Privacy Policy

Overview

Operon (“Operon,” “we,” “us”) helps small and mid-sized teams build forms and calculators and collect submissions. This policy explains what personal data we process, why, and the choices you have. It applies to our marketing site and the Operon application.

Information we collect

• Account data — your email address and authentication credentials, handled by our authentication provider. We store a password hash, never your plaintext password.
• Workspace content — the forms you build and the submissions your respondents send, including any files they upload.
• Connection records — if you connect an AI app, the details of that connection described under "Connected AI apps" below.
• Billing data — when you subscribe, payments are processed by our merchant of record, Polar. We receive your plan, billing status, and the email used at checkout; we do not receive or store full card numbers.
• Usage and device data — basic logs (such as IP address, timestamps, and request metadata) used to operate the service, prevent abuse, and debug issues.

How we use information

• To provide, maintain, and improve the Operon service.
• To create and secure your account and send transactional email (verification, password resets, submission notifications).
• To process subscriptions and prevent fraud and abuse.
• To meet legal, accounting, and security obligations.

We do not sell your personal data, and we do not use your workspace content to train machine-learning models.

Service providers

We share data only with vendors that help us run Operon, under contracts that limit their use of it: our database and authentication host, our merchant of record for payments (Polar), our transactional email provider (Resend), and our hosting and content-delivery infrastructure. Each processes data on our behalf to deliver the service.

Bot protection and product diagnostics

We use Cloudflare Turnstile to protect account access from automated abuse. Turnstile runs in the background and processes browser, device, and network signals, including your IP address. Learn more in the Cloudflare Turnstile Privacy Addendum.

We use PostHog in the United States for marketing pageviews and selected product events, such as signup and publishing a form. These events use browser-level identifiers and device metadata. We do not identify visitors by name or email in analytics, and session recording and automatic click capture are disabled. PostHog is configured to discard stored client IP addresses.

We use Sentry in the United States to diagnose application errors and delivery failures. We remove request bodies, cookies, authentication headers, and direct user contact details from error reports before sending them.

Connected AI apps (ChatGPT, Claude, Codex)

You can connect an AI app, such as OpenAI’s ChatGPT or Codex or Anthropic’s Claude, to one Operon workspace. Nothing is shared with an AI app until you start a connection from that app, sign in to Operon in the connection window, choose a workspace and choose permissions.

What a connected app can receive. An app receives data only when it asks Operon for it on your behalf, in response to what you, or someone using your AI app account, asks the app to do. We do not send data to AI apps on our own. What it can receive depends on the permissions you choose:

• Read workspace and allowance — the workspace name and public handle, your plan and its status, and usage levels (AI allowance used and remaining as percentages, submission, storage and seat usage).
• Read forms — the titles, links, status and full content of your forms and calculators, including questions, options, calculation rules and any text you wrote in them.
• Read aggregate analytics — submission totals, such as how many submissions arrived, how many are unhandled, and daily counts.
• Create and edit drafts, Use AI allowance, Publish forms — these let the app send Operon instructions and form content to create or change drafts, generate drafts with AI and publish forms. Publishing makes that form public at its hosted link.

Submissions are totals only. We never send an individual submission to a connected app: no respondent answers, contact details or uploaded files. A connected app also never receives payment details, passwords, member lists or other workspaces’ data.

What a connected app sends us. The app sends the requests it makes on your behalf. Those requests can include form content the app wrote and descriptions you ask it to turn into a form. We process AI drafting requests with our AI provider, exactly as we do in the Operon builder, and they count against your workspace’s AI allowance.

Processing by the AI app’s provider. Once an AI app receives data from Operon, the app’s provider handles it under its own terms and privacy policy: OpenAI for ChatGPT and Codex, Anthropic for Claude. Operon does not control how they store or use it. Review their policies and your app’s data settings.

Your controls. You can see and revoke your connections at any time in Operon under Settings › Connections. Revoking stops the app’s access immediately. Connections also end on their own 30 days after they are created. Removing Operon inside the AI app may not end the connection on our side, so revoke it in Operon as well.

Connection records we keep. For each connection we store the name the AI app gave itself, your account and the chosen workspace, the permissions you granted, the address the app returns to after sign-in, and when the connection was created, expires and was revoked. We store access credentials only as one-way hashes, and the connection’s sign-in session only in encrypted form. To prevent duplicate changes, we keep a record of each draft or publish request: its type, a fingerprint of the request and the resulting form identifiers. We delete a revoked or expired connection, together with its credentials and request records, 12 months after it ends. Sign-in attempts, one-time codes and expired credentials are deleted 30 days after they expire or are used, and registrations from AI apps that never completed a connection are deleted 30 days after they are created. Records of an active connection are kept while it is active. When you delete your account, or a workspace is deleted, its connection records are deleted.

Data retention

We keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymize it within a reasonable period, except where a longer retention is required for legal, tax, or security reasons. Connection records for AI apps are kept as described under "Connected AI apps."

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise these rights — or ask any privacy question — by emailing support@useoperon.app.

Security

We use industry-standard measures — encryption in transit, scoped access controls, and tenant isolation — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you of material incidents as required by law.

Children

Operon is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product evolves. When we make material changes, we will revise the effective date above and, where appropriate, notify you.

Contact

Questions about this policy or your data? Email support@useoperon.app.