old in order to access the Services. Course assessments are offered only to colleges and universities, not to primary or secondary schools.

Depending on where you live, you may have the right to:

• Access/know and portability: Request a copy of your personal information or details on how we use it.
• Deletion/erasure: Request to erase your personal information.
• Rectification/correction: Request to update incomplete or inaccurate information.
• Object, restrict processing, or withdraw consent: Restrict our use of your information or withdraw consent at any time.
• Appeal and lodge a complaint: Appeal our decisions or lodge a complaint with your local data protection authority.

You can delete or archive your sessions, change who they are shared with, and disconnect a computer to stop it uploading sessions directly in the Services. For any other request, including access, export, or deletion of your account, contact us as described below. We may take steps to verify your identity before complying with your request and will not discriminate against you for exercising your rights. If you use the Services through an organization, we may refer your request to that organization.

How to contact us:

If you have any questions or concerns regarding this Privacy Policy, or want to exercise your rights, please email us at support@oneworldai.com.

Changes to this Privacy Policy:

We may change this Privacy Policy from time to time. We will post any changes on this page, and when a change is material we will ask you to agree to the updated policy in the Services. The date the Privacy Policy was last updated is identified at the top of this page.