Privacy Policy

Phoenix Horizon, Inc. ("Phoenix," "we," "us," or "our") operates Rush, a cloud where AI agents do work you ask for: you send a request through the Rush API, an MCP client or the console at cloud.getrush.ai, an agent does the work in its own isolated cloud computer, and you get the result back with a record of what it did. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Rush and related services.

By using Rush, you consent to the data practices described in this policy. If you do not agree, please do not use our services.

This policy supplements the Phoenix Horizon Privacy Policy, which covers all Phoenix products and services.

Account Information

• Email address
• Name (if provided)
• Profile photo (via your sign-in provider)
• Payment information (processed by Stripe)

Google API Data

You connect each Google product separately, and each connection asks Google only for that product's permissions, plus your email address to name the account:

• Gmail (read, send and modify mail) — So an agent can read, search, label and send email when a run you start or schedule asks it to, and so an automation you set up can start a run when matching mail arrives
• Google Calendar (read calendars, read and write events) — So an agent can check availability and create or change events for you
• Google Drive and Google Sheets (read Drive files, create and edit files the app uses, read and write spreadsheets) — So an agent can find and read your files and work in your spreadsheets when you ask it to
• User info (email) — To identify which Google account you connected

A developer who builds on Rush can let their own users connect Google accounts to an agent made for each of them. Those accounts are used only by that user's agent, never by the developer's own runs or anyone else's.

Rush's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other Connected Services

When you connect another service, we access data within the permissions you grant on that service's own sign-in page. These include Microsoft (Outlook, Calendar, OneDrive), Slack, Linear, GitHub, GitLab, Buffer, QuickBooks, and apps that publish a remote MCP server.

Token Storage

The tokens that let an agent use your connected accounts are stored on our servers, encrypted: Google and Microsoft refresh tokens in an encrypted secrets vault, other tokens in encrypted database columns. A run receives short-lived access only for the accounts it is allowed to use, inside its own cloud computer.

Runs and Their Records

When an agent works for you, Rush keeps a record of the run so you can check it: your request, the agent's messages and the steps it took (including what it read from or wrote to a connected account, when a step did), the files it produced, and the result. This record is stored on our servers and shown to you and to the people you share the run with.

Usage Data

• Session identifiers and service logs
• Usage metrics (model tokens, compute time, cost, duration)
• Error information
• Browser and device information
• IP address

We use collected information to:

• Provide, maintain, and improve Rush
• Process transactions and send billing notifications
• Carry out the work you ask agents to do, through the accounts you connected
• Monitor usage for security, abuse prevention, and debugging
• Generate aggregated analytics to improve our products
• Communicate with you about updates and support
• Comply with legal obligations

Data obtained through Google APIs is used only to do the work you, or an automation you set up, ask an agent to do, and to show you the record of that work:

• Gmail data is read, searched, labelled or sent by an agent during a run that needs it. When you set up an automation that starts on incoming mail, our servers check your inbox for matching messages and pass a matching message to the run it starts.
• Calendar data is read or changed by an agent during a run that needs it.
• Drive and Sheets data is read or changed by an agent during a run that needs it.
• What an agent reads becomes part of that run's record (section 2) and is sent to the AI model that runs the agent (section 6), which is how the agent can work on it.

We do not:

• Use Google user data for advertising
• Sell Google user data, or transfer it to anyone except as needed to provide the work you asked for (for example, the AI model provider that runs the agent), for security, or to comply with the law
• Use Google user data to develop, improve or train generalized AI or machine learning models
• Let people read Google user data, unless you ask us to (for example, to help with a support request), it is needed for security or to comply with the law, or it is aggregated and anonymized for internal operations

You can disconnect a Google product at any time in Settings → Connections. Disconnecting removes Rush's stored tokens for that Google account and revokes Rush's access with Google, unless another of your connections still uses the same Google account. Google ends access for all of an account's products together, so disconnecting one Google product disconnects the account's other Google products too.

• Passwords for connected accounts — You sign in to each service on its own page; we never see or store those passwords
• Data from accounts you have not connected — An agent reaches only the accounts you, or the person you built it for, connected

AI Model Providers

Agent requests, which can include data from your connected accounts, are sent to the AI model provider that runs the agent:

• Anthropic — Privacy Policy
• OpenAI — Privacy Policy
• OpenRouter, for the other models Rush offers — Privacy Policy

When you connect your own Claude, ChatGPT or other model account, runs that use it go to that provider under your own agreement with them.

Infrastructure

• Supabase — Authentication and database (hosted in the United States, AWS us-west-2)
• E2B and Amazon Web Services— The isolated cloud computers agents run in, and the service that starts them
• Cloudflare — CDN, security, and storage of run records and files
• Hetzner — Server infrastructure (EU)
• Vercel — Hosting for the console
• MET Norway (the Norwegian Meteorological Institute) — Weather for the sky behind getrush.ai. Our server sends MET Norway only the approximate location Cloudflare assigns your connection, rounded to about 10 km. Your IP address and browser details are never sent, and your browser never contacts MET Norway.
• PostHog — Product analytics. On getrush.ai, PostHog sets analytics cookies and only loads after you opt in via our cookie consent banner. Until you consent, no analytics cookies or identifiers are set.

Storage: Account data, connected-account tokens, run records, usage and billing data are stored on our servers and our providers' (section 6). We use encryption in transit (TLS) and at rest, and connected-account tokens are additionally encrypted as described in section 2.

Isolation: Each run works in its own cloud computer, which reaches only the accounts that run is allowed to use.

Retention: We keep each class of data only as long as necessary for the purpose it was collected, then delete or anonymize it. You may request deletion at any time.

We do not sell your personal data. We may share data:

• With your consent — When you explicitly authorize sharing
• With service providers — Third parties that help us operate our services (under strict confidentiality agreements)
• For legal compliance — When required by law, subpoena, or legal process
• For safety — To protect the rights, property, or safety of Phoenix, our users, or others
• In business transfers — In connection with a merger, acquisition, or sale of assets

You have the right to:

• Disconnect services — Disconnect a connected account at any time in Settings → Connections (section 4)
• Delete your data — Request deletion of your account and associated data
• Data portability — Export your session histories and artifacts
• Opt out of analytics — Manage your choice any time via the “Cookie Settings” link in the footer, or contact us to opt out of non-essential analytics

To exercise these rights, contact us at privacy@getrush.ai.

GDPR (European Users): You have rights under GDPR including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal basis for processing is contractual necessity and legitimate interests.

International transfers: Our database and authentication provider (Supabase) is hosted in the United States (AWS us-west-2). Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures including encryption in transit and at rest.

CCPA (California Users): California residents have the right to know what personal information is collected, to delete personal information, and to opt out of the sale of personal information. We do not sell personal information.

Rush is not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children.

We do not use your data or your connected accounts' data to train AI models. When agents work on your behalf, they send requests to AI model providers (section 6). Anthropic and OpenAI do not train on data sent through their APIs by default. Requests Rush routes through OpenRouter ask for providers that keep no data and do not collect it.

Our own service logs record usage metrics such as token counts, costs and latency, not the content of requests. The content of a run is kept in that run's record (section 2) so you can check the work.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of Rush after changes become effective constitutes acceptance of the updated policy.

For privacy-related questions or requests:

• Email: privacy@getrush.ai
• General: support@getrush.ai

Phoenix Horizon, Inc.
Palo Alto, CA
United States