Privacy Policy

Last updated: October 29, 2026

This Privacy Policy explains how Apache A-X Cybernetic Enterprises, LLC, a Delaware limited liability company ("Doco", "we", "us" or "our"), collects, uses, shares and keeps personal information when you use doco.to and everything we offer under the Doco name, including its website, MCP server, APIs, hook script, integrations, assistant and emails (together, the "Service"). It applies alongside our Terms of Service (the "Terms"), and words the Terms define, such as "Your Content" and "Output", mean the same here.

Please read Sections 8 and 17 carefully. Section 8 says that no system is completely secure and that, as the Terms say, Doco accepts no responsibility or liability for lost data, hacks or anyone accessing your information, whether you pay for the Service or not. Section 17 says that this Privacy Policy is not a contract and that disputes about your information are resolved under the Terms, through individual binding arbitration.

1. Information we collect

Information you give us. When you create an account, we collect your email address, your username and the name you choose. We store your password only as a one-way hash, never the password itself. When you add a passkey, your device sends us its public key and details about the passkey provider; the passkey's private key stays on your device or in your passkey manager. When you set up an authenticator app, we keep the secret it makes its codes from, encrypted. We also collect what you put into the Service, such as decisions, rules, logs and other records, policies, chat messages and attachments, and the email addresses of the people you invite, and anything you send us, such as bug reports, ideas, help requests and emails.

Information your agents and integrations send us. When an agent you connect uses the Service, through the MCP server, the APIs or the hook, we receive what it sends, such as its questions, what it records, and its name and version. If you install the Doco hook, it sends us parts of your prompts and the file paths your agent works on, as the instructions for agents page describes. When you connect an integration, such as GitHub, Slack, Notion or Google Drive, we receive and keep copies of the data it makes available, such as repositories, pull requests, issues, messages, pages and documents, with the names, usernames, email addresses and other details of the people in them, along with the tokens that let us keep that data in sync.

Information we collect automatically. When you or your agents use the Service, we and our service providers automatically collect information such as IP addresses and the approximate location they indicate; browser, device and operating system details; language; referring pages; the pages you visit and the actions you take; the tools your agents call; and timestamps, response times and errors. A bug report or help request you send from within the Service also includes details of the page you are on, such as its address, any text you selected, your recent activity on the page, and your screen and browser.

Information from others. Other people may give us information about you, for example when a teammate invites you by email, mentions you in their content, or connects an integration that holds your messages or work.

2. How we use information

We use the information we collect to:

provide, operate and maintain the Service, including to sign you in, to keep your workspaces and collections in sync with the integrations you connect, and to answer your agents;
produce Output, such as Señor Doco's replies, briefs, summaries, search results and the activity digest;
send you emails about the Service, such as sign-in and confirmation links, invites, alerts, setup reminders, the activity digest and news about Doco;
understand how the Service is used, measure its performance, fix problems, and develop, test and improve the Service and new features;
protect the Service, our users and others, including to detect, investigate and prevent fraud, abuse, security incidents and violations of the Terms;
comply with the law and legal process, and establish, exercise and defend our rights; and
do anything else we describe when we collect the information, or that you consent to.

We may also create aggregated or de-identified information that does not reasonably identify you, and use and share it for any lawful purpose.

3. AI models

The Service uses AI models to work with Your Content, including models that third parties run. To produce Output and to index Your Content for search, we send those providers the relevant parts of Your Content, your questions and your agents' requests, and they send the results back to us. Their handling of that information is governed by our agreements with them and by their own terms and policies, which we do not control. Output is generated automatically and may be inaccurate, including about you or other people, as Section 4 of the Terms says.

We share personal information:

With our service providers, who help us run the Service, such as hosting, database, email delivery, AI model, search, customer support and security providers, so that they can provide their services to us.
With the people you work with. What you put into a workspace or collection is shared with its members, and with anyone they invite or grant access, according to the access you and they set. Anyone signed in to Doco can open your profile, which shows your name, your username and your activity in the collections they can read. A workspace's owners can see who belongs to it and manage their access.
With the agents and integrations you connect, as you direct. When an agent reads from Doco, or an integration such as Slack receives what Doco posts, Doco sends it the information it asks for or is set up to receive.
With the public, when you or someone in your workspace makes a collection or a profile public, as Section 5 describes.
For legal reasons and to protect Doco. We may access, keep and disclose information if we believe in good faith that doing so is necessary or appropriate to comply with the law or with a subpoena, court order or other legal process or government request; to enforce the Terms or our other agreements; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Doco, our users or others.
In a business transfer. If Doco is involved in, or preparing for, a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets or similar transaction, information may be disclosed in due diligence and transferred as part of that transaction, and whoever receives it may use it as this Privacy Policy describes.
With our affiliates, who may use it as this Privacy Policy describes.
With your consent or at your direction.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising.

5. Public information

Some of the Service is public by design. Anyone can read a public collection, with its records and the activity in it, without an account, including search engines and AI agents, through the website, the public MCP server, the sitemap and llms.txt. A public profile shows anyone your name, your username and your activity in public collections, and links to it preview as your activity graph. Others may copy, keep and share again what is public, and we cannot recall it once it has been published, even if it is later made private or deleted. Choose what you make public with care.

6. Your organization and other people's information

If you use the Service for a company or other organization, that organization may control your access to its workspaces and collections, and may access, keep and delete what is in them. Its own policies govern what it does with that information, and we are not responsible for them.

Your Content may include personal information about other people, such as your teammates, your customers and the authors of the messages, issues and documents your integrations bring in. Doco processes that information on your behalf and at your direction, to provide the Service. You are responsible for having a lawful basis to give it to us, for giving those people any notice and obtaining any consent the law requires, and for responding to their requests about it. If someone asks us about their information in Your Content, we may refer them to you, or act on the request ourselves where the law requires it.

7. Cookies and similar technologies

We use cookies and similar technologies, such as your browser's local storage, to keep you signed in, to complete a sign-in with your second factor, to remember a device you ask us to remember so that it skips your second factor for 60 days, to remember your preferences, such as your recent searches and how you laid out the page, and to understand and improve how the Service is used. Our service providers may use them too, to provide their services to us. You can block or delete cookies in your browser's settings, but you cannot sign in to the Service without them. The Service does not respond to Do Not Track signals.

8. Security

We use technical and organizational measures we consider reasonable to protect information. But no method of storing or sending information over the internet, and no AI model, integration or service provider, is completely secure, and we cannot and do not guarantee the security of any information, including against hacks, security breaches or unauthorized access. As Sections 14 and 15 of the Terms say, the Service is provided as is, whether you use it for free or pay for it, and Doco accepts no responsibility or liability for lost data, hacks or anyone accessing your information. You are responsible for securing your devices, passkeys, authenticator apps, email account, tokens and agents, and for deciding what you put into the Service. If the law requires us to notify you of a security incident affecting your personal information, we will do so as and when the law requires, by email, in the Service or by any other means the law allows.

9. How long we keep information

We keep personal information for as long as we need it for the purposes this Privacy Policy describes, including while your account is open, to comply with our legal obligations, to resolve disputes and to enforce our agreements. Some information expires on its own: chat attachments are deleted after 30 days, and a deleted collection is purged 30 days after it is deleted. Copies of deleted information may remain in our backups and logs for some time after that. As the Terms say, we do not promise to keep Your Content for any period, and we may delete any of it at any time. We may keep aggregated or de-identified information indefinitely.

10. Your choices

Your profile. From your profile page you can change your name, email address and password, add and remove passkeys and an authenticator app, and make your profile public or private.
Your content. You can edit and delete records, and delete your collections and workspaces from their settings.
Agents and integrations. You can revoke your agents' tokens and disconnect your integrations at any time. They then send us nothing new, but what they already sent stays in the Service until it is deleted.
Emails. You can unsubscribe from the activity digest from any digest email. We may still send you emails about your account and the Service, such as sign-in links, invites and notices about the Terms or this Privacy Policy.
Your account. To ask us to close your account, email us at legal@doco.to.

11. Your privacy rights

Depending on where you live, the law may give you rights over your personal information, such as the right to know what personal information we hold about you and how we use it, to get a copy of it, to correct it, to delete it, to object to or restrict how we use it, to withdraw a consent you gave, and not to be discriminated against for using these rights. To use a right the law gives you, email us at legal@doco.to. We will respond as and when the law requires. We may need to verify your identity before we act on a request, and we may decline or limit a request where the law allows, for example where it is unfounded or excessive, would affect the rights of others, or concerns information we need to keep. Where we process information on behalf of a workspace or organization, we may refer your request to it. Where the law lets you appeal our decision on a request, you can do so by replying to it. Where the law allows, you may authorize someone to make a request for you, and we may ask for proof of that authority.

If you are in the European Economic Area, the United Kingdom or Switzerland, Apache A-X Cybernetic Enterprises, LLC is the controller of your personal information, except where we process Your Content for a workspace's owner or your organization, which is then the controller. We rely on these legal bases: performing our contract with you, the Terms; our legitimate interests in providing, securing, improving and promoting the Service, which you can object to; complying with our legal obligations; and your consent, where we ask for it. You may also complain to your local data protection authority.

If you live in California or another U.S. state with a consumer privacy law, in the last 12 months we have collected the categories of personal information Section 1 describes: identifiers, such as your name, email address, username and IP address; internet or other electronic network activity; approximate geolocation; professional information; and any other personal information in Your Content. We collect it from the sources, use it for the purposes, disclose it to the recipients and keep it for the periods this Privacy Policy describes. We do not sell or share personal information, as those laws define selling and sharing, including that of consumers under 16, and we do not use or disclose sensitive personal information for any purpose that would give you the right to limit it.

12. International transfers

Doco is based in the United States. We and our service providers may store and process your information in the United States and in other countries, whose laws may protect it less than the laws where you live. Where the law requires a mechanism for transferring personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on one it recognizes, such as the European Commission's Standard Contractual Clauses.

13. Children

The Service is for adults: you must be at least 18 to use it, as Section 1 of the Terms says. We do not knowingly collect personal information from children under 18, and if we learn that we have, we will delete it. If you believe a child has given us personal information, email us at legal@doco.to.

14. Information from Google

When you connect Google Drive, Doco's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15. Other services

The Service links to and connects with services that others run, such as AI agents, GitHub, Slack, Notion and Google Drive. Their own privacy policies govern what they do with your information, including what you send them from Doco, and we are not responsible for them.

16. Changes to this Privacy Policy

We may change this Privacy Policy at any time. We will post the changed Privacy Policy on this page and update the date at the top, and for material changes we will give reasonable notice, for example in the Service or by email. Changes take effect when posted unless the notice says otherwise, and by continuing to use the Service after they take effect, you acknowledge them. Where the law requires your consent to a change, we will ask for it.

17. This Privacy Policy and the Terms

This Privacy Policy is a notice of our practices. It is not a contract, it creates no rights or obligations beyond those the law gives, and it does not change the Terms. The Terms govern your use of the Service, including their disclaimers and limits of liability, in Sections 14 and 15 of the Terms, and their governing law, in Section 18 of the Terms. Any dispute about this Privacy Policy or your personal information is a Dispute under the Terms, resolved through individual binding arbitration, without class actions or a jury, as Section 17 of the Terms says, except where the law does not allow it.

18. Contact

Apache A-X Cybernetic Enterprises, LLC, a Delaware limited liability company. Email: legal@doco.to.