Privacy Policy

Effective date: November 10, 2026

The short version: Your code, agents, and conversations belong to you. We never train on your data and never sell it. Your projects are private to your account. You choose the model providers your agents use. The providers we offer are US-based, and we configure our accounts with them for zero data retention and no training where they offer those settings. When your agents serve your own users, their data is yours to control and we process it only for you.

1. Who we are

Standard Agents is operated by FormKit Inc., doing business as Standard Agents ("we," "us"). This policy covers the Standard Agents platform, the Standard Agents Builder software and CLI, Standard Agents hosting, our websites, and our documentation. Your use of them is also governed by our Terms of Service.

Standard Code has its own privacy policy. Your Standard Agents sign-in account is shared between Standard Agents and Standard Code, and this policy covers it.

We operate the service from the United States, and it is directed to customers in the United States. If you use it from another country, your data is sent to and processed in the United States.

When your agents serve other people ("your users"), you decide how their data is used. We process it only to provide the service to you, as your service provider. If you use an application that someone else built on Standard Agents, that company's privacy policy applies, and you should contact that company first.

2. What we collect

• Account information: name, email, sign-in identifiers, profile image address, and billing status. You sign in with Google, Microsoft, Apple, or GitHub, and we receive only your basic profile and verified email. Stripe processes payments; we never see full card numbers.
• Your projects: the source code, agent definitions, threads, messages, files, environment values, and agent activity you create, and the accounts and content of your users.
• Model request records: requests to and responses from AI models, plus operational metadata (timestamps, token counts, errors) used to run and bill the service, never to profile you. Your project stores the full requests and responses. Our router stores only the metadata.
• Command line records: when you sign in from the CLI, the name of your computer, your project name, and your package manager. The CLI sends no analytics or telemetry.
• Website and connection data: our hosting provider processes your IP address and browser details to deliver pages and protect the service. Our websites use no analytics or advertising trackers. Our specification site loads fonts from Google Fonts, which receives your IP address.
• Support communications: anything you send us directly.

3. Where your data lives

Your projects are stored privately within your account on our infrastructure, encrypted in transit and at rest. Each thread lives in its own isolated storage partition; there are no shared data pools across customers. Your content leaves your account when you direct it to, such as attaching a thread to a bug report or choosing a model provider, and in the two cases below.

Legal requests and business transfers. We may disclose information when the law, a subpoena, or a court order requires it, or when disclosure is needed to protect the rights, safety, or property of our users, the public, or us. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

Your project addresses are public. A deployed project is served at a subdomain that we assign, and at a custom domain if you add one. Anyone who knows the address can reach whatever your agent exposes there. The project name in the address is visible to the public.

Your computer stays yours. Local development runs on your own computer. We never scan or upload your filesystem. Only what you push or deploy to us becomes part of your project, where this policy protects it.

4. Our commitments

• We never train on your data and never sell it. Your code, prompts, and conversations are never used by us to train or improve any AI model. No advertising, no data brokers.
• Your data stays private to your account. We don't mine or merge customer projects.
• US-based model providers only.
• Zero data retention and no training at model providers. We configure our accounts with the model providers we offer for zero data retention and no training on your data, where the provider offers those settings.

5. How AI processing works

When your agent works on a task, the relevant context (your prompt, code, and conversation history) is sent to a model provider to generate the response.

You choose the model provider. Model providers are third-party services that you select. You choose a provider and a model by writing an agent that uses them, and we require none of them. The providers we offer are listed in the Providers section of our documentation. When your agent calls a model, we send the request to that provider on your instruction. Your choice of a provider is your instruction and your authorization to send it that content. If you choose a model through OpenRouter, OpenRouter selects the host that runs it.

We configure our accounts with the model providers we offer for zero data retention and no training on your data, where the provider offers those settings. With zero data retention, your content is processed to generate the response and not retained afterward, aside from narrow legal and trust-and-safety exceptions. Providers keep non-content metadata (timestamps, token counts, error codes) for billing and reliability.

If you configure your own provider key, your project sends requests directly to that provider under your agreement with it. Our agreements and settings do not cover those requests.

Your own project keeps a log of each model request and response, including the prompt text, so that you can inspect what your agents did. That log is part of your project. You delete it by deleting the thread or the project.

6. Operating a hosted service

Because Standard Agents is hosted, our systems store and process your projects to provide it. Authorized team members may access account data when needed to operate, secure, bill, or support the service: investigating an outage, a security event, or an issue you reported. Access is limited to the task at hand.

We process your users' data only on your instructions, which are to host your agents and run them as you configured. Our Data Processing Addendum sets out those terms. Requests from your users about their data go to you. If one reaches us, we pass it to you.

7. Service providers

These are the providers we use for every customer.

Each processes data only as needed to serve us. We update this list when we add or replace a provider. This list is our notice of the providers we use.

Two kinds of service are chosen by you and are outside this list:

• Sign-in providers. Google, Microsoft, Apple, or GitHub, whichever you sign in with.
• AI model providers. The providers your agents use, per Section 5.

8. Retention and deletion

Your projects stay in your account until you delete them. Deleting a thread removes its storage; deleting a project removes its threads, files, code repository, deployments, and addresses. Deleting your account removes your projects. Copies in backups and logs can remain for a short time until they are overwritten. Preview deployments are deleted after 7 days without a new push.

We keep account information, usage records, sessions, and operational records for as long as we need them to run, bill for, and secure the service. Billing records are retained as required by law.

9. Your choices

• Delete your content anytime: remove individual threads, or delete a whole project from its settings.
• Delete your account: contact us and we'll erase your account and its data, except records we must or may keep by law, confirmed by email.
• Get a copy of your data by contacting us, where the law gives you that right. Your project's source code is available to you through Git while your account is open.
• Share content with us only when you choose to, for feedback or support.
• Use your own provider keys if you want model requests to go to a provider under your own agreement.

10. US state privacy rights

If you are a California resident, you have the right to know what personal information we collect (Section 2), to access it, correct it, and request its deletion. We do not sell or share your personal information as defined under California law, so there is nothing to opt out of, and we will never treat you differently for exercising your rights.

Residents of Virginia and of other states with consumer privacy laws have the same rights to confirm, access, correct, delete, and obtain a copy of their personal data. We do not sell personal data, use it for targeted advertising, or profile you in ways that produce legal effects. If we decline a request, you can appeal by replying to our decision, and we will tell you how to contact your state attorney general if the appeal is denied.

To make a request, email [email protected] from your account email (we use it to verify the request). We respond within 45 days. Where the law permits us to retain certain records (completed transactions, security, legal compliance), we retain only what those exceptions cover.

11. Cookies

We use only the cookies and browser storage that the service needs: a session cookie that keeps you signed in, short-lived cookies that protect sign-in, and stored preferences such as your theme. We use no advertising or analytics cookies.

12. Children

Standard Agents is for people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email [email protected] and we will delete it.

13. Contact

Questions about this policy or your data: [email protected]

FormKit Inc., doing business as Standard Agents
961 2nd St SE, Suite 303B
Charlottesville, VA 22902

14. Changes to this policy

We may change this policy at any time. We give notice by posting the updated policy and by showing it to you in the product whenever you use the dashboard after a change. We may also send an email, and we have no duty to.