Placid Lake LLC ("we") runs Assistant Gym. This policy covers the Assistant Gym connector that lets an AI assistant (for example, one running in Muse, ChatGPT, Claude or Cursor) take an Assistant Gym intake. The connector uses the Model Context Protocol. Platform availability depends on the client and beta access; a platform name is not a claim of an approved directory listing.
What we collect
Account details: the email address and workspace name you use to sign in, and the API key or sign-in token we issue.
Run data: the name you give your assistant, the tasks we sent it, the choices and reasons it returned, and the reports, training plans and proof records we produce from them.
Service logs: time of each request, which tool was called, and an audit record of changes. We use these for security and to fix problems.
Network data: your IP address and browser details, in our web server's access logs, kept for 30 days for security. We also use your IP address for a moment to apply rate limits on sign-in. We do not store it with your runs.
What we do not collect
We do not ask the connector for access to your email, calendar, files, contacts, payment details or other accounts.
The assistant decides what to send us. Please do not put personal or confidential information in answers.
How we use it
To run the intake, produce your report, training plan and proof record.
To keep the service secure, prevent abuse and fix defects.
To improve Assistant Gym, using run data that has been aggregated or de-identified so it no longer identifies you or your assistant. We do not use your run data to train AI models, and we do not let others use it for that.
We do not sell your data. We do not use it for advertising.
Sharing
With the platform you connect from (for example Anthropic, OpenAI, Microsoft, Google or Meta), only the results you ask your assistant to fetch. That platform's own privacy policy covers what it does with them.
With service providers that host our systems, under contract.
When the law requires it.
A proof record is shared only when you choose to share it.
Keeping and deleting
Run data is kept while your account is open or until a verified manual deletion request. This beta does not yet perform automatic inactive-account deletion. Security audit records are retained separately to investigate abuse; they do not contain your answer text or access tokens.
Deletion is a manual support process, not a self-serve tool. After we verify your request, we remove your workspace run data and revoke its sign-in tokens and key within 30 days, except where the law requires us to keep something.
You can ask us to delete your account and run data at support@assistantgym.com. We will confirm when it is done.
Where your data is stored
On servers we rent from Hetzner Online GmbH in Helsinki, Finland (European Union). If you use Assistant Gym from outside the EU, your data is sent to and stored in the EU. We protect it the same way wherever you are.
Your choices
You can stop using the connector at any time by removing it from your assistant app.
You can ask for a copy of your run data, or for it to be corrected or deleted, at support@assistantgym.com.
Depending on where you live (for example the EU, UK or California), you may also have the right to object to or limit how we use your data, to move it to another service, and to withdraw consent. We will answer within 30 days. We may ask you to confirm your identity first. If we say no, you can appeal by replying to our answer. In the EU and UK you can also complain to your data protection authority.
We do not sell or share personal data for advertising, as those terms are used in California law.
Changes
We will post any change here and update the date at the top. For a material change we will tell account holders by email before it takes effect.
Security
Access needs a key or sign-in you approve. Each workspace can only see its own runs.
Sign-in and tool requests are rate limited. Successful tool calls are recorded in a hash-linked security audit chain; the chain does not contain intake answer text.
Children
Assistant Gym is for adults. It is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has used it, tell us and we will delete the data.
Contact
support@assistantgym.com
Placid Lake LLC, c/o A Registered Agent, Inc., 8 The Green, Ste A, Dover, DE 19901, USA
OAuth access tokens issued after October 3, 2026 5:11 PM expire after 15 minutes; refresh tokens rotate on use. Clients can revoke access or refresh grants at /revoke. Disconnecting in a client app alone does not guarantee that it revokes tokens. A verified workspace disconnect revokes that workspace’s client tokens and pending codes immediately. Service-side client deletion revokes all of that client’s tokens and codes. Earlier tokens retain their original expiry unless revoked.