Privacy

OpenArtifacts stores your published artifacts, the identity you sign in with, and records needed to run the service and process payments. For artifacts shared privately, we also store the addresses the owner invites and the addresses of people who request access. We do not sell your data or train models on your work.

• The artifact itself: its content, its title, and each version you push, until you unshare it.
• An account identifier, so your artifacts stay yours to list and remove.
• Timestamps for when an artifact was published and last updated.

Google or GitHub provides your verified email and the permanent id the provider uses for you. We store both with your OpenArtifacts account ID so your artifacts follow you across machines. We also keep token hashes, device labels, creation and usage times, and revocation records. Temporary approval and account-action records support sign-in and browser handoffs. Device polling secrets and one-use account handoff codes are stored as hashes; approval codes and handshake state are retained temporarily.

At sign-up, you can choose whether to receive product updates through our newsletter. We store that choice with your account. Unchecking the box does not affect your free account or publishing access. An account created to open a private artifact is not offered product updates.

• Passwords. We never see one.
• Full payment-card details. Payment details are handled by Stripe.
• Anything in your vault that you have not published.

Linking a Copilot for Obsidian license requires your explicit confirmation. The license key entered in that form is checked but not saved by the OpenArtifacts linking flow. License-key publishing keeps a hash and validation cache. We retain the confirmed association between account IDs so both accounts share a document collection; matching emails alone do not link accounts.

Browser account actions use a short-lived signed cookie containing your account ID, email, linked identity and expiry. Stripe stores payment and billing records. We keep your dedicated customer ID and the frozen request needed to recover an unfinished checkout. Publishing access is read from current provider and linked Copilot for Obsidian license state; we do not maintain a separate purchase ledger.

Reading a public artifact needs no account. Published HTML may include its own scripts, external resources or cookies. Pages ask search engines not to index them.

Every served artifact, public or private, shows a top bar with a Share button. The bar is the same for every reader and loads one script from api.openartifacts.ai, which reads and sets no cookie. Share opens a panel served from api.openartifacts.ai inside the page. If you sign in to that panel, a token for that one artifact is kept for 24 hours in the panel's own browser storage for api.openartifacts.ai, so you can change who can open the artifact if it is yours. The artifact's page never receives the token. While the panel collects it, we keep your account ID in a single-use record that expires after one minute.

Where scripts do not run, Share opens api.openartifacts.ai/share/{id}. A reader who can open the artifact but does not own it can copy its link there and change nothing. Anyone else is told the artifact is not available.

An owner can limit an artifact to invited people. We store each invitee's email address with that artifact, with the time it was added and whether the person can view or comment. We delete it when the owner removes that person or unshares the artifact. Switching to "anyone with the link" keeps the list. The invitation goes out once, when the address is added. It carries the artifact's title, the link and, when we know it, the owner's email address ("Shared by ..."). Each invitee therefore sees that address.

A signed-in reader who is not on the list can request access. We store that account's email address, never a typed one, and the request time with the artifact until the owner approves or declines the request or unshares the artifact. Switching to "anyone with the link" keeps pending requests. We email the owner once per new request, with the requester's address and the artifact's title, but only when we know the owner's address: an account owner, or a license owner's linked account. Approving sends the ordinary invitation, so an approved requester sees the owner's address as any invitee does. Declining tells the requester nothing, and a declined or pending requester never sees the owner's address.

Opening a private artifact needs a free OpenArtifacts account. A first sign-in asks the reader to accept the Terms, which creates the account. A reader signs in on api.openartifacts.ai with Google, GitHub or an emailed code. An account created with a code holds only its email address, with no provider ID. A code is six digits and is stored only as a keyed hash. It stops working after ten minutes or five wrong tries, and is deleted once used. Expired codes are cleared on a later request. Invitations, request notices and codes are sent through Cloudflare Email Service from share@mail.openartifacts.ai.

All of one publisher's private artifacts are served from one host, {label}.openartifacts.site. Its label is a one-way hash of the owner and is never stored. That host swaps a one-minute grant in the link for a one-hour cookie set on that host only, which opens only that publisher's artifacts the reader may read. OpenArtifacts sets no cookies on openartifacts.site.

The cookies we set for private sharing are these.

• __Host-oa_session on api.openartifacts.ai: a signed account ID, kept for 30 days. Only the sign-in, private-artifact and share pages read it. "Use another account" clears it.
• __Host-oa_login on api.openartifacts.ai: kept for up to ten minutes. It ties a Google or GitHub sign-in to the browser that started it, and is cleared when the sign-in ends.
• __Host-oa_grant on the publisher's {label}.openartifacts.site: kept for one hour and read-only. Every artifact is checked again on each request.

When an artifact's access changes, we record the owner's account ID, the access setting and how many people it is shared with, never an address. Views of private artifacts are counted per artifact, never per reader.

We use PostHog for website page views and explicit command-copy actions. Automatic event capture and session recording are off; anonymous visits do not create person profiles. Account-action pages are excluded from website analytics. Cloudflare serves requests and keeps operational logs.

Unsharing withdraws the link and starts removal of its stored files. It also deletes the artifact's invite list and pending requests. A permanent database tombstone keeps that link marked as withdrawn. Copies readers saved or cached cannot be recalled, and neither can copies opened before a public artifact was made private. An invited or requesting address belongs to the owner's artifact. It leaves when the owner removes it or declines the request, or when the artifact is unshared, not when the invited person's own account is deleted. Contact us to request account deletion. We may retain billing records required for bookkeeping and legal obligations, and records needed to prevent withdrawn links from being restored.

OpenArtifacts is open source. Run your own and this policy does not apply to it, because we never hold the data.

Questions about any of this go to logan@brevilabs.com.