Privacy Policy
Last updated October 14, 2026
programmable.run is operated by Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA ("we", "us"). This policy explains what we process when you use programmable.run and the rights you have. Questions: [email protected].
The short version
- We keep what the Service needs: your account, the APIs you add, the credentials you save (encrypted) and a log of the calls your AI clients make.
- The data that flows through a call (the request your AI client sends and the response the API returns) passes through our servers to be delivered and is not kept, apart from a fingerprint of the arguments in the activity log.
- Your saved API keys and tokens are attached to calls on our side and are never shown to you or your AI client again.
- We don't use advertising cookies or trackers, we don't sell personal information, and we don't use anyone's data to train AI models.
Our two roles
For your account (sign-in, settings, the activity log, security), we decide how data is used and are responsible for it. When we make calls on your behalf to the APIs you add, with the credentials you save and the arguments your AI client supplies, we act for you as your service provider (or processor) under the Terms and, once you accept it, our DPA. What those calls carry is decided by you and your AI client, not by us.
What we collect and keep
- Account: your email, name (optional) and sign-in records. Sign-in is handled by our shared Programmable sign-in service, which runs on our own servers; we never see your password.
- The APIs you add: the specification or collection you upload, paste or link to, and the endpoint descriptions derived from it. An API you add is private to your account.
- Credentials you save: the API key or token for each API, stored encrypted in a secrets vault on our servers and read only to attach it to a call. We never return it.
- Access keys: the keys your AI clients use are stored as hashes, with the name you gave each, its rules, its daily limit and when it was last used.
- Activity log: for every call made with your keys, the endpoint, the time, the key, the kind of call (read, write or delete), what the rules decided, whether it succeeded, and a one-way fingerprint of the arguments. Not the arguments themselves and not the response.
- Approvals: when a call waits for you, we keep its arguments so that exactly that call can run once you approve. The record then stays as an approval in your activity.
What a call processes, and doesn't keep
When your AI client calls an endpoint, the request (its arguments and your credential) goes from our servers to the API, and the response comes back through us to your AI client. The request and response are handled in memory to deliver them and are not written to a database, beyond the fingerprint and outcome in the activity log. If a call fails, a server error report may include the endpoint and the error, with credentials and arguments removed.
Notice at collection (California and other states)
The categories of personal information we collect, where they come from, why, how long we keep them and who receives them. We don't collect sensitive personal information other than credentials, and we use those only to provide the Service.
| Category | Examples | Source | Purpose | Kept for | Disclosed to |
|---|---|---|---|---|---|
| Identifiers | Name, email, account ID, IP address | You; your browser | Running your account, security | While your account is open, then 30 days | Our service providers |
| Credentials | Your sign-in (handled by our sign-in service); the API keys and tokens you save (encrypted); your access keys (hashed) | You | Signing you in; calling the APIs you add | Until you remove them or close your account | Only the API each saved credential is for |
| The APIs you add | Specifications and collections you upload or paste, and the endpoints we derive from them | You | Letting your AI client search and call them | Until you remove them or close your account | No one |
| Activity | For each call: the endpoint, when, which key, the kind of call, what the rules decided, the outcome, and a fingerprint of the arguments | Your AI client's calls | Showing you what your keys did; security; abuse prevention | 13 months | No one |
| Approvals | The arguments of a call waiting for your decision | Your AI client's calls | Running the exact call you approve, once | Until it runs or expires (10 minutes), then as activity | No one |
| Internet activity | Sign-ins, requests to our servers, server error reports | Your browser and API calls | Security, abuse prevention, fixing problems | Up to 90 days; error reports 30 days | Cloudflare, Sentry (service providers) |
Who else processes data
- Our service providers: OVHcloud (our servers, database, secrets vault and sign-in service; United States), Cloudflare (network, TLS and bot protection), and Sentry (server error reports, with credentials and arguments removed). Our DPA lists them.
- The APIs you add: when your AI client calls one, that API receives the request, your credential and the arguments, under your agreement with it. APIs in our catalog are described from their public documentation; we have no relationship with them on your behalf.
- Your AI client: the software you connect (Claude Code, Cursor, VS Code or another MCP client) receives the responses and whatever it chooses to show its model. Its handling of that data is governed by its own terms.
- Authorities, when the law requires it, and a buyer or successor if our business is sold or merged (bound by this policy).
Where data is processed
Our servers are in the United States and all processing happens there. If you use the Service from the European Union, the European Economic Area or the United Kingdom, your data is transferred to the United States; we rely on standard contractual clauses (available on request) for that transfer. Our legal bases are performance of our contract with you (running the Service) and our legitimate interests in keeping it secure and improving it.
Retention and security
Retention for each category is in the table above. Account records are deleted within 30 days of closing an account. Data is encrypted in transit; saved credentials are encrypted at rest in a secrets vault; access keys are stored as hashes; access to production systems is limited to the people who run them. No system is perfectly secure; if a breach affects your personal information, we'll tell you as the law requires.
Deleting your account
Remove your APIs, saved credentials and access keys yourself in the app at any time. To delete your account, email [email protected] from your account's address; we delete your account records within 30 days. Because the Programmable account is shared across Programmable apps, deleting it also ends your access to those.
Your rights
Depending on where you live (including the EU, EEA and UK, and US states such as California, Colorado, Connecticut, Oregon, Texas and Virginia), you may have the right to know what personal information we hold about you and get a copy, to have it corrected or deleted, to object to or restrict some processing, to opt out of its sale (we don't sell it) and of targeted advertising (we do none), and not to be treated differently for using these rights. How to ask: email [email protected] from your account's address; we verify requests by confirming control of that address, reply within 45 days (or 30 in the EU and UK), and tell you if we need more time. If we decline, you can appeal by replying, and you may complain to your supervisory authority or state attorney general. Global Privacy Control and Do Not Track: we have no advertising trackers, so there is nothing for these signals to turn off.
Children
programmable.run isn't directed at anyone under 18. We don't knowingly collect information about children; if you think we have, email [email protected] and we'll delete it.
Changes
We'll post changes here with a new date and, for material ones, email account owners before they apply.