Privacy Policy

Account and sign-in records.

• Your email address, which identifies your account.
• Sign-in links: when you sign in by email we store a single-use link token with your address. The link expires 15 minutes after it is sent.
• Dashboard sign-in sessions, held in a session cookie (rove_session) and a matching database record.
• API keys: we store a hash of each key, its prefix, its name, when it was created and last used, and whether it has been revoked. We do not store the key itself after showing it to you.
• OAuth grants, when you connect an MCP client to Rove: the client’s registration (name and redirect addresses), the scopes you approved, and hashes of the access and refresh tokens issued to it. To limit abusive client registration we keep a salted hash of the registering IP address for two hours.

Browsing session content. Rove runs a browser on your instruction or your agent’s. In doing so it processes:

• The pages the browser visits and their content, including accessibility trees, extracted text and data, which are returned to you in the API response.
• Screenshots the browser takes, and a video recording of a session when you turn recording on (record_video). These are session artifacts, described under storage below.
• For supervised sessions, a browser profile kept for your API key so that sign-ins persist between sessions: the browser’s cookies and site storage, a browsing history (address, page title, time, session, and whether the agent or a person was driving), and the list of open pages used to offer “restore pages”. Addresses that appear to carry credentials are recorded without their query string. The live view of a supervised session is streamed to your viewer while the session runs; it is not saved as a recording.
• Records of supervised-session control: when a viewer was admitted, when a person took or returned control, and how the session ended.

Usage and metering records. Per-request usage records (endpoint, outcome and credits used), supervised minutes metered per session, your credit balance and the credit ledger, and your spending and auto top-up settings.

Payment records. Payments are handled by Stripe. Your card details are entered with Stripe and never reach our servers. We keep the Stripe customer and payment identifiers, your purchases, refunds and subscriptions, and, for a saved card, its brand, last four digits and expiry date, plus the time you consented to off-session charges.

Technical records. Our API request logs record the method, the path (without its query string), the host and the requesting IP address. Error reports are described under sharing below.

Website. The website uses Google Analytics, which loads after your first interaction with a page (a click, key press, touch or scroll) and records your visit. If you use the support chat on the website, your messages are processed to generate replies, and if you type an email address into the chat, that address and the conversation are saved to our customer records (see sharing below).

• Operating the service: running browser sessions on your instruction, keeping supervised profiles so sign-ins persist, and returning results and artifacts to you.
• Metering and billing: counting credits and supervised minutes, taking payments and keeping the records of them.
• Security and abuse prevention: authenticating you and your agents, rate-limiting sign-in links and client registrations, and investigating errors.
• Support and service email: answering your questions and sending sign-in links, purchase and credit notices.

We do not use your data for advertising, and we do not sell personal data. We do not use the content of your browsing sessions to train machine-learning models; the service sends session content to no AI model provider.

• Application data (accounts, keys, OAuth grants, usage, metering and billing records) is kept in our production PostgreSQL database.
• Session artifacts (screenshots and video recordings) are stored under keys specific to each session. The service’s object storage for artifacts is Amazon S3; where it is not configured, artifacts are written to the disk of the API server. Links to artifacts held in S3 are pre-signed URLs that expire one hour after they are issued.
• Supervised browser profiles are encrypted (AES-256-GCM) and stored on a storage volume attached to our API server.
• Infrastructure: the website, the API and the browser workers run on Fly.io. Each supervised session runs in its own isolated worker machine.

We share data only with the service providers that run parts of Rove for us, and only what each needs:

• Fly.io: hosting for the website, the API, the browser workers and the profile storage volume.
• Amazon Web Services (S3): object storage for session artifacts.
• Cloudflare: the network edge in front of api.roveapi.com, through which API traffic passes.
• Stripe: payments. Stripe receives your email address and your Rove customer ID when a Stripe customer is created for you, and your card details when you pay.
• Resend: transactional email (sign-in links, purchase and credit notices). It receives your email address and the message.
• Sentry: error reports from the website, and from the API where error reporting is enabled there. API reports have query strings removed, and the website does not send cookies, request bodies or IP addresses with server error reports. Session replay is not enabled.
• Google Analytics: website visit analytics, as described above.
• OpenAI: generates the replies in the website’s support chat. It receives the chat messages, not your browsing sessions.
• Attio: our customer records. It receives the email address and conversation from the support chat when you type an email address into it.

We do not otherwise disclose personal data, except where required by law.

• Session artifacts. We have not set a fixed retention period for screenshots and recordings, and the service does not currently delete them automatically. The API lists a session’s artifacts only while the API process that saved them is running. To have artifacts deleted, contact us.
• Supervised profiles. Kept until you clear or delete them. History holds about the 10,000 most recent visits; older entries are removed as it grows. You can clear history or delete the profile through the API or MCP tools (clear_history, delete_profile) when no supervised session is using the profile. While a session is running or still ending, the request is refused: stop the session, or wait for it to end, then try again.
• OAuth records. Access-token records are deleted a day after the token expires. When a grant is revoked, its token records are deleted 30 days later. A client registration that never receives a grant is removed after seven days and purged 30 days after that. You can disconnect a connected app from the dashboard.
• Account, key and sign-in records. Kept while your account exists. Revoked API keys remain on record, marked revoked. Used and expired sign-in links are not reused but remain on record.
• Usage, metering and billing records (usage records, supervised minutes, the credit ledger, purchases and payments) are kept while your account exists, as the record of what was used and paid for.
• Account deletion. There is no self-service account deletion today. To ask for your account and its data to be deleted, email [email protected] from the address on the account.

For any privacy question or request, including access to or deletion of your data, email [email protected].

When we change this policy we update it on this page and move the date at the top.