Privacy policy
Last updated 3 November 2026
In short. Otto keeps your research on your own computer. It works fully without an account. Only what you choose to put online goes there: an account, projects you share, and requests you send to the cloud assistant. You can download or delete all of it from inside the app at any time. We never sell your data, show you advertising, or use your data to train AI models.
Who we are
Otto is a research workspace for macOS and Windows made by Anirudhan Vijaykrishnan, an individual based in the United Kingdom ("Otto", "we", "us"). We are the data controller for the personal data described in this policy.
Questions or requests about your data: care@tryotto.work. General enquiries: hello@tryotto.work.
This policy follows the UK General Data Protection Regulation, the Data Protection Act 2018 and the EU General Data Protection Regulation. It covers the Otto app, the website at tryotto.work, and the emails we send.
What stays on your computer
- Your PDFs, library, reading progress, highlights, notes, pages and tasks are stored on your computer. We cannot see them.
- PDFs are never uploaded to our servers and are never sent to collaborators. They leave your computer only if you switch on the optional backup to your own Google Drive.
- Voice input is transcribed on your computer. Audio is never uploaded or kept.
- When you use Open & auto-attach, Otto looks at new PDFs in your Downloads folder for up to 30 minutes, on your computer only, to find the paper you asked for. It reads no other files and sends nothing anywhere.
- Sign-in tokens are kept in the macOS Keychain or Windows Credential Manager, not in ordinary files.
- Automatic library backups are made on your computer. They go to your own Google Drive or OneDrive only if you switch that on.
What we hold online, and why
We collect only what is needed for the feature you use. The lawful basis for each is listed in the last column.
| What | When | Why | Lawful basis |
|---|---|---|---|
| Email address, name, profile picture, profile links | You create an account | To run your account and show who you are to people you work with | Contract |
| Shared project content: paper details, highlights, comments, pages, tasks, queue, and who did what | You share a project | So your collaborators can see it and work on it | Contract |
| Assistant usage: model, tokens, cost, time | You use the cloud assistant or reading aloud | To enforce fair-use limits and pay providers | Legitimate interests |
| Feedback: your description, name and email if given, app version and system details | You send a report | To fix the problem you reported | Legitimate interests |
| Waitlist: email address and an optional line about your research | You ask for an invitation | To send your invitation by email | Consent |
| Invitation code and a random identifier for your computer | You enter an invitation code | To check that the code is valid and used where it was given | Legitimate interests |
Pages and comments you mark private are not shared with collaborators. We do not build advertising profiles, sell or rent personal data, or use your data to train AI models.
The assistant and reading aloud
When you ask Otto's assistant to do something with a cloud model, the text needed for that request is sent through our server to OpenAI or Anthropic to produce the answer. That text can include passages from the paper you are working on. We record how much each account uses, not what was asked. Both providers state that data sent through their business APIs is not used to train their models. To route a short request, and to check that a cited passage says what the answer claims, the request's text or that sentence and passage may also be sent to TypeSafe AI, Inc., whose decision model returns a choice and a probability. TypeSafe does not train or fine-tune models on customer input or personal data. Nothing else (no PDFs, notes or library) is sent to TypeSafe, and nothing is sent if you use a local model, are signed out, or switch these off in Settings → Otto ("Quick actions", "Check cited passages"). If you choose a model that runs on your own computer, no assistant request content is sent.
When you are signed in, after a search Otto can send the search's words and the titles and abstracts of its top 30 results (public catalogue records) through our server to Anthropic, which grades each result so Otto can offer a better order. Nothing from your library, notes or PDFs is sent with it. Switch it off in Settings → Otto ("Better search order").
Separately, when you publish or change your signed-in profile, your display name and the small cropped profile picture are sent to OpenAI’s Moderation API to check for inappropriate content before publication. This applies even if your assistant model runs locally. Private notes, searches, research quotes and PDFs are not sent for these profile checks. A failed check leaves your existing shared profile in place; signed-out profile edits remain on your computer. OpenAI’s moderation guide and API data controls describe its processing.
Reading aloud sends the passage being read to ElevenLabs to produce the speech. We do not store the passages.
The assistant can be wrong. Check anything that matters against the source.
Helping improve Otto (optional)
In the app, one switch, “Let Otto keep track of problems in the background”, turns on both of the following. It is in Settings → Privacy & data and in the feedback form, and it is off until you turn it on. Otto works the same either way, and you can turn it off at any time; nothing more is sent after that.
- Error reports (Sentry, EU (Germany)): when something in Otto breaks, what failed and where in Otto's code, with the app version and system. File paths, links, email addresses and quoted text are removed before sending, and no record of what you clicked or typed is attached. Lawful basis: consent.
- Anonymous usage statistics (PostHog, EU (Germany)): counts of what is used, such as a project made, a paper added, a PDF opened, a task Otto finished or failed, with the app version and system. Not linked to your account, name or email. Never titles, searches, highlights, notes, what you ask Otto, or your files. Lawful basis: consent.
Feedback you send from the app may be copied into our issue tracker (Linear) so we can work on it, without your name or email.
Who processes data for us
We use a small number of service providers. They act on our instructions under data processing terms.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Accounts, shared projects, usage records, feedback, waitlist | EU (Ireland) |
| OpenAI, Anthropic | Cloud assistant requests; OpenAI also checks shared profile names and pictures | United States |
| OpenAlex | Your email address, only if you ask it for your own free search allowance | United States |
| TypeSafe | Routing short assistant requests; checking cited passages | United States |
| ElevenLabs | Reading aloud | United States |
| Resend | Sending invitation emails, and passing Contact sales messages to our inbox (not stored by the website) | EU (Ireland) |
| Cloudflare Turnstile | Checking that an invitation request or Contact sales message comes from a person, not a script (browser signals; no cookies for advertising) | Global |
| PostHog | Website visit counts; in the app, anonymous usage statistics only if you allow them | EU (Germany) |
| Sentry | Error reports from the app, only if you allow them | EU (Germany) |
| Linear | Tracking work on feedback you sent (without your name or email) | United States |
| Sign in with Google; Google Docs and Drive, only if you connect them | Global | |
| Vercel | Hosting this website | Global |
| GitHub | Hosting downloads and app updates | Global |
Where data is transferred outside the UK or EU, it is protected by the provider's standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework, as each provider offers. For TypeSafe, these are the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum in its Data Processing Addendum.
- Sign in with Google gives Otto your name, email address and profile picture. We use them to create and show your account; shared names and pictures are checked before publication as described above.
- Google Docs and Drive are optional. Otto asks only for access to files it creates or files you pick yourself. It cannot see the rest of your Drive.
- Backups to your own Google Drive or OneDrive are off until you switch them on. Copies go there only; on OneDrive, Otto can see only its own folder (Apps › Otto).
Otto's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The Otto browser extension
The extension adds an "Otto" button under Google Scholar results. It reads only the one result you press (its title, authors, year, venue and links). When you press it, your browser fetches that paper's PDF from the publisher with your own access, and hands the paper and PDF to the Otto app on your computer (at 127.0.0.1). Nothing goes to us or to anyone else: the extension has no server of its own and collects no analytics.
It keeps on your computer only: a pairing token for the Otto app, the names of your projects (so you can pick one while Otto is closed), papers waiting for Otto to open, and which results you added. Removing the extension deletes them. It does not read other pages, your browsing history or any other result.
Other services you may connect
Zotero, Mendeley, Jira, Confluence, Zoom and Microsoft Teams are optional. Otto uses them only to do what you ask: to import or send references, to keep a project’s tasks or Notes in step with Jira or Confluence, or to create or open a call link. Otto never records or receives call audio or video.
Searching for papers sends your search words to public scholarly databases such as OpenAlex, Semantic Scholar, Crossref and PubMed. If you add a contact email in Settings, it is sent only to the services that ask for one (Crossref, PubMed, Europe PMC and Unpaywall).
The website and emails
This website sets no cookies and keeps nothing on your device to recognise you. It counts visits anonymously with PostHog (EU (Germany)): which page was viewed, and whether a download or an invitation request was made. Each page view gets a new random identifier, so visits are not linked to each other or to you. Never your email address, what you type, or your IP address as a profile. Lawful basis: our legitimate interest in knowing how people find and download Otto. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. You can also opt out here, which keeps a single “no” in this browser:
Our hosting provider keeps standard server logs, such as IP address and request time, for security, for a short period.
Invitation emails contain your invitation link and code. They have no tracking pixels and no tracked links.
How long we keep data
- Account and shared content: until you delete your account. Projects you own are deleted with it. In projects others own, what you wrote stays for them, without your name.
- Assistant usage records: for as long as your account exists.
- Feedback reports: until the problem is resolved and no longer than 24 months. They are deleted with your account.
- Waitlist: until you are invited or ask to be removed, and no longer than 12 months.
- Invitation records: for the testing period.
Your rights
You have the right to access, correct, delete, restrict or object to the use of your personal data, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
- Download your data: in the app’s Settings, under Your account: Download my data.
- Delete your account: in the same place: Delete my account. This erases your account and everything stored online for it immediately.
- Anything else, such as correcting data, leaving the waitlist or asking a question: email care@tryotto.work. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live. We would appreciate the chance to put things right first.
Security
All connections are encrypted with TLS. On the server, every shared table is protected by row-level security, so people only ever see projects they belong to. Provider keys stay on our server and are never in the app. The app runs under a strict content-security policy, and updates are cryptographically signed. No system is perfectly secure. If you believe you have found a vulnerability, please email care@tryotto.work.
Children
Otto is not intended for anyone under 16, and we do not knowingly collect personal data from children.
Changes to this policy
If we change this policy in a way that matters, we will say so in the app or on this website before the change takes effect. The date at the top shows the current version.