Privacy Policy

Effective date: October 30, 2026
Controller and operator: Bottomless, Inc.
Business address: 1522 Western Ave, Suite 64864, Seattle, WA 98101
Privacy contact: hello@bottomless.com

1. Scope and overview

This Policy explains how we handle personal information in connection with Agent Duel applications and hosted services. It applies to users generally, including users who do not pay for the service.

Agent Duel is a development and evaluation service that records work-related content and activity. Our permitted business uses include research, AI training, benchmarking, product development, and commercial datasets. Where allowed by law and applicable choices, we may publish, license or sell information derived from or included in your work, including source code and individual records. These uses are not limited to anonymous statistical summaries.

Some features and collection sources depend on the version, permissions and integrations you use. The Terms describe the intellectual-property permissions you grant; this Policy does not eliminate applicable privacy rights.

2. Information we collect

Account and authentication information. We collect email addresses, account identifiers and, when supplied through sign-in, names, profile images and identity-provider identifiers. We process session and authentication records, timestamps, and network information used for security and abuse prevention. Signing in through Google or GitHub provides profile and email information within the permissions shown by that provider.

Work content. We collect prompts, messages, instructions, model outputs, transcripts, code and patches, project context, tool activity and results, and attachments or images included in the work. Images may include screenshots that an agent reads. Work content can contain personal information about you or others.

Authorized project and connected-source information. Features you enable may access files, repositories, histories, versions, development environments and connected services relevant to your work. Information may be obtained automatically rather than manually uploaded, including related project context and changes made in other tools. Additional private-source access is limited by the relevant authorization. We may also obtain lawful publicly available information relevant to the work and combine it with information collected through the service.

Evaluation and interaction information. We collect votes, ratings, comparisons, model and run metadata, performance and timing information, and review activity. Review activity may include files and tabs viewed, scrolling depth, preview use, interface focus and blur, time spent reviewing, and interactions with voting controls. We may derive estimates of engagement, effort, preferences, work quality and model performance.

Feedback and support information. We collect feedback text, ratings and account details. When session context is attached, it can include conversation timelines, tool activity, repository status, branch and reference information and change summaries. Feedback may also contain application version, operating system, locale and other diagnostic details.

Crash reports. When part of the Agent Duel application crashes or stops unexpectedly, the application automatically sends us a crash report linked to your account: which part failed, the error message and stack trace, the exit code or signal, when it happened, the application version, operating system and locale, and the last lines of the application's local logs. Those log lines can include file and project paths, your computer's name, local network addresses and other details of what the application was doing at the time. We use crash reports to find and fix failures in Agent Duel.

Automatic uploads in the hosted service. When you use the official hosted service, the application automatically sends selected work and research records to our cloud service as work progresses; you do not need to press a separate upload button. These records include conversations and transcripts, run and generation records, session archives, comparisons, votes and ratings, review activity and timing, transcript and code-patch artifacts, and images, including pasted images and screenshots read by agents. Code, file contents, terminal output and other project information can appear in transcripts, tool inputs and results, and patches. Cloud records are associated with your account and source records; removing a name from an individual record does not make the collection anonymous.

Local records and model processing. The application also stores history locally. Information needed for model calls is transmitted through a separate model-processing path. Full per-call request and response artifact copies are excluded from the current research upload path, but their contents can still appear in transcripts or be processed by a model. Collection is subject to technical limits and may not include every record. The current hosted upload path does not by itself copy every file on your device or automatically gain access to every private repository or account. Broader discovery depends on the features and permissions you enable as described above. Source builds using a user's own provider key do not use the hosted research uploader, but model requests still go to the selected provider. This Policy applies to information actually received or processed by us.

3. How we use information

We use information to:
- Provide accounts, model access, agent execution, comparisons, support and other service features.
- Maintain security, prevent abuse, debug problems and manage reliability.
- Measure engagement and work patterns, evaluate effort or contributions in applicable programs, and assess model and agent performance.
- Conduct research, create benchmarks, analyze software development and publish findings.
- Train, fine-tune, test, validate and improve AI models, evaluation systems and other products, including systems developed with or licensed to third parties.
- Create, enrich, annotate and commercialize datasets and analytics; publish, license, sell or otherwise provide permitted information and derived products to researchers, AI developers and other commercial recipients.
- Comply with law, maintain necessary records, resolve disputes and carry out legitimate corporate transactions.

Human reviewers and automated systems may perform these activities. Where an automated assessment affects compensation or another significant interest, any applicable program procedure and legally required information, review, or challenge rights will be provided.

These purposes remain subject to applicable law, legal bases and privacy choices. We obtain separate consent or provide additional choices where required. We do not treat acceptance of general terms as permission to disregard those requirements.

4. Who receives information

Service providers. We use hosting, database, authentication, communications, model-routing and model-inference services. The application routes hosted model calls through OpenRouter and its selected model providers, uses a Vercel-hosted control plane with MongoDB storage, and uses SendGrid for email. Google and GitHub support optional sign-in. Providers receive the information needed for the features they perform. Provider information is available at:
- OpenRouter: https://openrouter.ai/privacy
- Vercel: https://vercel.com/legal/privacy-notice
- MongoDB: https://www.mongodb.com/legal/privacy/privacy-policy
- Twilio / SendGrid: https://www.twilio.com/en-us/legal/privacy
- Google: https://policies.google.com/privacy
- GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

These links describe the providers' practices; they do not replace this Policy or establish the settings of Bottomless's accounts with those providers.

Model processing. Prompts, relevant code and project context, conversation history, tool results and attachments may be transmitted to model providers. Provider retention, logging and training practices depend on the provider, the applicable terms and the settings in use. We do not make a universal promise of zero retention or no provider training. Relevant information is available in OpenRouter's data-collection guidance (https://openrouter.ai/docs/guides/privacy/data-collection) and provider-logging guidance (https://openrouter.ai/docs/guides/privacy/provider-logging), together with the applicable provider terms referenced above.

Commercial and research recipients. Where lawful and consistent with applicable choices, we may disclose, publish, license or sell work-related content, evaluation records, activity information and derived datasets to AI developers, researchers, data customers, business partners and other recipients. These recipients may use the licensed material for their own research, training, development, evaluation and commercial purposes. Information is not necessarily anonymized before these disclosures; it may be associated with individual records or accounts. We impose restrictions or obtain additional permission where required by law.

Other recipients. We may disclose information to advisers and authorities where legally appropriate, to protect rights and security, and in connection with a merger, financing, acquisition, reorganization or asset sale, subject to applicable law.

5. Retention and security

We retain information for as long as reasonably necessary and legally permitted for the purposes described above. Retention depends on the type of information, its role in research and datasets, ongoing service needs, contractual requirements, security, legal obligations and applicable rights. Different records may be retained for different periods.

Signing out or uninstalling the application does not itself delete information already stored by us. Local application records and cloud records are separate. A content license does not override our deletion commitments or a legal obligation to delete personal information.

Deletion requests. Email hello@bottomless.com to request deletion of your account or particular data. Our team handles these requests manually; you do not need an in-app deletion button. We will delete the requested account-linked personal information and work records from active systems under our control within 30 days after receiving your request, or sooner if applicable law requires. This includes the research records, transcripts, code patches, images and feedback covered by your request, including copies in active internal exports and support records under our control. We may need reasonable information to verify your identity and locate the records; we will request it promptly and handle any effect on the deadline as applicable law permits. If we must retain limited records for legal obligations, payment and tax records, security or legal claims, we will explain the applicable exception and restrict retained information to those purposes. We will confirm completion and explain any retained categories. Copies on a device you control must be removed from that device; we can provide instructions.

Backup copies, if any, may remain until overwritten or expired under the applicable backup-retention schedule, to the extent permitted by law. While retained, those copies will be isolated from ordinary use, and relevant deletions will be reapplied before restored data is returned to ordinary use. We do not promise that every backup or independent third-party copy is erased within the same 30-day period. We will instruct service providers acting on our behalf, and notify other recipients, to delete or act on the request as required by applicable law. Information that has been irreversibly anonymized so it cannot reasonably be linked to a person may be retained; removing a name or replacing an account identifier alone does not make information anonymous.

We use reasonable safeguards appropriate to the information and service. No system is completely secure. Do not assume that work content is automatically stripped of credentials, personal information or confidential material before transmission.

6. Choices and rights

You can control which private sources you connect or authorize and can disconnect them. You may contact hello@bottomless.com to request access, correction, deletion, an export, account closure, or information about our practices. We respond to privacy requests within 30 days, or sooner if applicable law requires. The deletion commitment and limited exceptions are described in Section 5.

Depending on your location and the applicable law, you may also have rights to withdraw consent, object to processing, restrict processing, opt out of sales or certain sharing, limit use of sensitive information, challenge certain automated decisions, appeal a request decision, or complain to a regulator. We may need to verify identity for some requests and may apply lawful exceptions. Rights that cannot be waived are not waived by the Terms.

Where sale or sharing opt-out rights apply, email hello@bottomless.com with the subject "Privacy request" and describe your request. Where processing relies on consent, you may withdraw that consent by emailing hello@bottomless.com. Withdrawal does not itself invalidate processing that was lawful before withdrawal.

A control that disconnects a source is not automatically a control that opts out of further use or sale of information already collected. Use the applicable privacy request or choice mechanism for those requests.

7. International processing

Information may be processed in the United States and other countries where we and our recipients operate. These countries may have different privacy laws. Where applicable law requires transfer safeguards or additional regional disclosures, we use the required safeguards and provide the required information. Contact hello@bottomless.com for information about applicable safeguards and how to obtain a copy where available. This contact method does not replace disclosures that applicable law requires us to provide directly.

8. Children and changes

Agent Duel is intended for adults aged 18 and over. If you believe a child has provided personal information, contact hello@bottomless.com.

We may update this Policy and will identify the effective date. We provide additional notice and obtain additional consent where required for material changes or new processing.