Privacy Policy

Who we are

Sea Otter Inc. is a US company. Principal place of business: Greater Seattle Area, Washington, USA. Privacy and support: ryan@seaotter.dev.

Google sign-in data

If you choose Sign in with Google, Google shows a consent screen and, if you approve, we receive your Google account name, email address, and profile photo (OpenID Connect openid, email, and profile scopes). We use that only to create and sign you into your SEAOTTER account, show your identity in the product, and send transactional email (trial, billing, security).

We do not request Gmail, Drive, Calendar, Contacts, or other Google product scopes. We do not read your Google mailbox or files. We do not sell Google user data. We do not use it for advertising or to train models.

Our sign-in provider is Clerk. Google sends those fields to Clerk; Clerk issues a session we verify on our API. You can revoke SEAOTTER in your Google Account permissions.

X sign-in data

If you choose Sign in with X, X shows a consent screen and, if you approve, we receive your X name, username, profile image, and email address when X returns one. We use that only to create and sign you into your SEAOTTER account and send transactional email.

We request Read access only. We do not post, read your timeline, follow accounts, or send Direct Messages. We do not sell X user data or use it for advertising or to train models.

Clerk runs the OAuth exchange. You can revoke SEAOTTER in your X account settings under connected apps.

Other account and product data

• Email or GitHub sign-in — email, name, and (for GitHub) public profile fields needed to create the same account.
• Workspace and agents — names, config, usage, and the files and secrets you put on an agent. Secrets are stored in Google Cloud Secret Manager and delivered to your isolated agent runtime. See Trust.
• Billing — name, email, and plan. Card numbers are handled by Stripe; we do not store full card numbers.
• Product analytics and errors — PostHog (how the site is used) and Sentry (crash/error reports). These can include page URL, browser, and a user or organization id after you sign in.

Who processes data

We host the control plane and agents on Google Cloud (us-central1 today). The website runs on Vercel. Auth is Clerk. Payments are Stripe. Docs are Mintlify. Transactional email is Resend. We do not train foundation models on your content. Model calls you configure use keys you supply (BYOK) to the provider you choose.

Cookies

Essential cookies keep you signed in (Clerk). Analytics cookies or local storage may be used by PostHog and similar tools to understand product use. The site will not work correctly if you block all cookies.

Retention, deletion, and your rights

We keep account and billing records while your account is open and as required for taxes, fraud, and disputes. Agent disks follow the backup windows on /trust. Email ryan@seaotter.dev to access, correct, or delete your account. Deleting the product account does not automatically revoke Google or X access — also remove SEAOTTER from those providers' connected-app settings.

Children

SEAOTTER is not directed at children under 16. We do not knowingly collect their personal information.

Changes

If we change how we use Google, X, or other personal data in a material way, we will update this page and the date above. Continued use after the update means you accept the revised policy.