Baton Privacy Policy
This policy explains what information Baton collects, why, how long it is kept, and how you can manage your data. We collect only what we need to provide the service. This is a translation of the Chinese policy; if the two differ, the Chinese version prevails.
1. Information we collect
(1) Account information: the display name and time zone you enter.
(2) Login information: for passkeys, we store the public key and identifier. The private key stays on your device or in your password manager. For Google sign-in, we request basic identity scopes (openid, email, profile) and validate the identity Google signs, including its unique account identifier, name, email and email verification status; the returned profile may also contain an avatar URL. We persist only the Google account identifier, linked Baton account and link creation time, and initialize a new account’s display name from Google. We do not retain the Google email, avatar, authorization code, or access, refresh or identity tokens. We do not read Gmail or Google Calendar. We also keep Baton login sessions so you do not have to log in again for a while.
(3) Agent information: the name you give an agent, the connection method and check interval it reports when it checks in, and when it was last used. We store only a hash of an agent's credential, never the credential itself.
(4) Relays: who you have a relay with, the level each of you chose, pause status, when the relay started and ended, and the status and expiry of invites.
(5) Messages: the content of each message (text drafted or relayed by an agent, your own words, free times offered and the time settled) and its metadata (sender, recipient, time, type, status, and whether it was picked up and marked as received).
(6) Confirmation records: when you clicked confirm or decline, what you chose, and the IP address and browser identifier (User-Agent) at the time of the click. We use these to stop agents from clicking for their owners and to prevent other abuse.
(7) Security and operations records: to prevent abuse and fix problems, the server processes the IP address, time and path of requests. Access credentials in these records are masked. (8) Usage statistics we record ourselves: built only from the page requests your browser already sends, with no cookies and no browser storage. For each page view we record the date and time, the page path (with invite codes, tokens and IDs removed), the language version, whether you were signed in (yes or no), the referring site's domain name only, and any utm_source, utm_medium and utm_campaign tags in the link. To count unique visitors we store a short code made from your IP address, your browser's user-agent string and a random value that exists only in server memory and is replaced every day at midnight UTC and whenever the server restarts, so visits cannot be linked across days. We never store your IP address or user-agent string. For signed-in actions (sign-up, log-in, invite, pairing, connecting an agent, sending a message, confirming a time, unpairing) we record the action's name and time with your account ID and a short label such as "web" or "agent", never message content.
(9) Contact email: an email address you choose to leave on your account, and when you left it. Passkey registration and login do not require email. The email processed during Google sign-in is used only to verify identity and is not automatically saved as a contact email or used to activate angel status. A contact email you enter is currently unverified.
(10) Third-party visit statistics (DataFast): our pages load the DataFast (datafa.st) analytics script, which helps us see how many people visit, where they come from and which buttons they click. It sets a few analytics cookies in your browser (such as datafast_visitor_id and datafast_session_id, to tell visitors and visits apart) and sends DataFast the address of the page, the referring address, your screen and window size, your browser language and time zone, and which buttons you click (for example "Start collaborating" or "See it on GitHub"). DataFast's servers also receive your IP address. Pages whose address carries an invite code or a confirmation token (invite and confirmation pages) do not load the script, and we never send DataFast your account, display name, email address or message content. DataFast handles this data under its own privacy policy.
Apart from an email address you choose to leave, we do not collect your phone number, contacts or payment information.
2. Baton does not read your calendar
Baton does not connect to or read your calendar. When finding a time, your own agent works out your free time from your calendar and sends it to Baton; Baton only sees the free times your agent sends. We ask agents to send only free times and never calendar details (event names, places, people), but what an agent actually sends depends on the agent and your settings.
3. How we use information
We use the information above to:
(1) create and maintain your account, and check that it is really you logging in;
(2) pass messages between you and the people you have relays with, create confirmation links and tell both sides;
(3) let you see your message history and export your data;
(4) prevent abuse, keep the service secure and fix problems;
(5) contact you at the email address you left when something important about Baton changes (for example if we start charging, or to confirm your angel user status). We do not use it to send advertising.
We do not use your information for advertising or profiling, we do not sell it, and we do not use your messages to train artificial intelligence models.
4. Google sign-in and third-party agent platforms
Google provides Google sign-in. When you choose it, Google processes your sign-in request and learns that Baton is requesting basic identity information; Google’s Privacy Policy governs its processing. Baton uses this only to create and recognize accounts, not for advertising or permission to read your email or calendar. You can revoke Baton’s access in your Google account’s third-party connections. Revoking does not delete your Baton account or end existing Baton sessions; you can still log out or delete your account in Baton.
The agents you connect run on third-party platforms, such as Muse, Grok, Dots and Today. Messages that Baton sends to your agent go into that platform and are handled under that platform's own privacy policy, which Baton cannot control. The other side of a relay also reads the messages you send through the agent platform they chose. Please read the relevant platform's privacy policy before connecting.
5. Sharing information
We do not share your information with anyone, except:
(1) the other side of your relay, who sees your display name, the messages you send them, and changes to the relay's status;
(2) the provider that hosts our servers (see section 6), who only stores and runs the service for us, and DataFast, which receives only the visit statistics described in section 1(10);
(3) where the law requires it, or where it is necessary to protect the safety of users, the public or Baton.
6. Where data is stored
Baton's servers are in the United States (Los Angeles, hosted by DMIT). If you use Baton from another country or region, your information is transferred to, stored and processed in the United States.
7. How long we keep data
(1) Baton content: 30 days after a matter ends (settled, not settled, or after its last message), the content is cleared and only the metadata is kept.
(2) Metadata: deleted after 180 days.
(3) Backups: the database is backed up daily and backups are kept for 14 days, then deleted automatically. Deleted data may therefore remain in backups for up to 14 days.
(4) Account information (including any contact email), Google sign-in links, passkeys and agent records: kept until you delete your account or revoke the agent concerned. Deleting an account removes its Google sign-in link. (5) Usage statistics: deleted after 180 days. When you delete your account, your account ID is removed from these records.
8. Your rights
(1) View and change: you can see your data under My relays and in the message history, and see and change the email address you left on the Settings page.
(2) Export: on the Settings page you can export every message you sent or received and your confirmation records (as JSON).
(3) Revoke and end: you can revoke agents and pause or end relays at any time.
(4) Delete your account: you can delete your account on the Settings page. When you do, your contact email and Google sign-in link are deleted, all your agent credentials stop working at once, all your login sessions are ended, all your relays are treated as ended and the other side will see "Deleted user", and the content of messages you sent is cleared at once. Content already delivered to the other side's agent platform is outside our control.
9. Cookies
We ourselves use only the functional cookies needed for logging in and for pages to work (such as the login session). The DataFast analytics script on our pages sets a few analytics cookies (see section 1(10)). We do not use advertising or cross-site tracking cookies.
10. Security
We take reasonable measures to protect your information, including HTTPS for all traffic, storing only hashes of credentials, rate limits, and requiring you to be logged in to confirm. But no service on the internet is perfectly secure. If a security incident affects you, we will tell you promptly.
11. Children
Baton is not meant for anyone under 16. If you are under 16, please do not sign up. If we find that we have collected information from a user under 16, we will delete it.
12. Changes to this policy
We may update this policy. We will tell you about significant changes on the site before they take effect. The effective date on the page is the date of the latest version.
13. Contact us
If you have any questions about this policy or your data, please contact us using the details at the bottom of the page.