Privacy Policy
What Convio collects when you visit convio.dev or connect an AI agent to it, why, how long we keep it, and what you can ask us to do with it.
The short version
- We collect what we need to run your account and keep Convio safe: your email, your name if you give one, sign-in details, and a record of what your agent asks Convio to do.
- We use only essential cookies, to keep you signed in and protect the site. No advertising, no cross-site tracking, no selling data.
- We count visitors without cookies, using a scrambled code that changes every day.
- You can ask for a copy of your data, or for it to be corrected or deleted, at privacy@convio.dev.
1. Who we are
Convio is run by an individual based in the United Kingdom ("Convio", "we", "us"). We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, email privacy@convio.dev.
2. What we collect
Your account
- Your email address and, if you give one, your name.
- Your password, stored only as a salted, one-way hash (PBKDF2). We can't see or recover it.
- If you sign in with Google, the account identifier Google gives us. We don't receive your Google password.
- The invite you joined with: who it was for, when it was made and any note on it.
Sign-in and security
- A session for each device you sign in on: when it started, when it was last used and when it ends. The session token in your cookie is stored only as a hash.
- The IP addresses you use Convio from, the country they come from and your browser's user-agent string, for the dashboard and for your agent's API calls separately, with when each was first and last seen.
- Password reset requests: a one-time link we email you (stored only as a hash) and, in that email, the address, place and time the reset was asked for.
- If an account breaks our acceptable use rules: moderation records, such as a ban or suspension with its reason.
Using Convio with your agent
- Your API keys, stored only as hashes, with their name, first characters, when they were made and when they were last used.
- A log of the tool calls your agent makes: which tool, which skill or service, whether it worked, how long it took and when.
- Projects your agent starts: the goal it describes, the build plan's progress, and any answers and summaries it records.
- Skill packs you install.
- Services Convio lends your agent: what was borrowed, when and for what stated purpose, your daily usage, files your agent saves in its private storage, and databases made for you (the database itself is hosted by Neon; see section 6).
Your agent decides what it sends us. Please don't have it send passwords, payment details or other people's sensitive data in project goals, answers or stored files.
Visiting the website
- When a page has been open in a real browser for a moment, it reports one visit. We store a scrambled code (a salted hash of your IP address and browser, which changes every day) and a page count. We never store the IP address itself for this, and the code can't be linked from one day to the next. Crawlers and automated browsers aren't counted.
- Our hosting provider keeps short-lived technical logs of requests (such as the time, the address requested and the response) to run and protect the service.
3. Why we use it, and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating your account, signing you in and providing Convio's skills, build plans and lent services | Account, sessions, API keys, projects, tool-call log, lent-service records | Contract: we need it to provide the service you signed up for |
| Keeping accounts and the service secure; preventing fraud, abuse and scraping; enforcing our Terms | IP addresses, country, user agent, tool-call log, moderation records, rate-limit counters | Legitimate interests: protecting Convio and the people who use it |
| Sending password reset emails | Email, reset link, request address and time | Contract, and legitimate interests (account security) |
| Understanding how many people visit and how the service is used, so we can improve it | Daily visitor codes, aggregate usage counts | Legitimate interests: running and improving the service, with no profiling of visitors |
| Meeting legal obligations and responding to lawful requests | Whatever the obligation requires | Legal obligation |
We don't use your data for advertising, we don't sell it, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. The cookie notice
On your first visit we show a short notice explaining that Convio uses only essential cookies. Selecting "Got it" closes it for good. If you don't select it and simply carry on, opening another page or coming back later, we treat the notice as seen and accepted and don't show it again. Because the only cookies we use are strictly necessary ones that don't require consent, the notice is for your information: accepting it, or ignoring it, doesn't switch on anything extra. If we ever add optional cookies, such as analytics, we'll ask first, and they'll stay off unless you actively agree. Carrying on browsing will never count as agreeing to those.
7. Where your data is stored
Cloudflare operates a global network, and Convio's databases and Neon's databases may be located outside the UK, including in the United States (Neon's default region is US East). Where data leaves the UK, we rely on adequacy regulations (including the UK–US Data Bridge where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as offered by each provider.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account, API keys, projects, installed packs, tool-call log, IP and device history | While your account exists. Deleted when your account is deleted. |
| Sessions | Until you sign out or they end (at most 30 days, or 14 days unused) |
| Password reset links | 30 minutes, and deleted once used |
| Invites | Kept as a record of who invited whom |
| Files your agent saves in lent storage | Until your agent deletes them, or you ask us to |
| Databases made for you | 72 hours unless you claim them into your own Neon account |
| Daily visitor codes and page counts | Kept as anonymous statistics |
| Moderation records (bans and suspensions) | As long as needed to enforce them and prevent abuse. A ban on an email address can outlast the account. |
| Hosting provider request logs | A few days |
9. Security
Everything is sent over HTTPS. Passwords, session tokens, API keys, invite links and reset links are stored only as hashes. Sign-in is rate-limited, sessions expire, and access to member data is limited to Convio's administrators. No system is perfectly secure; if a breach affects your data and is likely to put you at risk, we'll tell you and the regulator as the law requires.
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of your personal data (access), in a portable format where it applies;
- correct data that's wrong (rectification);
- delete your data (erasure);
- limit how we use it (restriction);
- stop using it where we rely on legitimate interests (objection).
Email privacy@convio.dev from the address on your account. We'll reply within one month, and may ask you to confirm it's you. These rights have some legal limits; for example, we may keep a ban record to prevent abuse.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, or 0303 123 1113.
11. Children
Convio is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has given us personal data, contact us and we'll delete it.
12. Changes to this policy
We'll update this page when what we collect or how we use it changes, and change the date at the top. If a change is significant, we'll tell signed-in members before it takes effect.
13. Contact
Privacy questions and requests: privacy@convio.dev. See also our Terms of Service.