Privacy Policy

Last updated: March 2026 (Experiment Phase)

What We Collect

• Account information: email address, display name, and authentication provider
• Usage data: requests made, agents used, and execution metadata
• API keys you provide: stored to route requests to your chosen LLM providers
• Chat history: conversations and generated artifacts within your workspace

How We Use It

• To provide and operate the Aeqnt platform
• To improve routing, matching, and agent capabilities
• To enforce usage limits and prevent abuse
• To communicate with you about your account

Your API Keys

Aeqnt operates on a Bring Your Own Keys (BYOK) model. Your API keys are encrypted at rest and used solely to make requests to your chosen LLM providers on your behalf. We do not use your keys for any other purpose.

API calls are routed through our server to the provider using your keys. We process request and response data for platform functionality (agent routing, execution tracing, cost tracking) but do not store the content of your LLM interactions beyond what is needed to display results in your workspace.

Security Measures

• API keys are encrypted at rest using AES-256 (Fernet symmetric encryption)
• Passwords are one-way hashed with bcrypt (never stored in plaintext)
• Session tokens are generated and verified with HMAC-SHA256 signatures
• Code execution uses AST-safe sandboxing — no eval(), no exec(), no arbitrary imports
• Each user operates in a private, isolated workspace with strict data boundaries
• Public agent execution (via MCP/A2A) runs in stateless mode with no access to user data

Data Storage

Your data is stored on secure infrastructure using a multi-tenant architecture with logical per-user isolation. Each user has a private workspace directory — your agents, chat history, files, and configuration are separated from other users at the storage level.

API keys are encrypted at rest using AES-256 (Fernet). Passwords are one-way hashed with bcrypt. Session tokens are signed with HMAC-SHA256. No user can access another user's workspace, keys, or execution history.

Cross-User Agent Sharing

Users can expose agents publicly via MCP (Model Context Protocol) and A2A (Agent-to-Agent) protocols. When external callers invoke a shared agent:

• Execution runs in stateless mode — no access to the creator's workspace files
• No access to the creator's chat history or stored configuration
• No access to the creator's API keys (the creator's keys are used server-side for LLM calls, but are never exposed to the caller)
• Results are returned directly to the caller without persisting in the creator's workspace

Rate Limiting

All API endpoints are protected by rate limiting. Per-user and per-IP limits are enforced to prevent abuse. Public-facing endpoints (MCP, A2A) have tighter rate limits than authenticated user endpoints. Repeated violations may result in temporary or permanent access restrictions.

Third-Party Services

• LLM providers (Anthropic, OpenAI, Google, xAI, Azure OpenAI, Groq, Mistral, Cerebras, Together AI, OpenRouter) — called using your API keys
• OAuth providers (Google, GitHub) — for authentication only
• Cloudflare — for SSL termination, DDoS protection, and CDN

Data Retention & Deletion

Your data is retained as long as your account is active. You can request deletion of your account and all associated data by contacting hello@aeqnt.com. We will process deletion requests within 30 days.

Contact

For privacy-related questions: hello@aeqnt.com

Cookie Policy

Last updated: March 2026 (Experiment Phase)

Cookies We Use

Session Cookie (session_token)

Essential for authentication. Set when you log in, expires after 7 days. HttpOnly and Secure flags are set — cannot be accessed by JavaScript or transmitted over unencrypted connections. SameSite attribute is set to Lax to prevent cross-site request forgery (CSRF).

CSRF Protection

State-changing requests are protected against cross-site request forgery. Session cookies use the SameSite=Lax attribute, and sensitive endpoints validate request origin.

Theme Preference (aeqnt-theme)

Stores your light/dark mode preference in localStorage. Not transmitted to our servers.

Cloudflare Cookies

Our infrastructure uses Cloudflare for SSL termination and DDoS protection. Cloudflare may set its own cookies (e.g., __cf_bm) for bot management and security purposes. These are strictly functional and not used for tracking. See Cloudflare's cookie policy for details.

What We Don't Use

• No third-party tracking cookies
• No analytics cookies (Google Analytics, Mixpanel, etc.)
• No advertising cookies
• No social media tracking pixels

During the experiment phase, we keep cookie usage minimal. This policy will be updated if we introduce analytics before general availability.

Terms of Service

Last updated: March 2026 (Experiment Phase)

Experiment Nature

Aeqnt is currently in a limited experiment mode. The service is provided as-is, without guarantees of availability, performance, or continuity. Features may change, break, or be removed without notice. By participating, you acknowledge the experimental nature of the platform.

Your Account

Access requires admin approval during the experiment phase. You are responsible for maintaining the security of your account credentials. One account per person.

BYOK Model

Aeqnt uses a Bring Your Own Keys model. You provide API keys for LLM providers (Anthropic, OpenAI, Google, etc.). You are solely responsible for costs incurred through your API keys. Aeqnt does not charge for platform usage during the experiment phase.

Security

We implement multiple layers of security to protect you and the platform:

• All user-submitted code runs in restricted sandboxes with AST validation — no eval(), exec(), or arbitrary imports
• Per-user and per-IP rate limiting on all endpoints, with tighter limits on public-facing APIs
• Automated abuse prevention including request throttling and content policy enforcement
• API keys encrypted at rest, passwords hashed, sessions signed (see Privacy Policy for details)

Cross-User Sharing

You can expose your agents publicly via MCP (Model Context Protocol) and A2A (Agent-to-Agent) protocols. When you share an agent:

• External callers can invoke your agent, but it runs in stateless mode
• Callers have no access to your workspace, files, chat history, or configuration
• Your API keys are used server-side for LLM calls (creator-pays model) — keys are never exposed to callers
• You can disable sharing at any time by revoking MCP/A2A access on the agent

You are responsible for the agents you expose. Shared agents must comply with the Acceptable Use policy below.

Multi-Provider Support

Aeqnt routes requests to multiple LLM providers (Anthropic, OpenAI, Google, xAI, Azure OpenAI, Groq, Mistral, Cerebras, Together AI, OpenRouter) based on your configuration. You are responsible for complying with each provider's terms of service and acceptable use policies. Aeqnt is not liable for actions taken by third-party providers.

Acceptable Use

You agree not to:

• Use the platform for illegal activities or to generate harmful content
• Attempt to circumvent rate limits or security controls
• Share your account with others or create multiple accounts
• Reverse engineer the platform or extract proprietary algorithms
• Use automated scripts to interact with the platform at scale
• Use shared agents to intentionally exhaust another user's API budget
• Attempt to access other users' workspace data, API keys, or chat history
• Deploy agents that violate the terms of the underlying LLM providers

Data Portability

You can export your agents as portable packages (ZIP files containing agent configuration, skills, and metadata). You can export your chat history. You can request full deletion of your data at any time — see our Privacy Policy for details.

Intellectual Property

Content you create using Aeqnt (artifacts, agents, skills) belongs to you. The Aeqnt platform, including its routing algorithms, agent-building pipeline, and composable architecture, is proprietary.

Limitation of Liability

To the maximum extent permitted by law, Aeqnt and its operators are not liable for any indirect, incidental, or consequential damages arising from your use of the platform. This includes but is not limited to: costs from API key usage, data loss, or service interruptions.

Termination

We reserve the right to terminate or suspend access at any time during the experiment, with or without cause. You may leave the experiment at any time by requesting account deletion.

Contact

We're a small team building in public.