3. What we collect, and why
Visiting the website
Nothing of ours. Our hosting providers, Vercel and Supabase, receive the technical details
every web request carries, such as your IP address and browser, to deliver the page, and handle
them under their own policies.
Asking the website a question
The "Ask about the product" window records every question: its text, the topic it matched,
whether it was answered, the page you asked from, and any campaign tags in the link that
brought you (such as utm_source). It records nothing that identifies you. We read
the questions to decide what to build and what to write, and delete them after 12 months. Do not
type personal information into it.
The contact form
Your email address, name, company, what you run today, your message, and any campaign tags in
the link that brought you. We use them to reply to you, and only we can read them.
Creating an account
Your email address and a password, or a sign-in link sent to your address. Supabase handles
sign-in; we never see your password. We keep when your account was created, when you confirmed
your address, and when you last signed in, and Supabase records the IP address and browser of
each sign-in, for security. Only a confirmed address, or one we invited before sign-up opened,
can use the product. If we invited you then, we keep your address and a note of ours.
A personal address (from a public email provider) cannot create an organization. The account
it made still exists until it is deleted, and we can see that it was refused.
Your organization
Its name, its email domain, the statement its creator made that they may create it (word for
word, with who and when), whether it said its work is export-controlled, and its members: their
roles, seats, how and when they joined, who is a key custodian and who appointed them, and who is
waiting for approval.
Members of an organization can see each other's email addresses, and project members can see
each other's.
If you joined the waiting list, your answers to its questions: what you are working on, your
industry, how you heard of us, and what you want from the product. You and we can read them.
Your programs
Everything you put in: projects, models, plans, tasks, comments and attachments. We hold it
to run the service for you. Section 4 covers how it is protected.
A few seconds after you change a program, the application also sends us how many
requirements, risks, tasks and milestones it has, and how many of them are verified, open or
done. Numbers only, never names. We add them up across customers to see how much the product is
used. When you read a notice in the product, we record that you read it, and when.
Planned, and off unless you turn it on: a feature that shares patterns seen
in at least three unrelated organizations — never text, values or identifiers — to improve what
every customer is offered. You would see every file before it left.
Seeing who else is in a project — not switched on yet
Not switched on yet. Our hosted service refuses presence connections until we apply the rules
that admit only a project's members, and set it to refuse any channel those rules do not cover.
Until then, the application says presence is off.
When it is on, a project's other members can see that you have it open, and you can see them.
We show it so people working on the same project can see each other, and use it for nothing
else.
Your browser shares your member identifier, a random identifier for the browser tab, the name
of the branch you are in, and the commit you are looking at, which can be an autosaved draft. It
also shares the kind of view you have open, the identifier of the element that view is for, the
identifiers of up to 20 elements you have selected, and whether you have been active in the last
two minutes. It shares identifiers, never the names, text or values of elements. Your display
name, which today is your email address, is not shared this way: each member's browser shows it
from the project's member list. To join, your browser also sends the project's identifier and
its sign-in token, so the service can check you are a member.
An element marked export-controlled, or not yet assessed for export control, is never sent:
not its identifier, and not a count. Others see only that your selection is not shared.
Presence travels over Supabase Realtime, part of the same Supabase project that holds your
data. It is held in memory only while you are connected, by Realtime and by the browsers of
members who have the project open. It is dropped when you close the project or lose your
connection, and it is never written to our database or to the project's history. Realtime runs
in several regions, and your browser connects to the nearest one. While you are connected, your
presence can pass through regions outside the United States and be held in memory there.
Supabase's connection logs may record when your browser joined and left the project's channel,
and technical details such as your IP address, but not what you had selected.
When presence is switched on, it is on for every project, and other members can see you from
the moment you open one. The first time you open a project's design view with presence working,
the application tells you, once per project in each browser. To turn it off, open "Who's here"
and choose "Hide my presence". While you are hidden, your browser does not connect at all.
Nobody sees you, and you see nobody else. The choice is kept in your browser (section 6) and
covers every project you open there afterwards. A tab already open elsewhere stops sharing when
you reload it. Without our hosted service, presence is off.
Presence is for display only. It is not a record that anyone saw anything. The service checks
that a browser belongs to a member, but not which member it claims to be, so one member could
appear as another.
The assistant
When you ask the assistant a question, your browser decrypts the parts of the program the
question is about and sends them, with the question, through our service to Anthropic, which
runs the model. We store who asked, when, which model, the tokens used, what it cost, and a
digest of what was sent — never the question or the answer. Your organization's members can see
those records.
Connecting an AI agent
If you connect an AI client such as Claude to your program over MCP, you sign in and
approve it. Our connector then lets it read your projects, tasks, schedule, risks and earned
value, and propose changes that wait for a person; each proposal is labelled with the client's
name. To answer it, our server decrypts the parts it asks for.
The credential the client is given carries your own access. It is refused
your organization's key on its own; only our connector can fetch the key with it, on your
behalf. Everything else you can do, it can: read what we store unencrypted (section 4), change
your projects' records, including pointing a project at a different saved version of itself,
which skips the review a proposal waits for, and act on your account itself, which a client set
on misusing it could turn into a way to your program.
Connect only clients you would trust with your own account. Supabase keeps the client's
registration, your approval and its session; our own code keeps no copy of its token. What the
client does with what it reads is governed by your agreement with its provider.
Problem reports
Only when you choose to send one, and only after you have seen what it contains. An automatic
crash report carries a random identifier for your installation, the release, your operating
system family, which parts of the product you were using, the shape of your last few actions and
of your program (counts and statuses, never names), and where the error happened in the code —
never the error's message or any of your content. A report you write yourself also carries your
title, your description and up to three screenshots. Either kind carries your account if you are
signed in, and your organization if you belong to exactly one, so that deleting the organization
deletes the report. We keep a copy in your browser.
We read reports on our own machines and on build servers we rent from GitHub, and we triage
them with the help of AI models from Anthropic.
Feedback
What you write, its kind and severity, and your account. If you leave the box ticked, which it
is by default, also your browser's description of itself and the page you came from. We use it to
reply to you and to fix things, and for nothing else.
Billing
Stripe takes your card; it never reaches us. We keep the references Stripe gives us, your
seats, the price and the dates. From each message Stripe sends us about your subscription, we
keep only its references, amount, currency and status. We never keep the billing name, email or
address Stripe holds, and from a message we do not act on we keep only its identifier and type.
We keep these as financial records.
Email we send you
Messages about your account: access being granted, somebody asking to join your organization
(which includes their address), the reminder before a trial ends, changes to what the assistant
costs, and anything about deleting your organization. Resend delivers them. Some of these, and
alerts about failures, also reach our own mailbox, and can include your address and, for a
deletion, the reason given.
Product updates and the newsletter — not sending yet
When we start: you choose to subscribe, on the website or with an unticked box when you sign
up, and you confirm from an email before anything is sent. We keep your address, what you chose
to receive, the exact wording you agreed to and when, and when you confirmed. We record when an
email is delivered, opened or clicked, and when it bounces or is marked as spam, to know whether
it is worth sending. Every email has a one-click unsubscribe that takes effect at once.