Privacy Policy

Last updated November 2, 2026.

This policy explains what the hosted RunLater service (runlater.io and gateway.runlater.io), operated by OM.Network, LLC, collects and why. RunLater has no user accounts and does not sell personal information or use it for advertising.

What we collect

• Agent identities. For Agent Auth agents: their public keys, the name they give their host, their status and granted capabilities. For hosted MCP connections: the name and redirect address the MCP client registers, and its OAuth grant and tokens.
• What your agents schedule. Each task’s destination URL, method, headers and body, its schedule, lane and callback URL, and each attempt’s time and outcome (HTTP status or error). For crons and watches, the same request details, plus, for a watch, up to 16 KiB of the last response from the URL it polls.
• Payments. When someone buys attempts, Stripe collects their card details, email and billing information under Stripe’s privacy policy; we do not receive or store card numbers. We keep the payment’s Stripe id, amount, status, and which project it was for.
• Technical data. IP addresses are used to rate-limit registration, sign-in and payment endpoints, and Cloudflare records request logs (time, path, status, IP address) that we use to run and secure the Service.

How long we keep it

• A task’s body is deleted once the task succeeds or is canceled; a failed task keeps it so it can be retried. Finished tasks and their attempts are deleted 30 days after they finish.
• A watch’s request headers are deleted when the watch ends.
• Hosted MCP tokens expire after an hour, grants 30 days after last use, and registered clients after 90 days.
• Project balances and payment records are kept while the project exists and as long as we need them for accounting, tax and legal purposes.
• Request logs are kept by Cloudflare for a few days.

How we use it

Only to provide the Service: to deliver and retry requests, report results to your agents, apply limits and payments, prevent abuse, and fix problems. We may disclose information if the law requires it or to protect the Service and others from harm.

Who processes it for us

• Cloudflare hosts the Service and stores its data (Workers, Durable Objects, D1, KV, Queues, logs).
• Stripe processes payments.

Requests your agents schedule are sent to the destinations they choose; what those destinations do with the data is up to them.

Cookies

The site uses no analytics or advertising cookies. The hosted MCP consent page sets a short-lived cookie to protect the approval step. The payment page loads Stripe.js, which may set cookies Stripe uses to prevent fraud.

Your choices

Your agent can cancel tasks and delete crons at any time. To ask for a copy of a project’s data or for it to be deleted, email support@runlater.io with the project id; because there are no accounts, we may ask you to prove control of the project, for example by calling get_project with its agent. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA; contact us to use them.

Security

Traffic is encrypted with TLS, deliveries are signed, the internal API accepts only short-lived signed assertions from the gateway, and each project’s data is stored separately. No system is perfectly secure; tell us at support@runlater.io if you find a problem.

Children

The Service is not directed to children under 16, and we do not knowingly collect their information.

Changes

We may update this policy; the date at the top shows the latest version.

Contact

OM.Network, LLC · support@runlater.io. See also the Terms of Service.