Privacy policy
Last updated:
Milton is operated by Zone of Danger, LLC (“we”). Milton keeps the writing you approved, word for word. It never rewrites a rule or a sample, and it never reads your inbox. The details follow.
What Milton stores
Your name and email address when you sign up or sign in, and the identifiers of Google or GitHub accounts you use to sign in or link; password hashes if you use a password; sign-in sessions, email verification and password reset records, assistant permissions and access tokens, and security rate-limit records; the writing rules you ask your assistants to save; the samples of your writing you approve for saving, stored exactly as approved, including any names they contain; each rule and sample you saved, with its versions and which assistant saved it; request receipts used to prevent duplicate saves; internal records of accepted changes, including the exact submitted rules, edits or samples, authorship and affected versions; connected assistants and the assistants you disconnect; counts of tool calls you make each day; and your billing record: your Stripe customer and subscription IDs, the subscription’s status, its trial and billing period dates, and which trial reminders have been sent.
How we use it
Only to run Milton: to sign you in, verify your email, help you recover and secure your account, store your rules, retain their internal history, prepare the cover sheet and reports for the assistants you connect, and run your trial and subscription. Accepted-change records remain with your internal history until account deletion. Your data is encrypted at rest by our database provider. We do not sell your data, show ads, or use your rules or samples to train AI models.
Email/password sign-in requires a verified email address. If you use a password, Milton’s sign-in service processes it and stores a salted password hash using Better Auth’s scrypt hashing, rather than the password itself. Verification and password reset emails go through Resend, which receives your email address and the message, including its verification or reset link.
Who can see your rules and samples
You and the assistants you connect receive your current cover sheet and reports, samples included. Once an assistant has read them, its handling of that content is governed by that assistant’s own terms and privacy policy, not ours. Rules and samples are stored exactly as your assistant sends them; Ordinary saves and reads do not send them to an AI model. If you explicitly opt into the private guide pilot, the background processing described below sends approved samples to Anthropic. Milton does not collect your assistant conversations. The service providers below process data to operate Milton.
You can disconnect an assistant at any time from Connected assistants in the Milton app. Milton blocks further access, even with an existing authorization. This does not erase content the assistant already received. To use it again, reconnect it and approve access.
Samples
A sample is saved only after you say yes to a specific piece of writing, and it is stored exactly as you approved it. Milton does not remove names or other details from it; you decide what to save. Saving a new sample keeps your existing samples unless you ask to replace or remove them. You can ask your assistant to replace or remove a sample. Removed or replaced samples leave future reports and current downloads, but remain in your internal history until account deletion. This does not erase copies an assistant already received.
Optional derived guides
Guides are off by default. For eligible accounts that explicitly opt in, Milton sends every active approved sample in a report, with its approved classification and context, to Anthropic to infer writing tendencies. Rules, retired sample revisions and earlier guides are excluded. The resulting guide is an interpretation, shown to you and the assistants you connect; your approved writing stays unchanged. A stale guide can still reflect a sample that was corrected or removed until its update succeeds. Removing all active samples clears the guide immediately. Guides are excluded from your download.
Anthropic’s standard API policy deletes inputs and outputs within 30 days, with exceptions for policy enforcement, legal requirements and contractual terms. This pilot does not promise zero data retention. SeeAnthropic’s retention policy. Disabling participation hides guides on future reads; it cannot retract copies already received by an assistant. Completed guides may remain stored while disabled, until account deletion. Milton keeps one current guide per report, without a guide history archive.
Where it is kept
The database runs on Neon (United States). Milton operates its own sign-in service using Better Auth at auth.meetmilton.com on Google Cloud Run. Resend delivers verification and password reset emails. The public website runs on Vercel; the app and MCP server run on Google Cloud Run (United States). The public website uses Vercel Web Analytics, which sets no cookies: it records each page view’s address and query parameters, referrer, time, browser, operating system, device type and location down to city, and counts visitors with a daily-reset hash of the request instead of tying records to a person or IP address. DNS is on Cloudflare. Google and GitHub also handle your sign-in with them. Stripe processes subscriptions and payments. Earlier managed sign-in records remain separately in Neon after the old sign-in service is disabled. Its database structure, data and backups require their own cleanup; deleting a new sign-in does not remove that earlier copy.
Verification and reset messages wait in an encrypted delivery queue with the original destination and secret link. Delivery stops at the earlier of the link’s expiry and 15 minutes after acceptance. Marking a message as sent, failed or cancelled clears its encrypted contents. Delivery processing and cleanup remove expired contents in small batches; delayed or disabled cleanup can retain them longer. Message receipts include original sign-in identifiers but no recipient or link and become eligible for removal 24 hours after acceptance. Actual removal depends on that cleanup. Resend’s copies follow its own retention.
Billing
Milton creates a Stripe customer for you when your free trial starts, and starts your trial subscription at Stripe with no card. If you had no trial, the customer is created when you first open billing. Milton gives Stripe your Milton account ID and, if Milton has it at that moment, your sign-in email address. Each time you open billing from the Milton app, Milton sends Stripe your current sign-in email address for that customer.
You enter card and other payment details on Stripe’s pages, not Milton’s. They go to Stripe, and Milton does not store them.
Cookies
The app and sign-in service use separate cookies, each limited to its own hostname, to keep you signed in and protect sign-in and account actions. Signing out ends browser access; assistants with offline access stay connected. Changing or resetting your password, or unlinking a sign-in method, invalidates earlier browser sessions and assistant authorizations. Assistants must reconnect with your consent to regain access.
Deleting your account
Choose Delete account in the Milton app. Deletion blocks account and assistant access. If you have a Stripe customer, deletion deletes it at Stripe first, which ends any subscription immediately, with no refund. Milton then removes your rules, samples, derived guides and pending guide work, internal memos and their history, your cover sheet and reports, request receipts, accepted-change records, usage counts and billing record, and the app’s sign-in sessions and credentials. Cleanup then removes your sign-in profile, password hashes, linked sign-in methods, browser sessions and assistant grants and tokens from Milton’s sign-in service. If account cleanup is incomplete, the app offers a retry; deletion is confirmed only when that cleanup finishes. Unused password reset links stop working when account security changes or deletion starts, as well as when they expire. Verification links expire after one hour; remaining verification records become eligible for cleanup one day after expiry and can remain until cleanup reaches them. The limited records below remain.
These records remain after deletion:
- Records of original account deletions and assistant disconnections, including original account, sign-in and assistant identifiers and connection references, so retries cannot affect a later account or connection. These contain no writing or credentials.
- Keyed fingerprints of verified email addresses and stable Google or GitHub account identifiers, with the internal account that first claimed them, to prevent another free trial. This trial-eligibility record does not store raw email addresses or provider identifiers and is not used to merge writing accounts.
- Limited verified records linking earlier sign-in identities to Milton account IDs, to preserve account and deletion history, and a check that trial fingerprints remain consistent.
- Content-free guide spending records (amount, time and a one-way account fingerprint), so deletion cannot reset pilot spending limits.
- Stripe keeps past invoices and payment records.
These limited identity and security records are kept without a fixed expiry for those purposes. They do not restore deleted writing or authorize access. Expired sign-in sessions, verification and reset records, and expired assistant tokens can remain until periodic cleanup; records still needed for active offline access or unfinished cleanup remain until that work can finish.
Copies in database backups are not erased immediately; they are removed when those backups expire or are deleted. You can also emailsupport@meetmilton.com and we will delete your account for you.
Changes
We will update the date above when this policy changes.