Privacy policy

This describes what Aeonmind LLC, trading as Outcrawl (we, us), does with your data: your account, the pages and browser sessions the service touches on your behalf, and the credentials and secrets you give it to do that work. It sits alongside our terms of service and our security page, which goes further into how the systems described below are actually built.

Account information. When you sign in with Google or GitHub we receive the name, email address and avatar your account there makes available, and store them against your Outcrawl account. We never receive a password from either provider; you do not set one with us.

Usage information. Every call the API serves is metered: which capability was called, when, how much it cost, and whether it succeeded. This is how your credit balance and usage history are built, and it is where a support conversation about a specific run starts.

Billing information. Where your plan involves payment, our payment processor collects your card or bank details directly and passes us back only what we need to keep your account current, not the full card number.

How the site is used, if you allow it. Only after you allow analytics in the cookie popup or Cookie settings, we use PostHog to see how outcrawl.ai, its docs and the console are used: the pages you visit and the page that sent you, what you click, your browser, device and approximate location (worked out from your IP address), how fast pages load and errors. Only if you also allow session recordings, it records the screen while you use the site; everything you type is hidden, on the console and during onboarding every word on the page is hidden too, and it never captures an API key, a secret or a session your agents run. With the same permission, we use DataFast to see where visitors come from and which sources lead to sign-ups and payments: it receives the address of each page you visit and the page that sent you, any ad click ID in the link, the links to other sites you follow, the steps you take (such as signing up, creating an API key or starting a checkout), your browser’s language, time zone and screen size, and approximate location (worked out from your IP address). Once you sign in, this activity is linked to your account (your user ID, email address and name) and to your workspace and plan, including what you did on the same browser before signing in; DataFast receives your user ID, name, plan and role, and your email address when you subscribe so it can match the payment. When you pay, the payment record at our payment processor also carries your user ID and the IDs DataFast gave your browser, so both tools can count the payment against where you came from. If you do not allow analytics, none of this is collected. Separately, when an AI crawler or assistant such as GPTBot or ChatGPT requests a page of this site, we report that request (the page, the crawler’s name, user agent and IP address) to DataFast; it concerns automated agents, not people browsing, and stores nothing on any device.

Content you give us directly. Task instructions, search queries, crawl seeds, and secrets you store for a run to use.

Support and communication. Anything you send us by email or through the console when you ask for help.

To operate the service: authenticate you, route and meter your requests, run the browser sessions your tasks need, and show you the console and your usage. To bill you and keep the ledger on your billing page accurate. To answer when you contact us. To keep the service secure, including detecting the kind of misuse our terms describe. To learn which pages and features help people get started, and to find and fix what breaks. To meet a legal obligation, such as a lawful request from an authority.

We do not sell your data.

This is the question this product raises more than any other: what happens to the browser session your task runs in, the cookies it holds, the credentials a page asks it for, and the content of the pages it visits.

Your API key is a separate thing from that session entirely: it authenticates your calls to our API, and the browser rendering a page for you never receives it, never sends it anywhere, and has no way to. What that browser carries is only what you explicitly gave the task: a stored secret filled in by its handle for that one request, or a value you passed in directly.

Beyond that, what the browser sees while a task runs, page content, cookies, anything typed into a form, is not logged as telemetry. The one durable copy of a session is its recording. Agent runs and browser sessions are recorded unless you turn recording off, and a recording keeps a video of each tab together with the requests the session made, which can include the cookies and form data those requests carried. Our security page describes recordings in full.

If a task needs a credential, a card number, a password, an API token, you store it once as a secret under a name you choose, a short one like stripe-card, from our CLI or an SDK, straight to the platform. From then on a task refers to the secret by that name, and the value is filled in only for the request that needs it. The console lists what you have stored and revokes it; it never carries the value itself.

The value is sealed the moment you send it. No route in our API returns it, not to you, not to a script, not to us: creation, listing by name, and deletion exist; reading the value back does not. A task can name a secret it is allowed to use. It cannot ask for the value behind it, and neither can a model acting on your behalf.

When you sign in, this site sets two cookies that keep you signed in. One holds your session for seven days and renews while you use the site. The other holds a signed copy of your session details for one minute, so pages load without asking our database each time. Signing in with Google or GitHub also sets a cookie for up to five minutes to protect that step, and approving a sign-in from our command line tool sets one for up to thirty minutes. Signing out removes the session cookies. Watching a recording on api.outcrawl.ai sets a cookie that lets the player load that one recording.

We ask before setting anything else. Your answer is kept in a cookie named oc_consent for six months, after which we ask again, and copied into your browser’s storage so our docs can honour it. You can change it at any time from Cookie settings at the bottom of every page, and withdrawing consent deletes PostHog’s and DataFast’s cookies straight away.

If you allow analytics, PostHog keeps two cookies named after our project (they start with ph_) and the same record in your browser’s storage, for up to a year. They hold a random ID for your browser and, once you sign in, your user ID. When it first loads, PostHog also sets a test cookie for three seconds to find the right domain. Session recordings use the same storage. DataFast keeps four cookies that start with datafast_: a random ID for your browser, when it first saw your browser and how many visits it has counted, each for a year, and an ID for the current visit that ends after 30 minutes without activity. It also notes the last page it counted in your browser’s storage until you close the tab. We do not run advertising trackers.

Two pages load a script from another company: the sign-in page uses Google reCAPTCHA to stop automated sign-ups, and the billing page uses Stripe to take payment. Each may set its own cookies for security and fraud prevention, under Google’s and Stripe’s own privacy policies. Our documentation at outcrawl.ai/docs is hosted by Mintlify; it loads its fonts from Google, keeps an anonymous visitor ID in your browser’s storage to count visits, and sends analytics to PostHog only if you allowed analytics here. If any of this changes, we will describe it here and move the date at the top of this page.

This is separate from a cookie that exists on a page your agent visits while it works: that belongs to the site being visited, lives inside the browser session running your task, and is handled the way the rest of a session is, under the browser session data section above.

We do not sell personal data. We share it only with the providers that help us run the service, each bound to use it only for that purpose, and with a court, regulator or other authority where the law requires it.

Google

Sign-in, if you choose it, and reCAPTCHA on the sign-in page

GitHub

Sign-in, if you choose it

Vercel

Hosts the application you are using

Supabase

Runs the database behind your account, usage and billing records

Cloudflare

Runs the request router and the browser fleet your API calls reach, and stores session recordings

AI model providers

Read the page an agent run is working on, or a page a scrape or crawl turns into JSON

Captcha-solving services

Solve a captcha a page shows while we load it

Stripe

Processes payment where a plan involves one

Resend

Sends account and billing email

Mintlify

Hosts the documentation at outcrawl.ai/docs

PostHog

If you allow it, measures how this site, its docs and the console are used, and records sessions on them

DataFast

If you allow it, measures where visitors come from and which sources lead to sign-ups and payments

Page content and anything captured from a browser session go no further than running your request needs. Two kinds of provider above see some of it: an AI model provider reads the page an agent run is working on, or a page you asked to have turned into JSON, and a captcha-solving service sees a captcha a page shows, with that page’s address.

Outcrawl is a United States company, and the providers above run infrastructure mainly in the United States and, in Cloudflare’s case, at edge locations worldwide. If you are outside the United States, using the service means your data is processed there. Where the law where you live requires a specific safeguard for that transfer, we put it in place before the transfer happens.

We keep account information for as long as your account is active, and for a limited period afterwards to meet accounting and legal obligations and to restore an account closed by mistake. Usage and billing records are kept for accounting purposes on the same basis.

PostHog deletes a recording of how you used the site after 30 days. Other analytics events are kept while they help us understand how the service is used; ask us and we delete yours.

A session recording is kept for the period your plan sets, shown with its expiry date against that recording in your console, and is deleted automatically once it expires. Agent runs and browser sessions are recorded unless you turn recording off on the request, and nothing is captured when you do. Browser session data that is not captured as a recording is never retained in the first place, because it is never logged, so there is no copy to hold a retention period against.

A secret you store stays until you delete it. Deleting it takes effect on the next request that would have used it.

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict some of what we do with it, and to receive it in a portable format. Write to hello@outcrawl.ai and we will act on a request within the time the law where you live requires; where it does not specify one, within a month.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to complain to your local data protection authority. If you are a California resident, the rights above correspond to the ones the California Consumer Privacy Act gives you, and we do not sell your personal information as that act defines the term.

The service is for businesses and developers, not for children. We do not knowingly collect personal data from anyone under sixteen, and we will delete it if we learn we have.

We may update this policy as the service or the law around it changes. We will move the date at the top when we do, and for a change we consider material we will make a reasonable effort to tell account holders directly before it takes effect.

Questions about this policy, or a request about your data: hello@outcrawl.ai.