Privacy Policy

Last updated 3 August 2026

Page is operated by Monday Draft LLC. This policy covers a-gnt.com/page, the Page iOS app, the Page CLI, and the Page MCP server.

We do not sell your data, we run no analytics or advertising SDKs, and there are no third-party trackers in the app or on this site.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Phone numbers are used only to deliver the messages you asked for.

What we collect

Account identifiers — your email address, and your mobile number if you add one for SMS delivery.
Page content — the title, body, and any answer note of each page your software sends you, plus the machine name and project it came from.
Delivery records — device push tokens, and whether a message was sent, delivered, or failed.
Billing state — your plan and the App Store transaction identifier for a subscription. Card details go to Apple; we never see them.

We do not collect location, contacts, photos, browsing history, or advertising identifiers. The app requests Reminders and Calendar access only when you tap those buttons on a page, to write that one page across; nothing is read back and nothing syncs.

How it is used

To deliver your pages by push, email, and SMS; to show them in your inbox; to sign you in; to return your answers to the program waiting on them; and to bill the subscription. Nothing else. We do not use your page content to train models.

How it is protected

Encrypted at rest. Page titles, bodies, and answer notes are stored AES-256-GCM encrypted, with a random initialisation vector per value and an authentication tag, so a tampered record fails to decrypt rather than returning something plausible. A stolen disk image or leaked backup yields ciphertext.
Encrypted in transit. HTTPS everywhere.
Tokens are hashed. API tokens are stored as SHA-256 hashes, not in the clear. On iOS the token is held in the Keychain. Sign-in tokens travel in the URL fragment, so they never reach a server log.

The server decrypts a page to render it into an email, an SMS, or a push notification — that is what delivery requires — and re-encrypts nothing else. Page is not end-to-end encrypted, and we do not claim to be.

Who else sees it

Only the providers needed to deliver a message, and only the message being delivered:

Twilio — SMS delivery and login codes.
Apple Push Notification service and Firebase Cloud Messaging — push notifications.
Our email provider — email delivery.
Apple — subscription billing and receipt validation.
DigitalOcean — hosting, in the United States.

None of them receive your data for their own marketing, and we have no other recipients. We disclose data otherwise only if the law compels it.

How long we keep it

Pages stay until you delete them or close your account. Deleting a page removes it from the database. Closing your account deletes your pages, revokes your tokens, and removes your email and phone number. Backups roll off within 30 days.

Your choices

Turn off SMS delivery, or remove your number, in account settings. Replying STOP to any message does the same.
Turn off push notifications in iOS Settings, or by removing the device from your account.
Export or delete everything from the dashboard.
Write to us to request access, correction, deletion, or a copy of your data. We answer within 30 days, wherever you live.

Children

Page is not directed at children under 13, and we do not knowingly collect their data.

Changes

Material changes are posted here with a new date, and announced by email if they affect how your data is handled.

Contact

Monday Draft LLC — joey@mondaydraft.com