Privacy policy

The short version

• RoboTrunk never sees or stores card or bank details. You pay the store on the store's own checkout page.
• To prepare a checkout, the name, delivery address, phone number and email you give are sent to the store that sells the product. We keep them, encrypted, only while the checkout is open, and remove them from our records when it is completed, cancelled, expires or fails. A checkout nobody comes back to is cleared when the store's own checkout expires.
• The words of a search are sent to OpenAI and to TypeSafe, whose models read the request and rank the results, and can reach Anthropic if those routes fail. Please do not put personal details in a search.
• Nothing you or your agent send RoboTrunk is used to train any model. Why, for each company whose models read it, is under "Model training".
• We do not set advertising cookies or tracking pixels, and we do not sell personal information. If an agent opts in, a random shopping-session ID lets us record safe step labels for internal service improvement; raw journey records are deleted once they are 30 days old, by a routine that runs whenever the site is in use, and the ID stops being usable after 24 hours.

Checkout details

To prepare a checkout at a store, the agent or the person gives RoboTrunk the items and a delivery address: first and last name, street, town, region, postcode, country and, optionally, a phone number. An email address and a phone number can also be given for the buyer. We send these to the store through the store's own checkout system, so the store can work out delivery and prepare the order.

While the checkout is open, we store these details encrypted so the checkout can be changed or finished. When the checkout is completed, cancelled, expires or fails, we remove them from our records. A checkout that nobody finishes or cancels is cleared by a routine that runs whenever the site is in use, at most once an hour: when the store's own checkout expires (stores keep a checkout for up to about 30 days), or, where the store gave no expiry, after a day without use.

We keep a record of each checkout without those details: the store, the products and quantities, the prices and totals the store quoted, any budget ceiling the agent set, the checkout's status and the times it changed. If the store confirms an order, we also keep the store's order reference, the items and the totals. We use this record to show the agent and the person where the order stands, to fix problems and to see which stores and products work. We have not yet set a date after which these records are deleted.

Your internet address

When RoboTrunk prepares a checkout at a store, it can pass the IP address the request came from to the store, because the store's checkout uses it to apply its own limits. When an agent prepares the checkout, that is usually the agent's address rather than yours. We do not store it.

Our rate limits, which stop any one caller overloading the site, keep either a keyed hash of the address, which cannot be turned back into the address, or, for the agent feedback endpoint, the address itself in server memory only. Neither is written to our logs.

Searches

The words of a search are sent to OpenAI, whose language models read the request and rank the results, and they can also be turned into an embedding, a numerical fingerprint of the words used to find similar products, by OpenAI. The words are held in our server's memory for up to 10 minutes so a list of results can be paged through. If our first route cannot answer, the same words and candidate product details can be read by Anthropic's Claude. The text and photos of a listing an agent asks us to check are read by OpenAI's models and are not kept by us. A question an agent asks for a comparison page is read by a model to write the page, and is dropped as soon as the page is written.

The words of a search are also sent to TypeSafe, whose model ranks the matching products. With them, TypeSafe receives each candidate product's title, brand, variant name, published price, whether it can be bought and any reviewed product facts. It is not sent store or product identifiers, web addresses, or anything about who searched. TypeSafe AI, Inc. is a United States company based in San Francisco, and its service is hosted in the United States.

We do not store the words of a search with anything that identifies who searched. We do keep a short summary of what was asked for, such as the kind of product and any limits like size or price, to decide which comparison pages to build. These summaries hold no personal details and are not tied to who searched. We have not yet set a date after which they are deleted.

Agent and visit records

For each purchase attempt we record where the visit came from, grouped into broad sources based on the referring page, the kind of agent based on its browser identification, the store and product, and how far the checkout got. These records hold no IP address, no full browser identification and no buyer details. We use them to see which routes lead to a finished purchase. We have not yet set a date after which they are deleted.

An agent may also request a random shopping-session ID and carry it between calls when it pauses and resumes. When that ID is sent back, we record only observed step labels, safe product or store identifiers, coarse crawler or prefetch classifications, and server timestamps. We do not store the shopping request, tool arguments, personal details, client address or raw browser identification with the journey. This capture is optional, adds no cookie and does not decide who may prepare, hand off or confirm a checkout. The ID expires after 24 hours; raw journey rows are deleted once they are 30 days old, by the same routine that runs whenever the site is in use. Internal operator reports are private and kept for service evaluation.

Recall and back-in-stock watches

If you or your agent asks RoboTrunk to watch a purchase for recalls, we keep a watch record: the checkout reference, the products watched with their titles, the time the watch began and the time it ends. A watch ends after 24 months, or when you stop it. We do not take an email address or a web address for alerts today; if we ever do, this page will say so first, and the address will be erased when the watch ends or is stopped, or if it is not confirmed within 7 days. The watch record itself, without any address, stays after it ends.

If you or your agent asks RoboTrunk to tell you when a sold-out product is back in stock, we keep the store, the product, the time the watch began, its end 90 days later and a one-way hash of the key that lets the watch be read or stopped. No name, email address or other detail about you is kept. The watch record stays after it ends.

Connector keys, sign-in and usage

A free connector key from robotrunk.com/mcp/key needs no account and no email. We keep only a one-way hash of the key, a reference number and a fixed label such as the name of the app it was made for. Revoking a key switches it off but leaves its record, and we have set no date after which key records are deleted. If an app signs in through our Allow page, we keep the app's name, its return address and one-way hashes of its access and refresh tokens. A sign-in stops working 30 days after it was last renewed, and its records are deleted a day after that, by a routine that runs when anyone next signs in.

Each call to the connector is counted in a usage record: the time, the tool, whether it worked and how long it took, the key's reference number, the app's name, a country if the agent gave one, and a code that changes every day and stands for the caller's address (not the address). It holds no request text, no search words and no personal details. Usage records are deleted once they are 30 days old, by a routine that runs while the connector is in use. The daily totals made from them hold no personal details and are kept.

Feedback

An agent can send feedback, or the reason a purchase was declined. That text is written to our server logs with the checkout or order reference it concerns, and is not stored in our database. Please do not include personal details. Server logs are kept by our hosting provider, Railway, for 30 days on our plan, and then deleted.

Our other logs record error types, reference numbers and timings. They are written so that they carry no addresses, email addresses, payment details or search text.

The sandbox example product

RoboTrunk lists one example product of its own so the purchase steps can be tried. It uses a fixed, made-up delivery address, takes no real payment and places no order. Its records are removed after they expire, 24 hours after they begin.

Cookies

RoboTrunk uses the following essential cookies where the relevant checkout flow needs them. They are limited to this site and cannot be read by scripts on the page.

• __Host-robodepo_run ties the steps of one checkout together. It lasts 24 hours.
• __Host-robodepo_confirmation protects the one confirmation step for the sandbox example product. It lasts 5 minutes.
• __Host-ucp_handoff supports the browser handoff to the store's own checkout where that flow uses it. It lasts until the short-lived link expires.
• We set no analytics, advertising or tracking cookies for journey recording. The optional shopping-session ID is carried in a tool argument or request header, not a cookie. The store's checkout page sets its own cookies under the store's own policy.

Who receives information

• The store you buy from receives the checkout details above, the IP address described above, and tags that name RoboTrunk as the source of the sale along with the checkout reference. The tags carry no personal details. From there, the store's own privacy policy applies.
• OpenAI receives the words of searches, and the text and photos of a listing an agent asks us to check, as described above.
• TypeSafe receives the words of searches and the candidate product details described above, to rank results.
• Anthropic receives the words of searches and comparison questions only on the routes described under Searches.
• Railway Corporation, our cloud hosting provider, hosts the site and its databases, on servers in Singapore.
• We share personal information with no one else unless the law requires it.

Model training

Nothing you or your agent send RoboTrunk is used to train any model. RoboTrunk does not train or fine-tune any model on it.

The companies whose models read your requests publish their own terms, which we read on 17-Oct-2026. OpenAI says data sent to its API is not used to train its models unless the customer opts in, and that it keeps that data for up to 30 days to check for abuse. TypeSafe says it will not train or fine-tune any model on prompts or other input. Where we reach OpenAI or Anthropic through an account sign-in instead of an API key, the ChatGPT and Claude accounts we sign in with have model training switched off.

International data processing

RoboTrunk is operated by an Australian company and is offered to shoppers in the United States, Australia, Canada, the United Kingdom and New Zealand. It lists stores that ship to each of those countries, and a store may itself be in another country. Checkout details go to the store you choose and may be processed outside your country. Our site and databases run on Railway's servers in Singapore. OpenAI, Anthropic and our cloud hosting provider are United States companies. Search words also go to TypeSafe, whose service is hosted in the United States.

Asking about your information

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing agents@robotrunk.com. Because checkout details are removed when a checkout ends, we usually hold none.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

What deleting does not cover

When we delete personal information, we delete it from our own database. That deletion does not reach three things. Server logs, which Railway keeps for 30 days on our plan and then deletes. Backups: our database has no regular backup, but Railway keeps backups under its own policy and may make others, for example before a change to the storage size, which it keeps for 21 days. And the companies that process information for us, such as OpenAI, TypeSafe, Anthropic and Railway, which keep what they received for as long as their own terms say.

Changes to this policy

When what RoboTrunk collects changes, this page changes with it, and the date at the top shows when it last did.