Legal

Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how Bolt (“Bolt,” “we,” “us,” or “our”) collects, uses, and protects information when you use the Bolt desktop application, the Bolt browser extension, the Bolt web console at app.trybolt.ai, our website at trybolt.ai, and related services (together, the “Services”). By using the Services, you agree to this Policy.

1. Information we collect

Information you provide

Account information — your name, email address, password (stored only as a salted hash), and organization or workspace details when you create an account or are provisioned by your administrator.
Content you submit — prompts, messages, files, and documents you choose to provide to the Services so an AI agent can act on them.
Communications — information you send us when you contact support, request access, or join a waitlist.

Information from connected accounts

Bolt lets you connect third-party accounts (for example, Google, or other services via connectors) so an agent can perform tasks you request. When you connect an account, we access only the data and scopes you authorize, and only to provide the features you ask for. You can disconnect a connected account at any time from the console, which revokes Bolt’s access going forward.

Information from the Bolt browser extension

The optional Bolt browser extension connects the Bolt desktop app to tabs in your own browser that you explicitly connect. When you connect a tab, the extension reads that page’s content (such as text, structure, and on-page elements) and the tab’s URL and title so the desktop app can perform the actions you request. The extension communicates only with the Bolt application running locally on your own device over a loopback connection; it does not send this data directly to Bolt’s servers. The Bolt app then handles that data as described in this Policy — for example, sending only the content necessary to fulfil your request to the model or tool provider you or your administrator have selected. The extension accesses a tab only after you connect it, and you can disconnect at any time.

Information collected automatically

Operational and security logs — such as sign-in events, audit records of actions and approvals, IP address, and timestamps, used to operate and secure the Services.
Limited product analytics — aggregate, privacy-respecting usage signals to understand and improve the Services. The desktop app can run without outbound telemetry, and self-hosted and air-gapped deployments keep data within your infrastructure.

2. How we use information

Provide, maintain, and improve the Services and perform the tasks you request;
Authenticate you, secure your account, and enforce administrator policies and governance;
Maintain audit logs and provide reporting to your organization’s administrators;
Respond to your requests and provide support;
Detect, prevent, and address fraud, abuse, and security incidents; and
Comply with legal obligations.

We do not sell your personal information, and we do not use the content of your files, messages, or connected-account data to train generalized or foundation AI models.

3. Google user data

Bolt’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you sign in with Google or connect a Google account, we access the specific Google services and scopes you authorize during consent (which may include your basic profile and email address for sign-in, and, where you enable them, services such as Gmail, Calendar, or Drive) solely to provide the features you request. Specifically, Google user data is:

used only to provide and improve the user-facing features you have asked Bolt to perform;
not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with equivalent protections;
not used for advertising; and
not used to train generalized AI or machine-learning models.

Human access to Google user data is not permitted except with your explicit consent for specific data, as necessary for security or to comply with applicable law, or on aggregated, anonymized data for operations. You can revoke Bolt’s access at any time from the Bolt console or from your Google Account permissions page.

4. How we share information

Within your organization — administrators of your workspace may access account, usage, and audit information as part of managing the Services.
Service providers — vendors that host infrastructure or process data on our behalf, under contractual confidentiality and security obligations.
Model and tool providers — when you run a request, the necessary content is sent to the model provider or tool you (or your administrator) have selected, which may be our hosted gateway, your own keys, or self-hosted models.
Legal and safety — where required by law or to protect the rights, safety, and security of users, the public, or Bolt.

5. Data retention

We retain information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. You or your administrator can delete content and accounts, after which we delete or de-identify the associated data within a commercially reasonable period, subject to legal retention requirements.

6. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit, hashed credentials, scoped access tokens, and audit logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise these rights, or ask questions, by contacting us at the address below. If your access is managed by an organization, please also contact your administrator.

8. International transfers

We may process and store information in countries other than your own. Where we transfer personal information internationally, we take steps to ensure appropriate safeguards are in place. Enterprise customers can choose self-hosting or a specific region for data residency.

9. Children’s privacy

The Services are not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them.

10. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice as required by law.

11. Contact us

Questions about this Policy or our privacy practices? Contact us at [email protected].