Privacy Policy

01About this policy

This policy explains how cot handles information when you visit cot.run, create an account, contact us or use the cot software. A self-hosted cot installation stores your agent traces on your own machine or infrastructure. The website and optional usage metrics handle separate information, described below.

02Your agent traces

Prompts, responses, shell commands, file paths and tool calls recorded by a self-hosted collector stay in your installation, by default in ~/.cot/cot.db. The collector does not send that trace content to us. Creating a cot.run account does not give us access to your local traces.

You control access, backups and deletion for your installation. If you choose to include trace content in a support message or share it with someone else, that information leaves your installation as part of what you share.

03Optional usage metrics

The collector can send aggregate usage metrics to cot.run, including an installation identifier, installation timestamp, software version, operating system, architecture and counts of sessions, events, tool calls and errors. We also record when a report arrives and the country associated with the request. We use these reports to understand adoption and reliability. Reports do not include prompts, responses, file paths or commands.

Usage metrics are on by default. You can turn them off in Settings → Usage metrics or set COT_DISABLE_TELEMETRY=1. See the FAQ for more details.

04Accounts and downloads

When you sign in with Google or GitHub, we receive your name, verified email address and provider account identifier. We store these with your cot account identifier, account creation and last sign-in times, license key, insider status and email preferences. We use this information to sign you in, manage your license and provide account features. We do not receive your Google or GitHub password.

We record download requests with the release, version, platform, release channel and request time. If you are signed in, we associate the request with your account so you can see your download history.

Signing in uses a temporary security cookie and a session cookie that lasts up to 30 days. We store a hash of the session token on the server. Signing out clears that session.

05Messages and email subscriptions

When you contact us, request a demo or subscribe to emails, we store the information you submit, such as your email address, message, subscription code and reason for subscribing. We also store the request time, country and browser details. We use this information to reply, manage subscriptions and limit abuse.

Forms use Cloudflare Turnstile to check for automated submissions. Verification can include your IP address. Form submissions may also be sent to a team notification channel on Discord so we can respond.

You can change account email preferences on your account page. For release email subscriptions, you can ask to unsubscribe by replying to an email or contacting us.

06Website analytics and browser storage

cot.run uses Google Analytics and Umami to measure visits and understand which pages people use. Analytics can process page addresses, referrers, browser and device information, and approximate location. Our Umami proxy forwards the request IP address and browser user agent to the analytics service. Google Analytics may use cookies to distinguish visits.

The website stores your theme preference in local storage. Account cookies keep you signed in and protect the sign-in flow. You can clear cookies and local storage in your browser, though clearing account cookies signs you out. Browser privacy settings and content blockers can limit analytics requests.

The website also loads some fonts from Google Fonts, which receives the network information needed to serve those files, including your IP address.

07Service providers

Cloudflare hosts the website, databases and download storage, and provides form protection. Google and GitHub handle sign-in when you choose them. Google Analytics and Umami provide website analytics, and Discord can receive form notifications. These services process the information needed for those functions under their own privacy policies. Stable release downloads are served through GitHub.

Using these services can involve processing information in countries other than your own. This website policy does not control how an agent provider or another third-party product handles information you send directly to it.

08Storage, retention and security

Local trace retention is under your control. Website records, including messages, subscriptions, usage reports and account records, are stored separately from those traces. Retention depends on the record and the purpose it supports. You can contact us to ask about or request deletion of information associated with you.

Deleting your account removes its profile, provider identities and sign-in sessions. Download records are kept without the link to your deleted account. Account deletion does not delete local traces or separately submitted messages and subscriptions.

We use HTTPS and account security controls to protect information in transit and access to accounts. No storage or transmission system can guarantee complete security.

09Your choices and requests

You can disable collector usage metrics, manage email preferences and delete your account from the account page. You can also ask us to access, correct or delete information associated with you through our contact form. We may need to verify that a request concerns your information before acting on it.

10Changes to this policy

We may update this policy as cot changes. The date at the top shows when it was last updated.

11Contact

Questions about privacy or your information? Get in touch and tell us your request concerns privacy.