Effective: October 15, 2026
Asymptote Labs, Inc. (“Asymptote,” “we,” “us,” or “our”) makes Beacon, an open-source tool that captures and organizes the session history of AI coding agents, and the hosted Beacon Cloud service (formerly called Beacon Managed). We also offer an enterprise platform to businesses. This Privacy Policy explains how we collect, use, share, and protect personal information when you use our websites (beacon.sh, asymptotelabs.ai, and their subdomains), Beacon, and Beacon Cloud, and when you otherwise interact with us (together, the “Services”).
Beacon and Beacon Cloud are offered to individual developers, including developers who use them at work. Beacon Cloud is also offered on a Team plan, which an organization buys for its members. When you use Beacon Cloud, Asymptote decides how your information is used and is responsible for it as described in this Privacy Policy, except for content in a Team workspace, as described below.
Team workspaces. If you use Beacon Cloud through a Team plan, the organization that bought the plan decides who can join its workspace and what the workspace’s administrators can see, and it is responsible for telling its members about their use of Beacon. The workspace’s administrators can see the agent session activity and findings of each member of the workspace, as well as the workspace’s administrative audit log. Other members can see only their own agent session activity and findings, unless the organization gives them a role with wider access. When we process content in a Team workspace to provide the service, we do so on the organization’s behalf and under our agreement with it, and the organization is responsible for that processing. We remain responsible for our own use of that content for Research Uses, as described below, unless you opt out or an administrator turns off Research Uses for the workspace. We may share requests about content in a Team workspace with the organization, or ask you to direct them to it. If you ask us to delete content you sent to a Team workspace, we may refer your request to the organization.
Enterprise customers. This Privacy Policy does not apply to information we process on behalf of business customers of the Asymptote enterprise platform. We process that information under our agreements with those customers and on their instructions. If you are an employee or contractor of one of those customers and have questions about that information, please contact the customer. Beacon data is stored separately from data we process for enterprise customers, and we do not use enterprise customer data for Beacon research or model training, or sell or license it.
If you are in the European Economic Area or the United Kingdom, please also read the Notice to users in Europe below. You can print or save a copy of this Privacy Policy from this page.
| Topic | In short |
|---|---|
| What Beacon Cloud receives | Your agents’ activity from devices you connect, such as prompts, responses, tool calls, commands, file and repository information, and metadata, according to the capture mode you choose. If you also install the browser extension and turn on capture, it includes your prompts and responses on supported AI websites. This content can include code, confidential information, and information about other people. |
| Local use | Using Beacon locally or with your own self-hosted destination does not send your agent activity to us. |
| How we use it | To run Beacon Cloud for you, support you, keep the service secure, and produce usage metrics and aggregated statistics. |
| Research and training | On by default. You can opt out at any time in your Beacon Cloud account settings, and Beacon works the same either way. |
| Who sees it | Authorized Asymptote personnel when needed to support you or run the service (including for research, unless you opt out); and service providers that host and process data for us, including AI model providers under zero-data-retention terms, subject to limited exceptions. We do not sell your personal information. We may sell or license de-identified data that does not identify you or any other individual. On a Team plan, the workspace’s administrators can see your agent session activity and findings. |
| How long we keep it | While your account is active, then deleted on a set schedule. Aggregated and de-identified data may be kept indefinitely. |
| Your controls | Choose your capture mode, disconnect any device, export your data or ask us for a copy at no charge, cancel a paid plan in your dashboard, and ask us to delete your data by emailing privacy@asymptotelabs.ai. |
When you connect a device or source to Beacon Cloud, it sends us your agents’ activity as it happens (“Beacon Cloud Content”). Depending on the agent tools you use and your capture mode, this may include:
Capture modes. In Standard mode, your agents’ activity is sent as captured, including prompts, model responses, tool activity, command output, file diffs, and file contents returned by tools, except that common secret formats, such as API keys and tokens, are masked on your device before anything is sent. In Metadata only mode, prompts, model responses, reasoning, tool arguments and results, command output, file diffs, and file contents are removed on your device before anything is sent; only structural information is sent, such as which agent and tool ran, file paths, exit codes, token counts, timestamps, repository and branch names, and full command lines. Common secret formats in those command lines are also masked on your device before anything is sent. The browser extension also has its own retention setting (full, redacted, or metadata), which applies before its activity reaches Beacon on your device. Masking is pattern-based and automated and may not catch everything.
Information about other people and your employer. Your agents’ activity can contain information about other people (for example, names or email addresses in code, files, or prompts) and confidential information belonging to your employer or clients. We process that information as part of Beacon Cloud Content, as described in this Privacy Policy. Please connect only devices and sessions you are allowed to share.
Sensitive information. Please avoid sending sensitive personal information through Beacon, such as health information, government identification numbers, or information revealing racial or ethnic origin, religious beliefs, or sexual orientation. Use Metadata only mode for sessions that may contain it. We take steps to exclude detected sensitive information from research and training datasets, but detection is automated and may not catch everything.
Our websites use cookies and similar technologies that are needed to operate them, such as keeping you signed in and remembering your preferences. We also use Google Analytics and PostHog to understand how visitors use our websites. You can learn how to prevent Google Analytics from using your information at https://tools.google.com/dlpage/gaoptout. We use PostHog’s session replay feature, which records how visitors interact with our websites (for example, clicks, scrolling, and pages viewed) so that we can understand how they are used and fix problems. If you visit from the European Economic Area or the United Kingdom, we use Google Analytics and PostHog only if you agree through our cookie banner, and you can change your choice at any time. You can block or delete cookies in your browser settings, but parts of the websites may not work without them. We do not use cookies for targeted advertising. Some browsers send “Do Not Track” signals; because there is no common standard for them, we do not respond to them.
We use personal information for the following purposes:
Unless you opt out, we may use your Beacon Cloud Content sent on or after the Research Start Date for the following “Research Uses”: research and analysis of your content, including review by authorized Asymptote personnel; developing and improving our products and features; creating research and evaluation datasets, including de-identified datasets; evaluating, training, and fine-tuning artificial intelligence and machine learning models; and publishing, selling, or licensing de-identified datasets, as described below. The “Research Start Date” is the date the updated Beacon Terms of Service first apply to you. We use content you sent before the Research Start Date for Research Uses only if you have agreed.
On unless you opt out. If you opt out, we will stop using your content for Research Uses within 30 days, as described below. Your choice does not affect how Beacon works for you.
Changing your mind. You can opt out, or opt back in, at any time in your Beacon Cloud account settings (select your profile picture at the top right of the Beacon Cloud dashboard, then Settings). If you sent content before the Research Start Date, you can also agree to its use for Research Uses, or later withdraw that agreement, in the same settings. If you use a Team plan, the workspace’s administrators can also turn off Research Uses for all content sent to the workspace; while Research Uses are off for the workspace, we do not use that content for Research Uses, whatever your own setting, and within 30 days after an administrator turns them off, we remove that content from our research and evaluation datasets. If you opt out, within 30 days we will stop using your content for Research Uses and remove it from our research and evaluation datasets. We will not delete or retrain models already trained, or withdraw findings, published results, or aggregated statistics already produced using your content, or recall de-identified datasets already published, sold, or licensed.
Publication and sale of de-identified data. We do not publish or sell your content in a form that identifies you or any other individual. Anything we publish, sell, or license from research is aggregated or de-identified so that it does not identify you or any other individual and cannot reasonably be linked to you or your devices, and is reviewed before release. This applies only to Beacon Cloud Content; we do not sell or license data from the Asymptote enterprise platform.
Secrets. We exclude detected secrets, such as API keys and tokens, from research and training datasets.
De-identified data. Where we create de-identified data, we keep it in de-identified form, do not attempt to re-identify it (except to test that our de-identification works), and require anyone who receives or buys it from us to agree in writing not to re-identify it, not to attempt to identify any person or organization from it, and not to pass it on except under the same restrictions.
We do not sell personal information, and we do not share it for targeted advertising. We share personal information only as follows:
We may also share aggregated and de-identified information, which does not identify you or any other individual, as described above, including de-identified datasets that we publish, sell, or license to third parties.
We may need to verify your identity before acting on a request, usually by confirming it comes from, or by replying to, the email address on your account. Depending on where you live, you may have additional rights, described in the notices at the end of this Privacy Policy.
We keep personal information only as long as needed for the purposes described in this Privacy Policy:
| Information | How long we keep it |
|---|---|
| Beacon Cloud Content | While your account is active. We delete it within 30 days after you ask us to delete it or close your account. If your account has no activity for ten years, we will email you and, unless you become active again within 30 days, delete it. Memories and other information derived from your Beacon Cloud Content for your use are kept and deleted on the same schedule. |
| Research datasets | As long as needed for the research or training purpose. If you opt out or ask us to delete your data, we remove your content from these datasets within 30 days. |
| Aggregated and de-identified data; trained models | May be kept indefinitely. |
| Account data | While your account is active and for 30 days after it is closed. |
| Device and enrollment data | Kept with your account data: while your account is active and for 30 days after it is closed. Records of the choices you make when you enroll a device are kept as described below for records of your choices and consents. |
| Team information and administrative audit log | While the organization’s Team workspace exists, so that the organization can manage its workspace and review actions taken in it, and then on the same schedule as account data. |
| Records of your choices and consents | While your account is active and for ten years after it is closed, so that we can show what you agreed to. |
| Support and privacy request records | Three years. |
| Service logs and security events | As long as needed to operate, secure, and troubleshoot the Services. We set this period based on how long logs remain useful for diagnosing problems and for detecting and investigating security incidents, fraud, and abuse. Logs relevant to an incident or investigation are kept until it is resolved and any related legal obligations are met. |
| Website analytics and session recordings | According to the data-retention settings we choose in Google Analytics and PostHog. We configure them to keep this data only as long as needed to understand how our websites are used and to fix problems, and we review them periodically. |
| Business contact and job application data | Two years after our last contact with you, unless you ask us to delete it sooner. |
| Enterprise platform account data | While the customer’s account on the Asymptote enterprise platform is active, and then as set out in our agreement with that customer. |
| Marketing preferences | Until you unsubscribe. We then keep your email address on a suppression list so that we do not send you marketing emails again. |
| Backups | Deleted data remains in backups for up to 35 days until they are overwritten. |
We may keep information longer where the law requires it or where it is needed to resolve a dispute or enforce our agreements. For example, we keep billing and transaction records for seven years after the transaction to meet tax and accounting requirements, even if you delete your account. Data you store only on your own device or in your own self-hosted destination is kept according to your own settings and is not controlled by us.
Where this Privacy Policy does not state a fixed period, we decide how long to keep information by considering the purpose for which we collected it and whether we still need it for that purpose; the amount, nature, and sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; whether we can achieve the purpose in other ways, such as with aggregated or de-identified data; and any legal, tax, accounting, or reporting requirements. When we no longer need information, we delete it or de-identify it.
We use administrative, technical, and physical safeguards designed to protect personal information, including restricting access to Beacon Cloud Content to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee security. Because masking may not catch every secret, and Standard mode sends your sessions as captured, we recommend using Metadata only mode for sensitive work and rotating any credential you believe has been captured.
Asymptote is based in the United States, and we and our service providers store and process information primarily in the United States. If you use the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those where you live. Users in Europe should read the transfer information in the Notice to users in Europe.
The Services are not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you by email, in the CLI, or on our websites before the change takes effect. We will not use personal information we have already collected in a materially different way from what this Privacy Policy described when we collected it unless you agree.
Asymptote Labs, Inc.
Privacy questions and requests: privacy@asymptotelabs.ai
Mail: 36 Cooper Square, Floor 6, New York, NY 10003
This section applies to individuals in the European Economic Area and the United Kingdom (“Europe”).
Controller. Asymptote Labs, Inc. is the controller of personal information described in this Privacy Policy for the purposes of the EU General Data Protection Regulation and the UK General Data Protection Regulation (the “GDPR”). For content in a Team workspace, we act on the organization’s behalf when we process it to provide the service, and the organization is the controller of that processing; we remain the controller of our own use of that content for Research Uses.
Legal bases. We rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Running Beacon Cloud; support and troubleshooting; account management; service messages; billing and payments | Performance of our contract with you |
| AI-powered features using OpenAI and Anthropic | Performance of our contract with you |
| Service metrics and improvement; publishing aggregated statistics | Our legitimate interests in operating and improving Beacon and sharing insights about AI agent use, using metadata and aggregated data that do not identify you |
| Research Uses, including publishing findings, and publishing, selling, or licensing de-identified datasets, based on your content | Our legitimate interests in researching and improving our products and developing AI models. You may object at any time, without giving a reason, by opting out in your Beacon Cloud account settings, and we will then stop this use. This basis does not extend to sensitive information about you; we ask you not to send it and take steps to exclude it from research and training datasets. |
| Security and abuse prevention | Our legitimate interests in keeping the Services and our users safe; compliance with legal obligations |
| Business relationships and recruiting | Our legitimate interests in responding to inquiries, managing customer relationships, and hiring; steps taken at your request before entering into a contract |
| Legal and compliance | Compliance with legal obligations; our legitimate interests in establishing and defending legal claims |
| Marketing emails | Your consent, or our legitimate interests where the law permits |
| Analytics cookies and session replay (Google Analytics and PostHog) | Your consent |
Your rights. You may ask us to give you access to your personal information; correct it; delete it; restrict our processing of it; give you a copy in a portable format; or object to processing based on our legitimate interests (including service metrics and Research Uses). Where we rely on your consent, you may withdraw it at any time without affecting processing that took place before. To exercise these rights, email privacy@asymptotelabs.ai. You may also complain to the data protection authority where you live or work: in the EEA, see https://edpb.europa.eu/about-edpb/board/members_en; in the UK, contact the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
Transfers. When you use Beacon Cloud, you send information directly to us in the United States. When we share your information with service providers, we rely on the safeguards available under the GDPR, such as the European Commission’s standard contractual clauses (and the UK equivalent) or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK extension, as applicable. You may ask us for more information about these safeguards.
Automated decisions. We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.
If you live outside the United States and Europe, including in India, the laws where you live may give you rights over your personal information, such as rights to access, correct, or erase it, to withdraw consent, and to raise a grievance with us. To exercise any of these rights or raise a concern, email privacy@asymptotelabs.ai.
California. This Privacy Policy describes the categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it; how you can review and request changes to your information; and how we notify you of changes. We do not respond to Do Not Track signals, as explained under “Cookies and similar technologies.”
Nevada. We do not sell covered information as defined under Nevada law. Nevada residents may send questions to privacy@asymptotelabs.ai.