Customer-owned Git
The product reads and writes the customer’s repository. Deleting a workspace deliberately leaves that repository alone.
Privacy and data handling
Say what the product handles. Say when it leaves.
This page describes current software behavior in plain language. It is an engineering data map, not a counsel-reviewed privacy policy or DPA.
Legal framing, lawful bases, jurisdiction terms, and contractual commitments still require counsel review before production launch.
Where data lives
The customer’s content stays portable.
Workspace-scoped Postgres
Accounts, projects, drafts, settings, analytics, and audit records live in Postgres behind row-level security.
Project-scoped assets
Images, PDFs, and fonts are content addressed, with separate copies and prefixes across projects and workspaces.
People who read
Cookieless analytics with no stored reader address.
Published sites set no analytics cookie or browser storage. A reader address is hashed and discarded before storage; the salt rotates daily, so yesterday’s visitor cannot be joined to today’s.
Path, coarse country, device class, bare referrer host, and a daily salted hash.
90 days. Each project can choose between 1 and 400 days, and shortening it deletes already-expired analytics immediately.
Published documentation includes no third-party analytics, fonts, or scripts because of Staleless.
AI features
Off until a workspace chooses them.
Ask Staleless and writing help are separate switches because they send different content.
Published passages only
A question and up to six matched published passages go to the configured OpenRouter model. No reader identity, address, session, draft, or private page is included.
The selected text only
The selection, matching glossary terms, and site style guide go to the provider. The suggestion is not stored and changes nothing until the writer accepts it.
Customer controls
Take it, shorten it, or remove it.
Download Markdown, navigation, variables, snippets, redirects, assets, versions, and a manifest of anything unavailable.
Shorten reader-analytics retention and apply the shorter window immediately.
Delete projects, accounts, or a workspace. A workspace stops serving immediately and its service data purges after a 30-day grace period.
Turn off AI features or remove connected services. Conditional data sharing stops with the next request.