Privacy

Privacy notice review draft

Information handled by the service

• Account and profile information, including email address, display and preferred names, time zone, notification preference, avatar URL, onboarding state, and account status.
• Sign-in identifiers received from configured Google or GitHub OAuth, or password hashes when local authentication is enabled. Provider credentials are not stored in account exports.
• Workspace content, including workflow configuration, tasks, notes, deployments, activity, importer input and decisions, report drafts, and finalized report versions.
• Session and security metadata, including device label and type, user agent, IP address, activity and expiry times, and revocation state.
• Stripe customer and subscription references, local entitlement state, and complimentary access records when billing features are configured.
• Support-case summaries and operational records submitted through an available support process. Private work content should not be sent unless a secure process explicitly asks for it.

Why the information is used

The service uses these categories to authenticate accounts, preserve sessions, operate the personal work-context and reporting features, protect organization-scoped data, process configured billing actions, respond to support needs, prevent abuse, diagnose failures, and perform account export or deletion requests.

Analytics and operational diagnostics

Optional usage measurement requires opt-in through Privacy choices and can be withdrawn there. Events contain only a version, surface and predefined action; route templates are assigned by the server. No analytics provider script runs in the product. Events must not contain task titles, note bodies, importer input, report content, company or project names, secrets, or tokens. Operational services may process request metadata such as route, status, request identifier, IP address, or user agent for security, rate limiting, and diagnosis. The repository does not establish a production analytics deployment or an approved retention policy. The prepared Umami adapter uses separate development and production configuration. Advertising remains disabled; local review placeholders load no provider code.

Cookies and device storage

Web sessions use an HTTP-only refresh cookie and in-memory access credentials. The web app stores workspace, appearance and versioned optional privacy preferences in browser storage. Product privacy choices are scoped to the account in that browser; marketing choices are separate. Private or testing desktop and mobile wrappers use their platform session-storage implementations; those wrappers are not public releases. Removing browser or application storage signs out that local device but does not delete the account.

Service providers and external systems

Google and GitHub are contacted only when their OAuth sign-in is configured and selected. Stripe is contacted for checkout, subscription management, and webhook processing only when billing is configured. The deployed hosting, database, proxy, monitoring, backup, and analytics services are operator-controlled infrastructure choices and must be identified before this notice is made effective. Installing a package alone is not treated as use of a processor.

Account export, deletion, and retention boundaries

Account settings provide a versioned JSON export of profile, workspace, billing reference, safe session metadata, support, task, note, activity, report, and importer data. Credentials, token hashes, one-time OAuth codes, access tokens, and company-admin audit data are excluded.

Deletion requires the account email and is blocked by an active or trialing subscription, platform-staff access, or a workspace with another member. A successful transaction deletes the account and sole-member workspaces, dissociates retained support cases, pseudonymizes prior organization-deletion actors, and retains only a hashed user identifier, deleted workspace count, and deletion timestamp as account-deletion evidence.

Deletion does not remove records held by Google, GitHub, Stripe, app stores, or other external providers. Operational logs and backups may follow separate operator-controlled lifecycles; no deletion timing or backup-retention duration is promised by this draft.

Your choices

You can update profile preferences, review and revoke active sessions, export account data, manage an available subscription through Billing, and request account deletion in Account settings. Provider-held information must be managed with the applicable provider.

Contact and changes

Use the Support page for the configured privacy or security contact path. If no destination is configured, the page says so and no receipt or response time is implied. Policy revisions will be published here; direct change notifications are not promised unless a separate mechanism is approved and implemented.