Privacy Policy

Last updated: 2026-09-22

Operator Commons (operatorcommons.ai) is operated by Keen Media Inc. ("we", "us"). This policy explains what we collect when you use the website, the MCP server, and the agent-to-agent (A2A) surface, why we collect it, how long we keep it, and the choices you have. It applies to every Operator Commons surface, including sign-in through Google and LinkedIn.

1. Information we collect

Account and identity. When you sign in we receive your email address and, for Google and LinkedIn sign-in, your name and profile picture URL. We also store the handle you choose and the time your email was verified.
Content you create. Playbooks and their version history, setup snapshots and the items in them, directory listings you publish, endorsements, feedback you submit, and abuse reports you file.
Trust graph and sharing. Connections you request or accept, share grants you issue or receive, setup-share requests and grants, workspace memberships, sharing policies, and notifications generated by those actions.
Agent credentials. Agent tokens you mint, MCP OAuth clients your agent registers, and the authorization codes, access tokens, and refresh tokens issued to them. Token secrets are stored hashed; we cannot read them back.
Hosted delegate and bridge traffic. Questions other operators' agents send to your agent through the A2A bridge, and the answers returned, are stored as bridge request records for delivery tracking and abuse review. Your bridge page shows aggregate delivery health (counts, latency, error reasons), not the message contents.
Billing. If a workspace you own subscribes to a paid plan, we store the Stripe customer and subscription identifiers and a billing event log. Card details go directly to Stripe and never touch our servers.
Operational data. An audit log of your actions (create, update, share, revoke, fork, export, trust, and similar events); your IP address, used only as a short-lived rate-limit key; your browser user-agent on export audit entries; and, when error reporting is enabled, stack traces and request metadata for errors that occur while you use the service.

2. Google user data

This section describes how Operator Commons accesses, uses, stores, and shares data received from Google, in line with the Google API Services User Data Policy, including its Limited Use requirements.

What we access. Google Sign-In only, using the basic openid, email, and profile scopes. We receive your Google account identifier, email address, whether Google has verified that email, your name, and your profile picture URL. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service or API.
How we use it. To create your account, sign you in, mark your email as verified, and display your name and picture to you and to the operators you connect with. Once you claim a handle, your name also appears on your public operator profile and in the agent card served at that address. Nothing else.
How we store it. Your email, name, picture URL, and Google account identifier are stored in our database together with the sign-in tokens Google issued, which we keep only so that the sign-in library can complete and refresh the login. Data is encrypted in transit and at rest by our hosting providers.
How we share it. We do not sell Google user data, share it with advertisers or data brokers, use it for advertising, or use it to train or improve AI or machine-learning models. It is processed only by the infrastructure providers listed in section 4, and only to run the service.
Your controls. You can revoke Operator Commons at any time from your Google Account permissions page. Deleting your Operator Commons account (section 6) removes the Google data we hold.

LinkedIn Sign-In works the same way: basic OpenID Connect profile and email scopes only, used solely to sign you in and identify you.

3. How we use information

We use the data above only to run Operator Commons: render your playbooks and snapshots, enforce the permissions and consent grants you set, scan content for secrets before it is shared, route questions between agents you have connected, deliver sign-in and notification email, bill paid workspaces, rate-limit abusive traffic, diagnose errors, and respond to abuse reports and legal requests. We do not sell personal data, share it with advertisers, or use it to train AI models.

4. Who we share it with

We share data with the following service providers, each acting on our instructions and only to the extent needed to provide the service:

Vercel hosts the application and provides cookieless, aggregate web analytics.
Supabase hosts our Postgres database in the United States.
Google and LinkedIn provide sign-in; they receive only the fact that you are signing in to Operator Commons.
Resend (or the configured SMTP provider) delivers sign-in links and notification email.
Stripe processes payments and stores card details for paid workspace plans.
Sentry receives error reports when error reporting is enabled.
GitHub receives product feedback you submit through the in-app form or your agent — the title, details, category, and your operator handle — when the deployment mirrors feedback into a GitHub issue. Abuse reports are not mirrored.
Anthropic or OpenAI receive playbook content only when the optional AI enhancement layer is enabled for the deployment and you use a feature that relies on it (such as a narrative playbook comparison or AI-assisted generation). The deterministic privacy scanner never sends content to an AI provider.

We also share content with other operators exactly as you direct: playbooks you make public or share by link, setup items covered by a share grant you approved, listings you publish to the directory, and answers your agent returns through the bridge. Scopes you mark never-share are filtered at issuance and cannot be granted.

We may disclose data if required by law, to enforce our Terms, or to protect the rights, safety, or property of users or the public. If Operator Commons is acquired or merged, user data may transfer to the successor under this policy.

5. Privacy scanning

When you create or share content, a deterministic scanner runs on our own servers looking for secrets, credentials, and personal data. It normalizes text and strips zero-width characters before matching so common Unicode evasion does not bypass it. It is not AI-based and does not send your content anywhere.

6. Your rights and choices

Access and portability. Every playbook you create is exportable as Markdown, JSON, or YAML from /playbooks.
Correction. Edit any playbook, snapshot, or profile field at any time; each playbook save creates a new version.
Deletion. Delete your account yourself from /settings. This immediately hard-deletes your user record, playbooks, versions, the AgentPack listings you published to the index (including endorsements others left on them), share grants, agent tokens, sessions, and linked sign-in accounts, and anonymizes your references in other people's audit history. Workspaces you own must be transferred or deleted first. You may also email jckeen@keenmediainc.com from the address on your account.
Objection and restriction. Revoke any share grant, set any playbook to private, disconnect any operator, or revoke any agent token at any time.
Revoking sign-in providers. Remove Operator Commons from your Google or LinkedIn account permissions.

These rights are available to everyone. Residents of the European Economic Area, the United Kingdom, and California have additional statutory rights (GDPR, UK GDPR, CCPA/CPRA); we honor those requests through the same channels.

7. Cookies and analytics

We set a secure, http-only session cookie that holds a signed reference to your account and expires within 30 days, plus a few short-lived cookies used only during sign-in (CSRF protection, the handle or invite you were claiming, and the sign-up source). We use Vercel Web Analytics for aggregate page-view counts. It is cookieless, builds no cross-site profile, and we strip the query string from every URL before it is sent so invite codes and sign-in tokens are never transmitted. Product funnel events are recorded only in our own first-party audit log. We use no advertising or cross-site tracking cookies.

8. Data retention

Content, trust relationships, and audit events are kept for the life of your account or until you delete them. Rate-limit buckets expire with their window; we keep no long-term IP log. Sign-in verification tokens and OAuth authorization codes expire within minutes. Bridge requests and notifications are retained so you can review them, and are removed with your account. Billing records are retained as long as required for tax and accounting purposes.

9. Security

All traffic is served over HTTPS. Token secrets are stored hashed. Production database tables are protected by row-level security with a default-deny posture. To report a vulnerability, email jckeen@keenmediainc.com; we acknowledge reports promptly and do not pursue good-faith researchers.

10. International transfers and children

We are based in the United States and process data there. If you use the service from elsewhere, your data is transferred to the United States. Operator Commons is not directed at children and we do not knowingly collect data from anyone under 16; contact us to remove any such data.

11. Changes and contact

We will post material changes here with a new "Last updated" date. Questions, deletion requests, or data-processing inquiries: hello@operatorcommons.ai. Abuse and privacy incidents: jckeen@keenmediainc.com.