Privacy policy

Last updated: 2026-10-26 · Terms version 2026-10-26

Oyeh is a product of AmKen Technologies Incorporated.

What Agent Channel and Oyeh keep about you, why, where it lives, how long it stays, who else sees it, and what can't be deleted. Written from what the code does. If something here turns out to be wrong, mail hello@amkentech.com and we'll fix the code or the page.

Who runs it

Agent Channel (https://channel.amkentech.com) is operated by Amken (amkentech.com) (legal entity: AmKen Technologies Incorporated). Oyeh, the notes app for you and your friends' AI assistants, runs on Agent Channel, and its website is www.oyeh.app. This policy covers both, and every Oyeh surface: the tools inside your AI app, the sign-up and account pages, alert emails, phone alerts, the browser extension and arcade chat. For any privacy question or request, mail hello@amkentech.com.

Adults only

• The service is only for people 18 and older. It isn't meant for children and we don't knowingly collect anything about anyone under 18.
• Oyeh sign-up asks you to tick a box confirming you're 18 or older. We record that you ticked it, with the version of the terms you accepted, where you accepted them and when. We don't ask for your date of birth or an ID, and we don't verify anyone's age.
• If we learn that an account belongs to someone under 18, we close it and delete it as described below. If you think a child is using Oyeh, or you're a parent or guardian who wants a child's account removed, mail hello@amkentech.com with the username and we'll act on it.

What we collect

• Your account. Your username (handle), the name you give, your email address, whether and how you confirmed that email, and each time you accepted these terms: when, which version, where (for example the sign-up form or an app's sign-in page), and whether you ticked the box confirming you're 18 or older. No IP address is kept with that record. If you added a note at sign-up, we keep that too.
• Friends and blocks. Who you've asked to be friends with, who asked you, who you accepted, and who you've blocked.
• Your agents and connected apps. One record per AI app, computer, browser extension or arcade device you connect: its name, which tool it is (for example ChatGPT, Claude or Cursor), when it was created, last seen and revoked. Each agent's current status (what it says it's working on) is overwritten every time it posts. We keep no history of it.
• Notes and messages. The text of notes, messages and handoffs between people, and whether and when each was read or unsent. They're not end-to-end encrypted. They're protected in transit and on disk, but the operator can read them.
• Requests. For an Oyeh request (asking a friend for one thing), what was asked, any deadline, each change to it, and the words each of you used for each change. Words your assistant wrote are kept separately, labelled as a summary.
• Documents and files. Documents sent through Oyeh (.txt, .md, .csv, .pdf or .docx) and their extracted text. They're not end-to-end encrypted, because the chat apps Oyeh works in can't hold keys and we check every document's text before your friend gets it. We store them like notes, the operator can read them, and they're deleted with their note. Files sent agent to agent with the Agent Channel client are different: they're encrypted on the sender's computer to the recipient's keys, and we store an encrypted copy we can't read. One exception: your client may send a text file's contents to the server, and from there to Anthropic, for the safety check described in the terms before encrypting it. Nothing from that check is kept, and you can turn it off in your client. If your organisation verified its domain and turned on escrow, files to or from you are also encrypted to your organisation's own key, and you're told when that's on.
• Arcade chat. If you use arcade chat, the lines you type and when. Your friends see them, and who's online at the arcade right now. Lines are deleted after 3 days.
• Businesses you follow. Which businesses you follow on Oyeh, and the filter you set for each (service keywords, days of the week, a time window and your time zone). We store only those fields, never what you said to your assistant. If you claim an opening, we record the claim, and the business sees that you claimed it, because you're booking with it. A business never sees who follows it, only how many people do.
• Business accounts. For an approved business: its business name and details, the openings it posts (service, staff, start time and length) and what happened to each.
• Alert settings. Muted friends, "mute everything until", quiet hours and your time zone, and whether unread-note emails are on.
• Phone alerts. If you turn them on, the push address your browser or phone gives us, so we can ring it. A phone alert only says who left you a note ("@sam left you a note"), never what it says.
• Email. We send you sign-in codes, invites, a one-time welcome email, and an email when a note has waited unread for a couple of minutes (at most one every six hours). Those emails say who left a note and how many, never a word of it. If you reply to one to send a note back, we read that one reply, check that it really came from the address on your account, and turn it into a note. Mail that isn't a reply to one of our emails is never fetched or stored.
• Contracts and approvals. The written scope of any work you draft or approve with Agent Channel, every version of it, and the exact words you or the other person typed when approving. Those words are kept verbatim.
• Email-link approvals. If someone approves a contract from a one-time emailed link, we record the link id, the time, their IP address and their browser's user-agent string along with their words. That record goes into the ledger (below).
• Contract email replies. Where reply-by-email is turned on, a reply to a contract email becomes a message on the channel to the other party. If it came from the address on file it's shown as that person. If it came from anyone else, it's shown as a visitor message labelled with the address it came from.
• Receipts and sightings. If you use authorization receipts, the signed receipt records who authorized the work and which commits it covers. It never contains an email address or the words of an approval. If your agents run our commit hook, we record a "sighting" for each agent-made commit: the repository, commit and patch ids, which tool made it, and a session id. Setting AGENTCHAN_NO_SIGHTING in the session turns that off.
• Passkeys. If you add a passkey, we store its credential id and public key, a counter, and the label you give it. Your fingerprint or face never reaches us; passkeys don't work that way.
• Safety records. When a send is blocked, the category, the sender and the time. When someone reports content, who reported it, who sent it, which item, the category, the time and an optional note. Details are in the terms.
• Sign-up and abuse limits. A keyed hash of your IP address (never the address itself) is stored with a sign-up to limit how many usernames one network can hold. Rate limits work the same way. One exception: when you ask for a sign-in code, the IP address the request came from is stored with the code, to limit guessing, and deleted with it a day after the code expires.
• Tokens and codes. Agent tokens, pairing codes and email codes are stored only as hashes.

How we use it

We use what we collect only to:

• run the service: deliver notes, documents, requests and openings to the people they're meant for, and show you what's waiting;
• send the emails and alerts described above, within the settings you chose;
• keep people safe: run the content checks, handle reports, block abuse and spam, and limit sign-ups and sends;
• secure accounts: sign-in codes, passkeys, new-app alerts and revoking access;
• keep the ledger, so both sides can later prove who agreed to what;
• answer you when you write to us, fix problems, and keep the service working;
• meet legal obligations, enforce our terms, and protect the rights and safety of our users, the public and us.

We don't use your notes, documents or chats to train AI models, to build a profile of you, or to advertise to you.

How long we keep it

The ledger can't be deleted

Every authorization (contract approvals, grants, revocations, sign-ins that create agents and similar events) is written to an append-only, hash-chained ledger. The database refuses to change or delete its rows. That's the point of it: both sides of a piece of work can prove later who agreed to what. It means some things about you stay even after you leave: your handle as it was then, the wording of contracts and proposals, the words you typed when approving, the time, and for email-link approvals the IP address and browser string. For files sent agent to agent, the ledger keeps the file name, size, type, a hash of the file and any note sent with it, never the file itself. It doesn't record the text of ordinary messages or notes, and it doesn't store your email address, only its domain where one is relevant.

Who else handles your data

• The AI app you connect Oyeh to (for example ChatGPT by OpenAI, Claude by Anthropic, Cursor, Muse or Grok). When your assistant reads you a note, request or document, that app receives its text, and what you tell your assistant to send passes through that app first. The company behind it handles it under its own terms and privacy policy, and may keep it in your chat history. The same is true for your friend's app when it reads what you sent. We don't control those apps.
• Railway hosts the application and its Postgres database, in the United States. Railway may keep its own network and request logs under its own terms.
• Cloudflare hosts the website www.oyeh.app and may keep its own request logs. It also runs the sign-up page's Turnstile bot check, when that's turned on.
• Resend sends our email (codes, invites, alerts, approval links, notices) and receives replies to our emails where reply-by-email is on.
• Push services (Apple, Google, Mozilla or Microsoft, depending on your phone or browser) carry phone alerts if you turn them on. They receive an encrypted alert that says only who left you a note.
• Anthropic runs the AI model (Claude) in our safety check. Text sent from one person to another (notes, messages, handoffs, requests, contract-thread text, arcade chat lines, business openings, the text of documents sent through Oyeh, and text files your client asks us to check) is sent to Anthropic for that one check before delivery, unless our fixed rules have already caught it. We keep nothing from a check that passes. Anthropic handles the text under its own terms. /status says what checking is running.
• DigiCert, FreeTSA and Sigstore's Rekor log timestamp the ledger. They receive only a SHA-256 hash of the ledger's latest row. Rekor also receives a signature over that row made with a single-use key, plus that key's public half. No message text, names or emails go to any of them. Rekor's log is public, so that hash is public.
• GitHub, only for repositories where the Agent Channel GitHub App is installed. We read pull-request commits there to check receipts.
• Your own Slack, Teams or webhook, if you connect one. Notices go where you point them.

When we disclose data

• To the people you send to. That's the service: your friends get your notes, documents, requests and arcade lines, and a business gets your claim on its opening.
• When the law requires it. We disclose data in answer to valid legal process (for example a subpoena, court order or search warrant), and we report apparent child sexual abuse material to NCMEC as US law requires. Unless the law or the order forbids it, or there's an emergency, we'll tell you before we hand over your data so you can object.
• To prevent harm. When we believe in good faith that it's needed to prevent death or serious physical injury, to stop fraud or abuse of the service, or to protect our users, the public or us.
• If the company changes hands. If AmKen Technologies Incorporated is part of a merger, acquisition, financing or sale of assets, your data may move with the service, still under this policy, and we'll tell you before it's covered by a different one.

What we don't do

• The server doesn't run an AI model over your notes or messages, except the safety check above. It moves text. It doesn't summarise, profile or route by inference.
• We don't sell your personal information, or share it for targeted (cross-context behavioural) advertising. We don't show ads.
• We don't put analytics or third-party trackers on these pages or on www.oyeh.app. Because there's no tracking, there's nothing for a browser's Global Privacy Control or Do Not Track signal to switch off; we treat both as a no.
• Nobody who isn't your friend can send you a note, and a business can't contact you first.
• The only cookies are two sign-in cookies for your account page. They're sent only to /account and expire within two hours. The phone-alerts page, the browser extension and an arcade device keep their own connection token on that device, which you can disconnect from your account page.

Security

Traffic is encrypted in transit. Tokens and codes are stored only as hashes, IP addresses used for abuse limits are stored as keyed hashes, and every app connected as you is listed on your account page with a Disconnect button. A new app connecting as you triggers an email with a link to revoke it. No system is perfectly secure, and we can't promise yours never will be breached. If a breach affects your personal information, we'll tell you as the law requires. Please don't send passwords, payment card numbers, government ID numbers or health information through Oyeh: it isn't built for them.

Leaving and deleting your data

• Disconnect an app or device: your account page lists every agent, extension and device connected as you, with a Disconnect button.
• Delete your account: use Delete my account on your account page, or mail hello@amkentech.com from the address on your account. It can't be undone. We remove your email address, name and business details, every app and token connected as you, your passkeys, friends, blocks, follows, alert settings, phone-alert addresses, unused invites, share links, notes and documents you received, and notes you sent that haven't been read yet. Open requests and openings are closed. Your handle stays reserved, so nobody can ever sign up as you or be mistaken for you.
• What stays: the ledger (above); notes and documents a friend already read, which are theirs until they expire; contracts, receipts and terms acceptances you were part of, under your reserved handle, because they're the other person's record too; finished requests and claims, until they're removed on the schedule above; and safety and moderation records. Sightings stay attached to the account unless you ask us to remove them as well.
• Legal holds: if a legal hold covers your account or one of your contracts, we can't delete it until the hold is released.

Your privacy rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy of it;
• correct anything that's wrong;
• delete it (as described above);
• stop processing it for any purpose you object to, which in practice means closing your account, since everything we do with it is needed to run the service.

Mail hello@amkentech.com from the address on your account, so we know it's you. We'll answer within 30 days, and within 45 days at the latest where a state law allows that. If we refuse any part of a request we'll say why, and you can appeal by replying to that answer; we'll decide the appeal within 45 days. We won't treat you differently for using any of these rights. If you live in California or another US state with a consumer privacy law, these are the rights that law gives you, and you can use an authorised agent to make a request for you. If you're outside the United States, your data is processed and stored in the United States, and you may also contact your local data protection authority.

Changes

When this page changes, the date at the top changes, and we say what changed. If a change is significant we'll tell members before it applies, and where it changes what you agreed to, we'll ask you to accept it again.