Privacy Policy

The short version

• Your workspace (chats, tasks, memory, and files) is stored on your computer, not on our servers.
• When you use our hosted AI, your request, including the conversation and any files or images the agent includes, passes through our servers to the AI provider that answers it. We do not store the content of those requests, and we log only details about them, such as time, model, size, and cost.
• When you use your ChatGPT, Claude, or Grok plan or your own API keys, those requests go straight from your computer to the provider. We never see them.
• The desktop app is open source. It sends no analytics about how you use it, and it sends a problem report only when you choose to.
• We do not sell your personal information, and we do not use your content to train AI models.

The rest of this policy explains the details. It covers the Instrument desktop app, our hosted services, and this website, all provided by Finalpoint, LLC (“Finalpoint,” “we,” “us”). Words like “plan” and “hosted services” mean what they mean in our Terms of Service.

What stays on your computer

The app keeps these in your workspace folder or the app’s own data folder on your computer. We do not receive copies:

• chats, tasks, and their history;
• the agent’s memory;
• files you and the agent create or open;
• settings and preferences;
• the in-app browser’s cookies, history, and site data;
• your sign-in session, your ChatGPT and Grok sign-ins, your own API keys, and sign-ins for apps you connect, stored encrypted with your operating system’s secure storage.

If you put your workspace folder in a synced location such as iCloud Drive or Dropbox, that service will have a copy. That is between you and that service.

Your account

You sign in with Google. From Google we keep your name, email address, profile picture, and Google account identifier. We do not keep Google’s access or refresh tokens after sign-in, so we cannot act in your Google account.

For each signed-in session we store the IP address and device user agent it started from, to keep sessions secure.

Hosted AI requests

When the agent uses our hosted AI (the Auto model on a plan or trial), the app sends each request to our API. A request contains what the model needs to answer: the conversation so far, including text from files and web pages the agent read, results of commands it ran, and images. Our API passes it to OpenRouter, which routes it to the model provider that answers, or to Cloudflare Workers AI. Along with the request, we send OpenRouter your Instrument user ID, an identifier for the chat, and your app version and platform. We do not send them your IP address.

The app also uses small, quick model calls for background features, such as naming a chat, suggesting a topic or emoji, and helping search your chats. Those calls can include parts of a conversation, draft text, chat titles, and topic names, and they go through our API the same way unless you have your own OpenRouter key.

What we keep

• Request logs. Our API logs details about each request: your user ID, the time, the model asked for and used, whether it succeeded, timing, and cost. It does not log the content of prompts or responses. When a provider returns an error, we log the error message it sent. Cloudflare keeps these logs for 7 days.
• Usage records. To enforce usage limits and run the business, we record each hosted request’s time, model, provider, cost, and token counts, and your plan and any test group you are in. A copy is kept in our analytics storage on Cloudflare R2 until we no longer need it to run the business, and then we delete it or keep only totals that do not identify you. The usage meter keeps its own copy for 90 days after the record reaches our analytics storage.
• AI usage analytics. OpenRouter sends PostHog a record of each request: model, token counts, cost, timing, your user ID, and your app version and platform. These records do not include the content of prompts or responses.

What the AI providers keep

OpenRouter, Cloudflare, and the model providers handle your requests under their own data policies, which can include keeping requests for a period for abuse monitoring or legal reasons. The provider behind Auto can change (see the Terms).

Web search and images

• When the agent searches the web through our hosted search, your search query goes through our API to Exa. We log the query’s cost and how many results it returned, not the query itself. If your own provider key has its own search, that is used instead.
• Image generation on Auto goes through our API to OpenRouter, like other hosted AI requests, and can include images you give it.

Your ChatGPT, Claude, or Grok plan and your own API keys

If you sign in with ChatGPT, Claude, or Grok, the app talks to OpenAI, Anthropic, or xAI directly: you sign in with that company, the sign-in is kept on your computer, and your requests go from your computer to it without passing through our servers. The same is true for your own API keys: requests go from your computer to that provider. In both cases the provider’s privacy policy applies, and we do not see the requests, the responses, or your keys.

Apps you connect

When you connect an app such as Slack, you sign in with that app’s company in your browser, and the access it grants is stored encrypted on your computer. The app on your computer talks to that service directly, so what you keep there, such as your messages and files, goes between your computer and that service. We do not receive your sign-in, and we cannot read or act in your account.

For some apps, the service sends your browser back to the app by way of our servers at the end of signing in. That step carries a one-time code that only the app on your computer can use. We record that a sign-in happened, for which app, and whether it worked. We do not keep the code.

The agent reads from or acts in a connected app when you ask it to. What it reads becomes part of the conversation, so if you use our hosted AI, it goes to the AI provider with the rest of the request, as described in Hosted AI requests above. With your ChatGPT, Claude, or Grok plan or your own API keys, it goes straight to that provider.

Payments

Stripe handles checkout and your subscription. You give your payment details to Stripe, not to us; we never see your full card number. We keep your Stripe customer ID and your subscription’s plan, status, and billing dates. Stripe uses your billing details, such as your address, to calculate tax and issue receipts. When Stripe is the seller of your plan, it does so under its own privacy policy.

Problem reports from the app

• The app does not send analytics about how you use it.
• Problem reports. When something goes wrong, the app offers to send us a report, and you can send one from the Help menu at any time. A report includes what went wrong, your app version and operating system, recent errors, the end of the app’s log (which can name your files and chats), any note you write, and any images you attach. Feedback you send from a chat also includes that chat, unless you leave it out before sending; other reports do not include your chats. You can read the whole report before you send it. Reports go to our storage on Cloudflare, with your account if you are signed in.
• Sending reports automatically. The app sends reports without asking only if you turn that on, in Settings or when you send a report.

Other connections the app makes

• Updates. The app checks our update server for new versions and downloads them.
• Notices. The app checks our servers every few hours for notices about its version, such as a fix for a problem you reported. We count these checks without recording who made them.
• In-app browser. Websites you or the agent visit receive what any browser sends them. Text typed in the address bar goes to Google for search suggestions, and site addresses go to Google to fetch their icons.
• Connected apps. When you connect an app, you sign in with that app directly, and the agent talks to it directly.

Published pages

A page the agent made can be published to a link on instrument.page. Publishing uploads a copy of that page to Cloudflare, where anyone with the link can see it. You do not need to be signed in, and we do not attach your account to it. Pages are not indexed by search engines and are deleted automatically after 30 days. The browser you published from keeps a private key that lets you delete the page sooner; if you lose it, email us. Cloudflare collects basic, cookie-free visit analytics on published pages, and our own analytics count publishes and reads without recording who made them.

Our servers and website

• Product analytics. Our API sends PostHog events about account and billing activity: sign-up and sign-in, subscriptions, usage limits reached, searches, and errors. Events carry your user ID, email address, name, app version and platform, and the country your request came from.
• Website. This site uses PostHog to count page views, downloads, and errors, without building a profile of you; PostHog stores an identifier in your browser to do so. Downloads record your IP address and browser to tell people from bots.
• Waitlist. If you join the waitlist, we store your email address in Notion. Cloudflare Turnstile checks the form for abuse.
• Feedback. The feedback form on our support page sends us what you write and any images you attach (PNG, JPEG, WebP or GIF). If you are signed in, it goes with your account; if not, it goes with the email address you give for a reply, if you give one, and Cloudflare Turnstile checks the form for abuse. Feedback goes to the same storage on Cloudflare as problem reports from the app.
• Email. When you create an account, we add your email address and name to our list on Resend, which we use to send account and product email. Every non-transactional email has an unsubscribe link.

How we use information

• to run the hosted services you ask for;
• to enforce usage limits and trial rules, and to prevent fraud and abuse, including repeat trials;
• to bill you and manage your plan;
• to understand cost and usage, fix problems, and improve Instrument, including by testing different trial terms, allowances, and models with different groups of users;
• to send you account and product email;
• to meet legal obligations.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use your content to train AI models.

Who we share it with

We share information only with the service providers below, each for the purpose listed, and when the law requires it. If Finalpoint is ever sold or merged, this information may transfer to the new owner under this policy.

How long we keep it

• Account information: while your account exists, and deleted within 30 days after you ask us to delete it. Usage records already in our analytics storage stay there under your user ID, without your name or email.
• After you delete your account: a scrambled code made from your Google or Apple sign-in and your email address, for two years, so signing up with them again doesn’t start another free trial. It can’t be turned back into your sign-in or address.
• Request logs: 7 days.
• Usage records: in our analytics storage until we no longer need them to run the business, and 90 days in the usage meter after they reach it.
• Billing records: as long as tax and accounting law requires.
• Published pages: 30 days.
• Problem reports and feedback, with any images: 90 days. A short summary of each, with its title and any note you wrote, stays in our problem tracker until we no longer need it.
• Analytics events in PostHog: 7 years, the retention on our PostHog plan.

Your choices and rights

• Your workspace is yours to read, copy, or delete at any time; it is on your computer.
• You can ask us for a copy of the personal information we hold about you, to correct it, or to delete your account, by emailing support@tryinstrument.com. We will confirm the request comes from you and answer within 30 days.
• You can unsubscribe from product email from any of those emails.
• Depending on where you live, you may have further rights, such as to object to or restrict how we use your information, or to complain to your data protection authority. We will not treat you differently for using them.

If you are in the EU, the EEA, or the UK, we rely on these legal bases: our contract with you, to run your account, your plan, and the hosted services you use; our legitimate interests, to keep the service secure, prevent fraud, abuse, and repeat trials, understand cost and usage, and improve Instrument; your consent, for problem reports and feedback you choose to send, and for email where the law requires it; and our legal obligations, for tax and accounting records.

Where data is processed

Finalpoint is based in the United States. Our service providers process data in the United States and in other countries where they operate.

Security

Connections to our services are encrypted in transit. Secrets the app stores on your computer are encrypted with your operating system’s secure storage. Access to our systems is limited to the people who run Instrument. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Children

Instrument is not for anyone under 18, and we do not knowingly collect their personal information. If you think a child has given us information, email us and we will delete it.

Changes to this policy

We will update this policy when what we collect or who handles it changes, including when the AI provider behind our hosted models changes in a way that affects your data. For material changes we will tell you by email or in the app before they take effect.

Contact

Finalpoint, LLC

Email: support@tryinstrument.com