Privacy Policy

Last updated: October 12, 2026

Baton is a desktop application developed and operated by Tafjord Invest AS ("we", "us", "our"), a company registered in Norway. This policy explains what data we collect, why, and how we handle it. Baton never sends us your code, files, project names, or AI agent conversations.

1. Data We Collect

When you purchase a license:

• Email address — provided during Stripe checkout. We use it to deliver your license key, send purchase-related communications, and send occasional product announcements (see Emails).
• Payment information — processed entirely by Stripe. We do not receive or store card numbers or billing addresses. We store your plan, purchase amount, and the card fingerprint Stripe provides (an identifier, not the card number) with your license record.

When you activate and use a license:

• License key — sent to our server to verify validity.
• Machine identifier — a SHA-256 hash of your operating system's device identifier, used to tie an activation to a device. The raw identifier never leaves your device.
• Machine name — your device's hostname (e.g. "Johns-MacBook"), sent only when you activate a license so you can tell your activations apart.
• Platform and app version — sent on activation and when Baton periodically re-checks your license.

App telemetry (always on):

• To count installs and active users, Baton sends a one-time install ping and a daily heartbeat containing: app version, operating system, CPU architecture, the name of the AI agent you have selected, whether Baton is licensed, your plan type, and which free-tier experiment group you are in. When you have not opted in to usage analytics, these contain no identifier — they are counted, not linked to you or to each other.
• Baton also reports a few free-tier and upgrade milestones (for example reaching the free workspace limit, starting or ending a trial, or activating a license) on the same anonymous basis, so we can compare how well different free-tier options work.
• When you add an SSH host, Baton reports where in the app you started (for example the Tips menu) with your app version, operating system, and CPU architecture, on the same anonymous basis. It never sends the host's name or address.
• Baton checks for updates and in-app announcements. These requests carry no personal data beyond what any web request includes (such as your IP address).

Usage analytics (opt-in):

• Baton asks whether you want to share usage analytics. Only if you agree, Baton adds a random, app-generated telemetry ID to the telemetry above and sends a daily usage summary: workspace counts by state, counts of workspaces, agent tabs and actions created, project setup adoption, sandbox (Lima VM) usage, terminal shell type, AI utility request counts, and licensing state. It also reports which agent you picked during setup and the first time you use an integration (agent notifications or MCP tools).
• With your consent, the telemetry ID is also attached to the checkout page when you upgrade from the app, so we can see whether in-app prompts lead to purchases.
• You can change this at any time in Settings → Privacy. Turning it off deletes pending usage data on your device and stops the telemetry ID from being sent.

Error reports:

• When Baton encounters an unexpected error or a process crash, it sends an error report containing the error message, up to 10 lines of stack trace, app version, platform, architecture, licensing state, and selected agent. Before sending, Baton removes your home directory, username, hostname, email addresses, URL credentials, and common API token formats. You can turn error reporting off in Settings → Privacy.

AI utilities:

• Baton's AI utilities generate workspace names, descriptions, and branch names from the prompts you give a new workspace, and generate commit messages from your staged diff when you ask for one. With the default "Baton managed" provider, this text is sent through a Baton-operated service to OpenRouter, which routes it to a model provider. We do not store this text, and we only use providers that do not train on your data. The contents of untracked files are never included in commit message requests.
• Workspace naming is on by default; branch naming is off by default; commit messages are only generated when you request them. You can turn these off or use your own OpenAI-compatible provider in Settings → General → AI Utilities, in which case requests go directly to that provider.

Remote control, SSH, and voice:

• Remote control is off by default. If you enable relay access, your paired browser or phone connects to Baton through our relay at remote.getbaton.dev. Terminal output, input, and workspace data are end-to-end encrypted between your devices; the relay only sees connection metadata (an install fingerprint, timing, and message sizes) and stores nothing. Direct mode connects without our relay.
• SSH workspaces connect directly from your computer to hosts you configure. Nothing passes through our servers.
• Voice input is transcribed entirely on your device. Baton only downloads the speech model from our download server.

Feedback and contact (user-initiated):

• If you submit feedback in the app, we receive your description, optional email address, up to three optional screenshots, and system information (app version, platform, OS version, licensing state, selected agent).
• If you use our contact form, we receive your name, email address, and message.

Website:

• We measure website visits with Umami in cookieless mode, and record which ad campaign or referral brought you to the site (for example UTM parameters or an ad click ID).
• If you ask us to email you a download link, we use your email address to send that one email and briefly keep it to prevent duplicate sends.

2. Emails

We send transactional emails (license keys, receipts and refunds) and occasional product announcements. Customers are added to our announcement list when they purchase; you can also join it from our website or contact form. Every announcement includes an unsubscribe link, and unsubscribing is permanent unless you sign up again yourself. We do not send third-party marketing.

3. How We Use Your Data and Legal Bases

• Delivering and validating licenses, processing payments, and sending transactional emails — performance of our contract with you.
• Opt-in usage analytics — your consent, which you can withdraw at any time.
• Always-on app telemetry, error reports, security and abuse prevention, ad conversion measurement, and product announcements to customers — our legitimate interest in operating, improving, and promoting Baton.
• AI utilities, feedback, and support — to provide the feature or answer you asked for.

We do not sell or rent your personal data.

4. Service Providers

• Stripe — payment processing. Privacy Policy.
• Cloudflare — hosting, database, file downloads, transactional email (Cloudflare Email Service), and the remote-control relay. Privacy Policy.
• OpenRouter — AI utility inference with the Baton-managed provider. Privacy Policy.
• Umami — cookieless website and app analytics, self-hosted by us. Our servers forward your IP address and browser user agent to it so it can count unique visitors; Umami does not store IP addresses.
• Google Ads — measuring whether ads lead to downloads and purchases. Its website tag may set cookies.
• Discord — private internal channels where our team receives feedback submissions (including screenshots), contact messages, error reports, and new-purchase and license alerts (which include the customer's email address).

Several of these providers are based in the United States and may process data there. Where data leaves the European Economic Area, we rely on the safeguards in each provider's data processing terms, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. Our Umami analytics instance is hosted in Europe.

5. Data Storage & Retention

• License and purchase records (email, license key, activations, plan, card fingerprint) are stored in a Cloudflare D1 database for as long as your license exists, and afterwards as long as needed for accounting obligations.
• Announcement list entries are kept until you unsubscribe; we keep the unsubscribed address only to make sure we don't email it again.
• Telemetry is not stored in our own database; Umami keeps aggregated analytics events.
• Feedback, contact messages, and error reports are kept in our internal Discord channels until we no longer need them.
• Our servers keep short-lived operational logs, which can include IP addresses and email addresses, under Cloudflare's log retention.

If you request deletion of your personal data, we will remove it within 30 days.

6. Cookies and Local Identifiers

Our Umami analytics runs in cookieless mode — no cookies or local storage are set by that script. The Google Ads tag may set cookies or similar identifiers to attribute ad clicks and conversions. The desktop app only stores a random telemetry ID in its local settings, and only sends it if you opt in to usage analytics.

7. Your Rights

Under the GDPR and applicable Norwegian law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing, including processing based on legitimate interest.
• Withdraw consent at any time, without affecting earlier processing.
• Receive your data in a portable format.
• Complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

To exercise any of these rights, contact us.

8. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. If a change materially affects data you have consented to share, we will ask again in the app.

9. Contact

Tafjord Invest AS
Contact us