Privacy and terms, in plain language.

We collect: workspace name and members, source connection metadata (repo URL, doc workspace ID), Stream events you capture (decisions, lessons, preferences), Atlas nodes and edges derived from those events, citations back to source artefacts, and product telemetry needed to operate and improve the service.

We do not, by default, store the contents of your source repos, docs, or threads. Source contents are read transiently to derive structure and candidates, then discarded. Local-only mode (Enterprise) keeps even that derivation inside your boundary.

You can export your workspace at any time as JSON. You can delete an event, a Capsule, a scope, or the entire workspace. Deletion is hard-deletion within 30 days; backups roll off within 60 days. We confirm both in writing on Enterprise.

Personal scopes are visible only to you. Project, team, and client scopes are visible only to the members you authorise. Cross-scope promotion requires explicit, redacted action by the author. Agents see only the scope explicitly granted to the agent identity.

We use subprocessors for cloud hosting, object storage, transactional email, error reporting, and payment processing. The full list lives on the Trust page and is updated when it changes. Material additions trigger advance notice for Enterprise customers.

Encryption in transit and at rest. Per-workspace KMS keys for Enterprise. Access reviews quarterly. Vulnerability disclosure at [email protected] with a 90-day coordinated disclosure window.

We do not train foundation models on your project data. We do not share your project data with model providers beyond the per-request context required to fulfil your queries. You can disable third-party model providers entirely on Enterprise.

Acceptable use, fair-use limits on Context Credits, indemnification, warranty disclaimers, and dispute resolution are described in our Master Subscription Agreement (Enterprise) and Standard Terms (Solo and Team). Both are written in plain language and available on request.

Questions about this policy: [email protected]. Security disclosures: [email protected]. Data subject requests: [email protected].