Effective October 17, 2026

Privacy

What Archon keeps about you, why, who else handles it, and how to have it removed.

Who holds it

Archon is run by Saad Benryane, an individual based in Canada. When a company takes Archon over, this page will name it and say so. Write to [email protected] about anything on this page.

When you ask for access

The form keeps your email address, and the name, organization and note you choose to give. We use them to decide who to let in and to write to you about Archon: one email when you ask, and one when there is a place for you. Nothing else.

When you have an account

• Your email address and the name you go by.
• How you sign in: an emailed code, or your Google account (its id, email and name) or your GitHub account (its id, username and name). We never see a Google or GitHub password.
• A sign-in code is kept only as a one-way hash and lasts ten minutes.
• Each signed-in browser: a hash of its sign-in cookie, a short description of the browser, and when it was last used. A sign-in ends after 30 days unused, 90 days at most, or when you sign out.

What you put in a workspace

Messages, Library entries, files, and the record of Work your agents do are kept in that workspace on our servers. People in the workspace see them as its rooms and permissions allow; an agent shows each person only what they may read. A workspace's owner can export it, and its admins can clear it.

Keys and sign-ins you connect (a model provider, Google Drive, GitHub, Telegram) are sealed with encryption (AES-256-GCM) and used only to do what you asked. You can disconnect any of them at any time.

Cookies

The public pages set no cookies. Once you sign in, Archon sets only the cookies it needs to keep you signed in and to finish a sign-in you started; each is read only by Archon. There are no advertising or analytics cookies, no trackers, and no third-party scripts.

Who else handles it

• Railway hosts Archon's servers and storage, in the United States.
• Cloudflare carries traffic to the site and protects it.
• Resend delivers Archon's emails: sign-in codes, invitations and replies to your access request.
• The model provider you or your workspace chooses receives what an agent sends it to do its work, under that provider's terms.
• Google, GitHub and Telegram, only if you sign in with them or connect them.

We do not sell your information, show ads, or share it with anyone else, except where the law requires it.

Logs

Your IP address is used for a few minutes, in memory, to slow down abuse; it is not stored. If an email to you fails to send, the error record names your address so we can fix it.

How long it is kept, and removing it

An access request is kept until you are let in, or until you ask us to remove it. An account and its workspaces are kept while you use them. Write to [email protected] from the address in question and we will delete your access request or your account within 30 days, and tell you when it is done. You can also ask for a copy of what we hold about you, or to correct it.

Your rights

You can ask to see, correct, export or delete what we hold about you. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

Children

Archon is not meant for anyone under 16, and we do not knowingly keep information about them.

Changes

When this page changes, its date changes. If a change affects how your information is used, we will email you before it takes effect.