Privacy Policy
Last updated: 7 October 2026
This policy says what Okaybot collects, what it does with it, how long it keeps it and who else sees it. It is written to be read.
Who we are
Okaybot is owned and operated by Webcandy Ltd, a company registered in England and Wales (company number 07024033), of 66 Paul Street, London EC2A 4NA, United Kingdom. Webcandy Ltd is the data controller for the information described here, and is registered with the Information Commissioner's Office under registration number Z2687058.
What we collect
If you joined the waitlist. Before signups opened, people could leave their email address on a waitlist and answer two optional questions about how many X accounts they would run and what they spent on X's API. For anyone who did, we keep the address, the answers, which page they came from, the IP address it was sent from and when they last showed interest, and we mark the address as signed up if it makes an account.
When you sign in. Your email address, and a display name and picture if you set them. Sign-in codes are stored only as a one-way hash and expire 15 minutes after they are sent. If you register a passkey we store the public half of it, which cannot be used to sign in anywhere else, and never the private half, which stays on your device. There is no password to store, because Okaybot does not use one.
Your sign-in history and your devices. Each sign-in, each passkey added or removed and each other change to your account is recorded with the time, the IP address and the browser and operating system it came from. Your account page shows you this, and lists the browsers your account is signed in on so you can sign one out.
From X, when you connect an account. The account's handle, display name and picture, and a token that lets us make calls as that account. The token is encrypted, kept on our servers and used only to make the calls you have allowed. No agent holds it or can read it.
About your agents. The name you give each agent, its daily cap, which accounts it may act as, a hash of its key and a few characters of the key so you can tell them apart. We never store the key itself. We also record what each agent reports about the software running it, such as "Claude Code", as it reports it. When an agent signs in on a machine, we keep a record of that sign-in: the software and version it reported, the name it gave and the address it asked to be sent back to, when you approved it and when it was last seen, and the IP address of the browser you approved it from, so you can tell two machines apart.
Every call. For each request an agent makes: which agent, which account, what it asked for, the reason it gave, when, what it cost, and what happened to it. For calls that ran, the full request we sent to X and the full response X sent back. For calls that were held, the content that was waiting for your decision.
Other people's posts and profiles. When your agent reads X, what comes back is other people's content: their posts, their handles, their pictures, their words. We hold it because you asked for it and because you need to be able to see what your agent read. We do nothing else with it, and we delete it on the schedule below. See Other people on X at the foot of this page.
Payment. Your plan and your billing history. Payments are processed by Stripe, which collects and holds your card details; they never touch our servers.
Technical. Server logs, which include IP addresses, the browser or client used, and the pages and endpoints requested, for security and to keep the service working.
What we do with it, and why we are allowed to
| What we do | Why we are allowed to |
|---|---|
| Run the service: show you what your agents are doing, hold what needs approving, enforce your caps, make the calls you allow, keep the record so you can audit it | performing our contract with you |
| Bill you, and keep the billing record | performing our contract, and a legal obligation for the record |
| Send you the emails the service needs: a sign-in code, and a code to confirm a new email address. We do not email you about your agents' activity yet | performing our contract |
| Keep the service secure, stop abuse, and investigate it | our legitimate interest in a service that is not abused, and yours in an account that is not broken into |
| Keep the waitlist we ran before signups opened, and mark an address on it as signed up when it makes an account | our legitimate interest in knowing who asked to be let in and who came. You can leave the list at any time by asking |
| Hold what your agent read from X so you can see it | performing our contract with you, and our legitimate interest and yours in an audit trail that is actually auditable |
We do not sell your data, use it to advertise to you, or use the content of your agents' calls to train anything. We do not make automated decisions about you that have a legal or similarly significant effect.
How long we keep it
| What | For |
|---|---|
| The full content of a call: the request, and X's response | 30 days, then deleted. A post can wait up to a month for your okay, so its request is kept up to 60 days |
| The record of each call: who, what, when, what it cost, what happened | 13 months, or until your closed account is erased if that is sooner |
| A record of each call we made to X or to another service: the address, the status, the headers with the credential removed, and up to a thousand characters of the body | 30 days |
| Fuller diagnostic traces of a call to X, and of the steps a call took through our pipeline, recorded only while we have switched them on for a workspace we are watching | 14 days and 3 days |
| Attempts to connect an X account: who started it, from which page, and how it ended. Never the code or the token | 30 days |
| Your account | while it is open; once you close it, usually between 7 and 31 days. See Closing your account below |
| Your agents and your connected accounts | while your workspace exists. Removing one ends its key or its tokens at once; what the record of calls needs of it stays until your closed account is erased |
| The machines your agents sign in on | while your workspace exists, and erased with it. Signing a machine out, or removing its agent, ends the sign-in at once |
| A connected account's tokens | until you disconnect the account or close your own, when X is told and the tokens are discarded |
| Your sign-in history | while your account is open, then deleted with it |
| The sign-in codes we email: the address each went to, and the network address it was asked from. Never the code itself | 30 days, or until your account is deleted |
| Your device list | while your account is open; a browser not used for six months is dropped from it |
| The waitlist | until you ask to come off it. An address that has been let in stays on the list, linked to its account |
| Server logs | 30 days |
| Billing records | as long as tax law requires, which is currently 6 years |
The 30 days is the same on every plan. We keep the full content of what your agent read for a month so that you can check it, then delete it; the record stays.
Who else sees it
- X, necessarily: every call you allow is made to X, and X sees it as a call from your account through Okaybot. X is its own controller for what it does with that.
- SendGrid (Twilio Inc.), which delivers the sign-in code and any email we send you, and so sees your email address.
- Stripe, which handles your card and processes your payments.
- Google, which serves the site's font: your browser fetches it from Google Fonts, so Google sees that request and the address it came from.
- Cloudflare, which runs our domain's DNS and routes traffic to the site, and so sees the address your browser connects from and the pages it asks for.
- Anyone we are legally required to disclose to.
Nobody else. Your agents see only their own calls, never another agent's, and never another workspace's. If our business is ever sold, information may transfer with it, and we would tell account holders first.
Where it lives. The service runs on our own servers in the United Kingdom, and that is where your account and your records are held. SendGrid and Stripe are based outside the UK, so your email address reaches the United States when we email you, and your payment details when you pay. Those transfers run on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, which is the safeguard the law requires. Ask us and we will tell you more.
Cookies
Okaybot sets one cookie, the first time your browser talks to our server. Before you sign in it holds only a random id for the browser; once you sign in it is what keeps you signed in. It lasts up to 30 days and it is the only cookie the product sets. There are no advertising cookies, no tracking cookies and no analytics, which is why you are not asked to consent to any. The site's font is loaded from Google Fonts, which sets no cookie. A few small things are kept in your browser's own storage rather than in a cookie: a note that this browser has used a passkey here, how you last left the calendar (its view, its zoom and its tick boxes), and, if you joined the waitlist before signups opened, your reference on it. Our own staff signing into the admin get two more cookies of the same kind.
Your rights
You can see everything we hold about you in the product itself: your account, your sign-in history, your devices, your agents, your connected accounts and the record of every call. You can disconnect an account, remove an agent, sign a device out, or close your account at any time.
Closing your account stops everything at once: your workspace is put on emergency stop, every agent key and agent sign-in is ended, and every connected X account is disconnected, which tells X and discards its tokens. The account is kept for a short while, at least 7 days and to the end of any period you have paid for, and signing back in while it is kept restores it and everything recorded in it; you then reconnect your accounts and sign your agents in again. Then it is erased for good, usually between 7 and 31 days after you closed it: the account, its passkeys and its sign-in history, and its workspace with its agents, its disconnected accounts and the record of calls. What we keep after that is the billing record, for as long as tax law requires, and nothing on it identifies you beyond what that record needs.
You can ask us to delete everything, including the billing record where the law lets us, by writing to the address below. We do that on request, not at the next scheduled sweep.
If you live in the UK or the EU you also have the rights to access, correct, delete, restrict or port your data, and to object to how it is used, under data protection law. Where we rely on a legitimate interest, you can object to it and we will stop unless we have a compelling reason not to. To use any of these rights, contact us at the address below; we answer within a month. If you are not satisfied you can complain to your data protection authority; in the UK that is the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can fix it.
Other people on X
When your agent reads X, other people's posts and profiles arrive in your workspace. Those people did not sign up to Okaybot, so this section is for them.
We hold that content for 30 days and then delete it, and we do nothing with it beyond showing it to the customer whose agent asked for it and keeping the audit trail of the request. We do not build profiles of anyone, do not enrich it against any other source, and do not train anything on it. It reached us because a customer of ours read your public X account through X's own API, under X's terms.
If you believe content of yours is held here and should not be, write to us at the address below and we will look into it. Note that the customer who read it, and not us, decides what their agent reads; if the content is on X, X's own controls are the faster route.
Security
Agent keys are hashed before storage. Sign-in codes are hashed. The tokens for connected X
accounts are encrypted, with the key held in the vault. Cookies are HttpOnly, Secure and
integrity-protected. Secrets and database credentials are held in a vault rather than in
configuration files. Traffic is served over HTTPS. Access to the production database is limited
to the people who need it.
No system is perfect, and anyone who tells you otherwise is selling something. If you find a security problem in Okaybot, please email [email protected] and we will take it seriously. If there is ever a breach that puts you at risk, we will tell you and the ICO as the law requires.
Children
Okaybot is not intended for anyone under 18, and we do not knowingly collect their data. If you believe someone under 18 has created an account, contact us and we will remove it.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will tell account holders directly rather than relying on you to re-read this page.
Contact
Webcandy Ltd, company number 07024033, 66 Paul Street, London EC2A 4NA, United Kingdom. ICO registration Z2687058.