Privacy policy

• Your account: your email address, your name if you give one, and either a securely hashed password or the account ID from Google or Apple if you sign in with them.
• From Google or Apple sign-in: only your name, email address and account ID. We don’t ask for access to your contacts, files, calendar or anything else.
• What you publish: sites, posts, pages, images and settings, whether you create them yourself or your agent does.
• Agent connections: which apps you connect (for example Claude or ChatGPT), the permissions you grant, when each was last used, and hashed access tokens.
• Security records: the IP address and browser type of your signed-in sessions, and an activity log of publishing, deletions and permission changes.
• Abuse reports: the URL and details you report, and your email if you choose to include it.

Sites on OpenPress get simple, cookieless analytics: the page viewed, the referring site, and a coarse category of where the visit came from. To count unique visitors we keep a hash of the IP address and browser type, salted with a value that changes every day, so visits can’t be linked across days and the IP address itself is never stored. Bot traffic is ignored. Analytics are kept for 90 days.

We use only the cookies the service needs, and none for advertising or cross-site tracking:

• a session cookie that keeps you signed in;
• a cookie remembering that this browser has signed in before, so we can show sign-in instead of sign-up;
• a 30-day cookie recording which site or campaign referred you, if any;
• a short-lived cookie (10 minutes) that secures Google or Apple sign-in while it’s in progress.

Sites hosted on OpenPress don’t set cookies.

• to run your account and host the sites you publish;
• to let the agents you connect act within the permissions you gave them;
• to keep the service secure, prevent abuse and enforce limits;
• to understand, in aggregate, how people find and use OpenPress.

We don’t use your content or personal information to train AI models.

OpenPress’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to sign you in and identify your account, and never transfer it to others except as needed to run the service, to comply with the law, or as part of a merger or acquisition.

We share data only with the providers that run OpenPress for us, and only as needed to do so:

• Railway (application hosting and media storage);
• Neon (database);
• Porkbun (domain name service);
• Google and Apple, only if you choose to sign in with them.

AI agents you connect, like Claude or ChatGPT, receive the content they read or write through OpenPress. Their own privacy policies apply to what they do with it. We may also disclose information if the law requires it, or to protect people from harm.

Whatever you publish on a public site is, of course, public.

• We keep your account data for as long as your account exists.
• You can edit or delete your sites and posts, and revoke any agent connection, at any time from your dashboard.
• To get a copy of your data, correct it, or delete your account and everything in it, email us at connor.lagana@gmail.com. We’ll respond within 30 days.

Passwords are stored only as salted hashes, and access tokens only as hashes. Connections are encrypted, and the database enforces that each account can reach only its own data. No system is perfectly secure, but we work to protect yours.

OpenPress isn’t intended for children under 13, and we don’t knowingly collect their personal information.

If we make significant changes we’ll update the date above and, where appropriate, tell you by email. Questions? Email connor.lagana@gmail.com.