Company
Privacy policy
What attention.run collects on this site, through the request form and in the app, why, where it is kept and for how long.
Last updated 15 October 2026
This text is being reviewed and may change before attention.run opens to the public.
In short: this site sets no tracking cookies and shows no ads. The request form asks for what we need to reply about access, and we delete requests we don’t act on. In the app, what you record and build is yours; we keep it to run the service for you, and a vision model sees a frame only when you ask it to.
Who we are
attention.run is a UI automation product, in an invite-only preview. Write to hello@attention.run about anything in this policy.
This website
- Server logs. Cloudflare serves this site and processes the technical data of each request (IP address, browser user agent, the page asked for) to deliver it and to protect it from abuse.
- Analytics. We count visits with Cloudflare Web Analytics, which sets no cookies and doesn’t build a profile of you.
- Cookies. None for tracking or advertising. When you’re signed in to the app, it may set a cookie on this site that says only that this browser is signed in, so the menu can show “Open app”. It holds no identity.
Requesting access
The form asks for your email address, what you want to automate and what for, and optionally your name, company, role, GitHub username, a description, and whether you want product news. With it we keep the page you sent it from, the website that referred you (its address only), your time zone, and any campaign tags in the link.
- Why: to decide whom to invite, to invite you, and to understand what people need.
- Bot check: Cloudflare Turnstile checks that a person sent the form, using signals from your browser.
- How long: a request we don’t act on is deleted 12 months after its last update; one marked as spam after 30 days. Ask us and we delete yours sooner.
- Product news: only if you ticked the box, and you can stop it at any time.
The app (app.attention.run)
During the preview, Cloudflare Access lets in only invited email addresses, and Cloudflare handles the sign-in.
What you create in the app is kept so the app can work for you: the targets you connect (addresses and connection settings), recordings of the screens you connect, element libraries, flows and runs, and SSH keys you add. Recordings contain whatever those screens showed, so connect screens you’re allowed to record. Secrets you give a flow are stored encrypted and are hidden in recordings of what was typed. You can delete sessions, elements, flows and keys in the app, and we delete everything else of yours when you ask. Recordings are kept until you delete them.
Models see your screens only when you ask for one: a vision model on Amazon Bedrock in the United States (us-east-1), or a Claude model on Anthropic’s API when you pick one:
- Suggest elements: the frame you’re looking at, to propose the elements on it.
- Create flow automatically: crops and small thumbnails of the recording’s frames, the names of your elements and what was typed, to name new elements, find what was clicked and write the flow. Secrets a flow types are hidden in recordings, so they are never sent, and a request can leave all typed text out. The crops show what was on the screen, where a password field shows only dots.
- Create flow from a goal: your goal and screenshots of the target as the agent works on it, then the same as Create flow automatically. Values you give as params are typed without being sent.
Nothing else is sent to a model, and we don’t use your content to train models. An AI app you connect to the app’s MCP endpoint (Claude, ChatGPT, Cursor) receives what its tools return, such as text about a screen or a screenshot of it, from the targets you allowed it; that app’s own terms cover what it does with them, and you can revoke it in Settings → Connected apps.
Where data is kept
The app and its data are hosted on Amazon Web Services in Sydney, Australia (ap-southeast-2), with backups in the same region. Cloudflare’s network, in front of the site and the app, processes requests in the location nearest to you.
Who processes data for us
- Amazon Web Services: hosting, storage, backups and vision models (Bedrock).
- Anthropic: Claude models, for the requests above when you pick one.
- Cloudflare: network, DNS, protection, access control, analytics and the bot check.
We don’t sell personal data, and we don’t share it except with these providers to run the service, or when the law requires it.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, or to stop using it for something. Write to hello@attention.run.
Children
attention.run isn’t meant for children under 16, and we don’t knowingly collect their data.
Changes
When this policy changes, we update the date at the top. If a change matters, we tell people in the app or by email first.