What duetpad knows about you.

Your sign-in details. Email address, and a one-way scrambled version of your password (we never see the password itself). If you sign in with GitHub instead, we receive your email address and a stable account identifier from GitHub — we never ask GitHub for your repositories or your code.

Your profile. The name and avatar you put on your settings page. Optional — leave them blank and duetpad still works.

Your projects and cards. Everything you type into the canvas: project names, folder names, personas, jobs, journeys, problem statements, briefs. This is the work itself. We store it so you can come back to it.

Pairing keys. When you connect an AI to duetpad, we generate a long, random key that lets it talk to your projects. The full key is shown to you once; we keep only a one-way scrambled version, enough to recognise it — even we can’t read it back. You can revoke it from your settings page at any time.

Connection records. Light, technical breadcrumbs about your Claude Code connection — when it last connected, whether it’s online — so the canvas can show “paired” or “not paired” correctly.

Semantic-search embeddings. When you save a card, duetpad sends its text — the title, summary, and body (up to the first 8,000 characters) — through OpenRouter to an OpenAI embedding model, which returns a short numeric fingerprint (an embedding) so Cmd-K search can find the card. We store that fingerprint against your card and keep no separate copy of the request.

Product-analytics events — only if you say yes. If you accept the analytics banner, we count which actions you take — “created a project”, “paired Claude Code” — so we can see what’s working. Never the words inside your cards. Decline and your browsing sends nothing. One caveat: a small set of service-side milestones — a checkout opening, a subscription going live, an AI-written card landing — are counted on our servers, where no banner choice can reach; they carry your account reference, never your card content. This is handled by PostHog.

Error reports. When something breaks, we collect a diagnostic report — what went wrong and roughly where — so we can fix it. We keep your project content out of these. This is handled by Sentry, and runs regardless of your analytics choice — it’s how we keep duetpad stable and secure, not how we measure you.

Running your account and canvas. Your sign-in details, profile, projects and cards, and pairing keys. Lawful basis: performance of our contractwith you (Article 6(1)(b)) — we can’t give you the service you signed up for without them.

Semantic-search embeddings. The numeric fingerprint behind Cmd-K search. Lawful basis: performance of our contract(Article 6(1)(b)) — it’s part of the product you’re using.

Keeping duetpad working and secure. Connection records, and the error reports that keep the product stable. Lawful basis: our legitimate interests(Article 6(1)(f)) in a product that stays working, stable, and secure — weighed against your privacy, and never used to measure you.

Product analytics. The action counts described above. Lawful basis: your consent (Article 6(1)(a)), given through the analytics banner and withdrawable at any time, for everything counted from your browser. The service-side milestones (checkout, subscription, AI-written cards) rest on our legitimate interests(Article 6(1)(f)) in knowing whether the product’s core loops work.

Billing. Your plan status and customer reference, when you start a paid plan. Lawful basis: performance of our contract (Article 6(1)(b)), plus our legal obligations (Article 6(1)(c)) to keep tax and payment records for as long as the law requires.

We don’t sell or share your work. Your projects and cards are never sold, rented, or handed to advertisers.

We don’t read your project content to measure you. The product analytics described above count actions, never the words inside your cards. No ad networks, no affiliate links, no cross-site ad tracking.

We don’t collect your browsing history, location, contacts, calendar, or anything else outside duetpad’s own canvas.

We don’t see your payment card. When you start a paid plan, Stripe handles the card — duetpad only ever gets a customer reference and your plan status, never the card itself.

Sign-in cookie. Keeps you signed in between visits. Essential — without it duetpad forgets who you are on every page load.

Theme cookie. Remembers whether you picked light or dark. Optional, easy to clear.

Sidebar cookie. Remembers whether your sidebar is open or collapsed. Optional.

Analytics-choice cookie. Remembers whether you said yes or no to product analytics, so we don’t ask again on every visit. If you never answer, analytics stay off.

Analytics cookie (PostHog). Set only if you accept analytics. It holds a random device identifier and a matching visitor identifier, so we can tell one visit apart from another and count how features get used. It lasts up to 12 months, and PostHog keeps a copy of the same identifiers in your browser’s own storage. It carries no name, no email, and nothing you’ve written on a card. Decline, or never answer, and it is never set — and if you change your mind later, we remove it along with that stored copy.

Supabase hosts the database where your projects live and handles the sign-in machinery. Data sits in EU regions (Frankfurt and Paris).

Vercel runs the website itself — the page you’re reading right now. Vercel sees the standard request information any hosting service does (your address, the page you asked for, a timestamp), and its Speed Insights feature collects anonymised page-load timings so we can keep duetpad fast.

Liveblocks relays the live layer of the canvas — cursors, presence, and real-time edits between you, your teammates, and your AI. It handles the live updates it passes along and the connection details needed to route them.

Cloudflare stores the images and media files you add to your canvas, and renders the canvas snapshots your AI can request. It holds those files and serves them back when you view them.

Resend delivers the emails duetpad sends you — welcome, billing, and comment notifications. It sees your email address and the content of those messages.

OpenRouter routes the embedding requests duetpad generates for Cmd-K search. Your card’s text — its title, summary, and body (truncated to 8,000 characters) — travels through OpenRouter to reach the OpenAI embedding model, which returns the numeric fingerprint. AI writing happens inside your paired Claude Code session, never through OpenRouter.

Stripe handles payment when you start a paid plan. Stripe sees the bits payment processors need to see (your card, your country); duetpad only gets a customer reference back.

PostHog records the product-analytics events. Browser events flow only if you accept the analytics banner; the service-side milestones described above flow regardless. It sees which actions you take, never the words inside your cards.

Sentry catches error reports when something breaks, so we can fix it. It sees the diagnostic detail of a crash, not your project content.

GitHub — only if you choose to sign in with GitHub. It confirms who you are and passes us your email address and a stable account identifier. We never ask it for your repositories or your code, and it never sees anything on your canvas.

Vercel — the standard request information for serving the website.

OpenRouter and the OpenAI embedding model— your card’s text, to build the search fingerprint.

Stripe — payment details, when you start a paid plan.

Sentry — the diagnostic detail of a crash, not your project content.

GitHub — your email address and account identifier, and only if you choose to sign in with GitHub.

Liveblocks, Cloudflare, and Resend— the live-canvas relay, your uploaded media, and the emails we send you, respectively.

Deleted work runs on its own clock. When you move a project to the trash, or remove a card from the canvas, it isn’t destroyed straight away — you can restore it for a while. On a free or lapsed account that window is 7 days; on a paid plan (including a lifetime purchase, a team seat, or your free trial while it runs) it’s 90 days. Before anything goes, we email you a warning and give you at least another 3 days to restore what you want to keep. After that it is permanently deleted and cannot be recovered — not by you, and not by us.

Product-analytics events (only if you turned them on) are kept by PostHog for up to 12 months and then deleted or rolled up into anonymous totals.

Error reports are kept by Sentry for 90 days and then purged.

Export your data. Settings → Account → Export your datadownloads the work you own — projects, cards (archived ones included), folders, canvas sections, and a download link for each uploaded image, plus your billing details, Claude Code connections, and activity log — as a single JSON file. No queue, no email-confirm, no waiting.

Delete everything. Settings → Account → Delete accountwipes your account and all the projects in it. There’s no recovery. We’d rather you keep that power than have to email us for it.

Edit anything wrong. Profile, projects, folders — all editable from inside the app. If something can’t be edited and you think it should be, tell us.

Revoke Claude Code. The pairing key you generated for Claude Code can be revoked from settings. New key, old one stops working.