Privacy Policy
OpenA2A is a security platform. We treat data the way we wish every tool we audit treated ours. This page is the canonical statement of what we collect and why; the technical detail and exact wire shapes live on the data transparency page.
Two buckets, two consent shapes.
We separate invocation telemetry (which CLI ran which command on which platform) from scan-result contribution (the names of packages you scanned and the verdicts that came back). They collect different data, ask for different consent, and are controlled by different switches.
Read the rest of this page if you want the policy. The data transparency page has the wire shapes, retention, and deletion procedure.
Bucket 1: Invocation telemetry
What it is. Anonymous usage data: which CLI tool ran (e.g. hackmyagent, opena2a, ai-trust), which subcommand was invoked, the tool version, success/failure, duration, and platform (OS family + Node major version). It carries an install ID for de-duplication. It does not carry your name, email, IP, file contents, package names, scan results, or any personally identifying information.
Default state. On. We use it to track which commands users actually run, so we can prioritize bugs and keep unused features from rotting.
How to disable. Set the environment variable OPENA2A_TELEMETRY=off in your shell profile, or run the per-tool subcommand: hackmyagent telemetry off or ai-trust telemetry off. Either path persists the choice across sessions.
Bucket 2: Scan-result contribution
What it is. When you scan an npm/PyPI package, a GitHub repo, or a skill/MCP artifact, the result of that scan (package name + version + check IDs that fired + verdict) can be submitted to the OpenA2A Registry. The Registry is the public community-trust signal that other users see when they query the same package. Contribution does not include file contents, source code, or anything from outside the scan target.
Default state. Off. We prompt once on your first local scan and persist your choice. There is no contribution without explicit opt-in.
How to disable per scan. Run any scan with the --no-contribute flag. The scan runs locally and nothing leaves your machine for that invocation.
How to disable globally. Run hackmyagent telemetry off (or the equivalent on ai-trust, or opena2a config contribute off). The disable applies to scan-result contribution only, separately from invocation telemetry.
Silent post-consent
Once you have opted in to scan-result contribution, our CLIs do not announce each contribution. There is no per-scan "sent to registry" line, no progress chatter, and no banner. Consent was given once; subsequent contributions are silent. To re-confirm or revoke, run the disable commands above. This rule was locked in our public telemetry policy on 2026-04-27.
Third parties
Invocation telemetry is sent to a telemetry endpoint we operate. Scan-result contributions go to the OpenA2A Registry, which is also our infrastructure. We do not sell, rent, or share your data with third-party advertisers, brokers, or analytics resellers. Call bookings go through Cal.com; the inquiries section below describes what it receives.
If you subscribe to our newsletter, the email address you give us is stored in a database we operate, together with the exact consent wording you agreed to at signup. That wording, shown on every form, says that OpenA2A may email you about security research, tools, and events.
You can withdraw that consent at any time on the unsubscribe page. Unsubscribing puts a fingerprint of the address, not the address itself, on a do-not-email record we keep. To have the address deleted outright, email info@opena2a.org and we will remove it.
Some pages on this website embed standard infrastructure (e.g., font hosting, code-block syntax highlighting). Those are content-delivery dependencies, not analytics integrations. Our primary deployment platform is Vercel, which logs request metadata (timestamp, route, status code) for site reliability. That is standard hosting telemetry and outside the two-bucket scope above.
Retention and deletion
Invocation telemetry is retained in aggregate. Individual events roll up to weekly counters; raw event records are dropped after 30 days.
Scan-result contributions are retained as long as the package exists in the Registry. The Registry is a public community-trust dataset; the data you contribute is part of it.
To remove a specific scan you contributed, email us with your install ID (visible in any local hackmyagent telemetry status output). We can drop the records linked to that ID without affecting the rest of the Registry.
Inquiries and booked calls
Inquiries reach OpenA2A by email to info@opena2a.org, by booking an intro call from the contact page, or by booking a pilot discussion from the pilot program page or the GSX page. OpenA2A uses an inquiry only to reply to it and, for the pilot program, to scope the pilot. Inquiry emails and bookings are kept for 12 months after the last exchange and then deleted, or sooner on request, and are not shared with any other organization. Records of a pilot that goes ahead are kept under that pilot's contract instead.
Bookings are made through Cal.com, a scheduling service operated by Cal.com, Inc. in the United States. A booking sends the name, email address, organization, chosen time, and any notes or guest addresses entered to Cal.com, which stores them on OpenA2A's behalf, places the call in the OpenA2A calendar, and sends the confirmation emails. The call runs on Cal Video, Cal.com's video service, and is not recorded. Cal.com's handling of this data, including the subprocessors it uses, is described in its privacy policy. OpenA2A deletes the booking record and the calendar event 12 months after the last exchange, or sooner on request.
Access and deletion requests for inquiry emails and bookings go to the same address and are answered within 30 days.
Children
OpenA2A tools are developer tools and are not directed at children under 13. We do not knowingly collect data from children.
Changes to this policy
Material changes (anything that adds a new data category, expands retention, or changes a default) are announced on the OpenA2A blog and in the relevant CLI release notes before they take effect. Wording changes that do not alter what we collect or how long we keep it are made silently with the "Last updated" date below.
Contact
Questions about this policy or about your data?
- Email: info@opena2a.org
- GitHub: Open an issue