Security

What we do with your access

Autone sends email from your inbox and reads orders from your store. Here is exactly what that means, in the words of the permissions we ask for.

Gmail

We ask for two Google permissions: send email on your behalf (gmail.send) and see your email address. That is the complete list.
We cannot read your inbox. We never ask for a read permission, so the engine sees nothing you receive.
Creators reply to a reply-to address on our domain (outreach.autone.app). That is how the engine sees their replies without touching your mailbox.
Every email the engine writes is sent as you, in your voice, and you approve the outreach before it goes. Nothing is sent that you have not seen.
Your Google tokens are encrypted at rest with AES-256-GCM. The key lives only in our server environment and is never written to logs.
Disconnect Gmail in Settings at any time, or revoke Autone in your Google account. Either one stops sending immediately.

Shopify

We ask for four scopes: read orders, read products, write discount codes and write draft orders. Orders are read to trace sales back to a creator. Products are read so the engine knows what you sell. Discount codes are created per creator so their sales can be attributed. Draft orders are used to ship gifted product.
We never change your theme, your prices, your customers or your settings.
Your Shopify access token is encrypted at rest the same way.
We honour Shopify's data-request, data-erasure and shop-erasure webhooks. Uninstalling the app or disconnecting the store stops all reads.

Payments

Subscriptions and creator payments run through Stripe and PayPal. Your card and bank details go to Stripe's hosted checkout and never reach our servers.
A payment to a creator is never sent without your explicit approval, at every plan and every autonomy level.

Where your data lives

The application runs on Vercel and Fly.io. The database is Supabase (Postgres).
Email address, creator conversations, shipments and attributed orders are stored for as long as your account exists.
To delete everything, email lucas@autone.app from the account address. Deletion is done within 30 days and confirmed by reply.

Questions about any of this go to the founder directly: contact.

Gmail

We ask for two Google permissions: send email on your behalf (gmail.send) and see your email address. That is the complete list.

We cannot read your inbox. We never ask for a read permission, so the engine sees nothing you receive.

Creators reply to a reply-to address on our domain (outreach.autone.app). That is how the engine sees their replies without touching your mailbox.

Every email the engine writes is sent as you, in your voice, and you approve the outreach before it goes. Nothing is sent that you have not seen.

Your Google tokens are encrypted at rest with AES-256-GCM. The key lives only in our server environment and is never written to logs.

Disconnect Gmail in Settings at any time, or revoke Autone in your Google account. Either one stops sending immediately.

Shopify

We ask for four scopes: read orders, read products, write discount codes and write draft orders. Orders are read to trace sales back to a creator. Products are read so the engine knows what you sell. Discount codes are created per creator so their sales can be attributed. Draft orders are used to ship gifted product.

We never change your theme, your prices, your customers or your settings.

Your Shopify access token is encrypted at rest the same way.

We honour Shopify's data-request, data-erasure and shop-erasure webhooks. Uninstalling the app or disconnecting the store stops all reads.

Where your data lives

The application runs on Vercel and Fly.io. The database is Supabase (Postgres).

Email address, creator conversations, shipments and attributed orders are stored for as long as your account exists.

To delete everything, email lucas@autone.app from the account address. Deletion is done within 30 days and confirmed by reply.

Questions about any of this go to the founder directly: contact.