Agent Gateway

What an AI assistant can and cannot do

You can let an AI assistant read the apreet data you choose. This page explains exactly what that means: what it can see, what it cannot, where your data goes, and how to cut it off.

Before anything else: the limits

Four things worth knowing before you read the rest, because they change whether this is useful to you at all.

Assistants. Claude and ChatGPT are the two we have confirmed work today. The Gateway is built on an open standard, so other assistants that support it may be able to connect too. We do not restrict it to a fixed list of companies, so we cannot tell you in advance every assistant that will work.
Where. Setup happens on a computer, not from an AI app on your phone.
Effort. Connecting is a one-time setup you do yourself, in the assistant.
Maturity. The Agent Gateway is new. Treat it as an early feature, not a finished one.

If any of those rule it out for you, nothing below will change that. We would rather you knew now.

Where your data goes

This is the part most pages skip, so it comes before the reassuring parts.

When you connect an assistant and ask it a question, the apreet data you authorised is sent to that assistant. If you connected Claude, Anthropic receives it. If you connected ChatGPT, OpenAI receives it. Once it arrives there, that company's own terms apply to it, including whatever they say about retention and about training.

That is not a side effect. That is the feature: the assistant cannot answer questions about your trips unless it receives data about your trips. But it means connecting an assistant is a real decision about a third company, not just a setting inside apreet.

What we control is the scope of it. Everything below is about keeping that as small as you want it.

For the full legal detail on data handling, see the Privacy Policy.

The short version

Nothing is connected until you connect it.
You choose which categories of data the assistant can reach.
It reads, and only reads. Nothing you can grant it changes your data.
You can revoke access at any time.
Requests are recorded, including the ones that were refused.
Requests are rate limited.
Credentials are scoped to your account alone and are never reused across accounts.
Contact notes and calendar descriptions are never included.

In detail

How each guarantee works

Nothing is connected until you connect it

The Agent Gateway is off until you turn it on. An assistant reaches your apreet data only after you add apreet as a connector in that assistant and then approve the connection on apreet's own screen. Until you approve it, there is nothing for the assistant to read.

Approval happens on apreet, not inside the assistant. That is the point: the assistant asks, and you are the one who says yes.

You choose what it can see

Access is not all-or-nothing. Permission is split into separate categories, every one of which only reads, and an assistant receives only the ones you granted:

Your profile. Your own account details.
Your itinerary. Where you are going and when.
Your matches. The people apreet has already worked out you might meet.
Your address book. The contacts apreet holds for you.
Cities. Looking up places by name.
Your weekly brief. The summary apreet prepares for you.
Same-city lookups. Who you already know where you are.
Trip search. Searching within a particular trip.

It reads, and only reads

Every permission an assistant can be granted is a read permission, so there is no combination of them that lets it change your apreet data. Two separate things hold that in place, and both matter: no write permission appears at the approval screen, so there is none to grant; and separately, an action that would change something cannot complete on its own: it stops and waits for a distinct approval step outside the assistant. An assistant asking for one is not the same as it happening.

That means an assistant cannot post anywhere, message anybody, alter your calendar or your address book, or change a setting. If you are weighing up whether to connect one, this is the part that should make it an easier decision than it sounds.

Write access is deliberately held back rather than absent by accident. If it is ever offered, it will be something you approve explicitly, and this page will say so.

You can cut it off

Access can be revoked, and revocation is the real off switch: the assistant stops being able to reach your data. If you are unsure about a connection, removing it costs you nothing except connecting again later.

Requests are recorded

Requests through the Gateway are recorded server-side, including the ones that were refused and why. That means "what did it actually ask for?" has an answer, rather than the request disappearing unlogged.

Requests are rate limited

There are limits on how much can be requested and how quickly. To be accurate about what that does: rate limits slow bulk extraction down. They are not a wall, and on their own they do not tell anybody it happened, which is what the recorded requests above are for. The real protection is what you granted and your ability to revoke it.

Two different secrets, stored two different ways

There are two credentials involved, and they are handled differently on purpose. The token your assistant presents is never stored in readable form. What is stored is a hash of it, and recovering the original from that is designed to be impractical. The credential the Gateway uses to talk to apreet on your behalf is stored encrypted, because that one has to be readable again to be usable at all.

Some things are never included

The Agent Gateway inherits the same limits as the rest of apreet. apreet does not read contact notes, and it does not read the description or notes of a calendar event. It uses the date and location of an event, and the city on an address. That was true before assistants were involved and it stays true, so there is no note text for the Gateway to pass on.

What this cannot protect you from

Two honest limits, because a security page that only lists strengths is not a security page.

Once data reaches the assistant, it is governed by that assistant. apreet controls what leaves. It does not control what the company behind that assistant does with it afterwards. That is their policy to read, not ours to promise.

Access you granted broadly can read broadly. The categories you approve are the real control. If you grant everything because it is quicker, you have granted everything.