Privacy Policy
This says what we collect, why, where it goes, and how to get it back or make it go away. Short version: we keep what the product needs to work, we encrypt the one truly sensitive thing you give us, we never sell anything, and you can export or delete everything from Settings.
What we collect
| Data | Why | Kept until |
|---|---|---|
| Email, name, handle, password hash | Your account. Passwords are hashed (PBKDF2), never stored. | You delete the account |
| Sessions (token hash, browser string, IP) | Keeping you signed in; letting you see and end sessions | 30 days, or sign-out |
| Provider API keys, vault mode | Pooling. Encrypted with AES-GCM under a key held only in our runtime secrets. | You revoke the key — the ciphertext is wiped then |
| Provider API keys, on-device mode | Never sent to us. Lives in your browser only. | You clear it |
| Usage events (who called, which model, token counts, cost estimate, status) | So key owners see every request made with their key, and so crews see their pool | Kept; personal link removed on account deletion |
| Builds, tasks, threads, messages, registry | The product | The crew deletes it |
| Billing customer id, invoices | Subscriptions and receipts. Stripe holds card details; we never see them. | 7 years (tax law) |
| Audit log (who did what to whom, IP) | Abuse handling and your own accountability inside a crew | Kept; actor unlinked on deletion |
| Email delivery status | To stop mailing addresses that bounce | Indefinitely, per address |
What we send to AI providers
When you or your crew use the Forge, the Mediator, or the completions API, the prompt — your message, the thread's recent history, the build's title, tagline, stack and agreed registry — goes to the provider the request was routed to, using the key that served it. What that provider retains is governed by its policy and the account the key belongs to. We do not use your prompts or code to train anything.
Who else sees your data
- Cloudflare hosts everything (Workers, D1 database, static sites).
- Stripe processes payments and holds card details.
- Resend delivers our transactional email (verification, invites, key-use alerts).
- Zoho Mail hosts the support inbox you write to.
- AI providers you or your crew route to, as above.
- Your crew sees what the build's access mode allows: members see threads, tasks, the registry, who pooled which provider and how much was used (never the key itself).
- Our staff can see that a build exists, its title, its members and its audit log — enough to action an abuse report. Staff cannot read a private build's content, cannot spend a crew's keys, and every staff action is logged.
We do not sell personal data and we do not run advertising.
Cookies
None for tracking. Your session is a token in your browser's local storage, sent only to api.teamable.dev.
Your rights
- Export — Settings → Your data gives you everything as one JSON file, immediately.
- Correct — name, handle, bio and email are editable in Settings.
- Delete — Settings → Delete account removes your personal details, sessions, keys, memberships, applications and sparks. Work you shipped into a crew stays, attributed to "a deleted account", because it belongs to the crew too.
- Object or complain — email support@teamable.dev. If you are in the EU/UK you may also contact your data protection authority.
Security
Transport is TLS everywhere. Passwords are hashed; session tokens are stored only as hashes; provider keys are encrypted at rest under a secret that is not in the database; staff access is a hardcoded allowlist that requires a code deploy to change. If we discover a breach affecting your data we will tell you within 72 hours of confirming it.
Children
The Service is not for people under 16 and we do not knowingly hold their data. Tell us and we will delete it.
Changes
We will email account holders about material changes at least 14 days before they take effect.
Contact
support@teamable.dev