Privacy policy
Effective 2026-10-14. Operated by AutoTenth ("AutoTenth", "we").
AutoTenth drafts time entries for lawyers from calendar, email, document and desktop activity. This page says exactly what we collect, where it goes and how long we keep it.
What we collect
- Account: your name, email address and a password hash, your firm name and your settings.
- Matters you enter: client and matter names, matter numbers, keywords, email domains, folder hints and rates.
- Activity metadata: from the calendar, mail and file connections you turn on and from the desktop capture agent: event titles, email subject lines, participant email addresses, start and end times, application name, and file names or paths.
- Time entries: hours, matter, narrative text, status and export history.
- Connection credentials: OAuth access and refresh tokens for Google, Microsoft or Clio. Device tokens for the capture agent.
- Billing: handled by Whop. We keep a membership id and a subscription status. We never see your card number.
What we never collect
We do not read or store email bodies, attachments, document contents, keystrokes, clipboard contents or screenshots. The mail permission we request is metadata only (headers, not message bodies). The capture agent sends titles and durations, never contents.
How we protect it
- OAuth tokens are encrypted with AES-256-GCM before they are stored. Device tokens are stored only as a SHA-256 hash and are shown to you once.
- Traffic uses HTTPS. Every query is scoped to your firm.
- The database is managed by Neon in the AWS US East (N. Virginia) region. The application runs on Vercel in the US East (Washington, D.C.) region.
- For abuse prevention we count requests per network address and per device token. Those counters use hashed keys and are deleted within a day.
How long we keep it
- Raw activity (titles, participants, paths, timestamps) is deleted automatically 90 days after the activity started.
- Time entries and narratives are kept until you delete them or ask us to delete your account.
- Sample-firm sandboxes created by the demo are deleted after 7 days.
- Deletion: email us and we will delete your account and firm data within 30 days. You can disconnect any connection and revoke any device at any time from the app; disconnecting stops new collection.
Who else handles data
- Vercel hosts the application and keeps request logs.
- Neon hosts the database.
- Whop processes subscriptions and payments, and runs its own page analytics on our marketing and checkout pages.
- Cloudflare sends sign-in and account emails.
- Google, Microsoft and Clio are the sources and destinations you connect yourself; we read and write only what the permissions you grant allow.
- An AI model provider (OpenAI or Anthropic) is used only if your firm turns on AI narratives and we have configured a provider. Then we send item titles, durations and the matter name. We do not send participants, file paths or message contents.
We do not sell your data and we do not use it to train models. The optional AI providers receive data through their commercial APIs, where they state that API data is not used for training by default.
Privilege and confidentiality
Titles and subject lines can reveal client names and the nature of work. You remain responsible for your professional duties of confidentiality. Review what you connect, and turn off AI narratives if your clients or jurisdiction require it.
Changes
If we change this policy in a way that affects your data we will update the date above and tell account owners by email.