Privacy
Policy.

Glueprint ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use the Glueprint desktop application, mobile app, cloud relay service, and web portal (collectively, the "Service").

01 · CollectionWhat We Collect

Account Information

When you create a Glueprint account, we collect:

• Email address (provided during registration)
• Activation key (used to unlock the desktop application)
• Subscription tier and billing status
• Security-related metadata (authentication hash, authentication salt, and encryption salt) used to derive and protect your encryption keys — these values cannot be used to decrypt your session data

Usage Analytics

We use PostHog (PostHog Cloud, US region) to understand how Glueprint is used so we can improve it. We do not collect the content of your coding sessions, agent conversations, or source code.

• Website analytics — anonymized page views and download interactions on our marketing site, used to understand which pages and downloads are useful. Analytics is configured cookieless (it uses your browser's local storage, not tracking cookies). When you follow a link from the marketing site into the web portal, the random analytics identifier from local storage is included in that link so we can see which pages led to a sign-up; the marketing site never knows who you are. Separately, Glueprint may use first-party functional cookies across its subdomains: one to remember your chosen color theme, and — only if you arrive through a partner referral link — one that records that partner’s referral code and the time you clicked it, so the referral can be credited.
• Web portal product analytics — because the web portal is something you sign in to, its page views and a small set of product events (for example signing in, creating a session, or starting a checkout) are associated with your account, along with your plan and role, so we can see how signed-in users use the product. This never includes your source code, session content, or agent conversations. Like the marketing site, it is configured cookieless (browser local storage, not tracking cookies).
• Download counts — our download server counts completed downloads and auto-updates so we know how many real installs happen. These counts use a coarse, non-identifying value derived from a one-way hash of IP address, browser type, and the day; we do not store your raw IP address.
• Desktop application telemetry — the desktop app sends a small set of usage events (install, update, launch, and similar product events such as starting an agent session). Before you sign in, these are anonymous, identified only by a hashed per-machine ID. Once you sign in to the app with your account, this telemetry is associated with your account and organization so we can understand and support real product usage. It never includes source code, session content, file paths, prompts, or agent conversations — only feature usage counts and product events. This is opt-out: turn it off any time in Settings → General ("Share usage analytics"), which stops all of it, including the account association.
• Error & crash diagnostics — when something breaks in our websites or apps, we use Sentry (Sentry, US region) to capture the error message, stack trace, and the page or screen where it happened so we can fix it. On the signed-in web portal these reports are linked to your account (user ID, email, plan) to help us reproduce the problem. In the desktop, CLI, and mobile apps, crash reporting is anonymous and can be turned off in Settings (on desktop it shares the "Share usage analytics" opt-out; on mobile, the "Share crash reports" toggle) — opt out and no crash reports are sent. Reports never include your source code, session content, or agent conversations.

Cloud Relay Metadata

When you use the cloud relay service, we process the routing metadata required to deliver encrypted event envelopes, including tenant, host, session or channel identifiers, sequence numbers, timestamps, presence, and event-type labels. Some fixed-enum control fields remain visible so the Service can route and authorize them. Free-text payloads are transmitted as ciphertext; the key-delivery boundary differs for password and Enterprise SSO seats as described below.

Local Data

The Glueprint desktop application stores data locally in the ~/.glueprint/ directory on your machine. This includes session transcripts (JSONL), work item configurations (YAML), workflow definitions, audit logs, project metadata, and application settings. This data remains on your device and is not transmitted to our servers unless you explicitly enable the cloud relay feature.

02 · Cloud boundaryCloud Relay & Encryption

Glueprint encrypts classified session content and free-text event payloads on the client using AES-256-GCM before relay transit. The relay processes ciphertext and the routing metadata required for delivery. The way a client obtains the tenant Data Encryption Key (DEK) depends on its authentication path:

• Password and recovery seats derive a Key Encryption Key locally with PBKDF2-SHA256 and unwrap an AES-GCM-wrapped tenant DEK on the client. The relay stores the wrapped key but does not receive the password-derived key required to unwrap it.
• Agent hosts derive a Key Encryption Key from the host API key and unwrap an AES-KW-wrapped tenant DEK on the host.
• Enterprise SSO seats use a second, tenant-bound key wrapped by AWS KMS. During an authenticated SSO session, the relay may ask KMS to decrypt that key and return the plaintext DEK to the client over TLS. This places the active relay inside the SSO key-delivery trust boundary.
• Each encrypted message uses a random 12-byte nonce with authenticated encryption.
• Routing metadata and selected fixed-enum control fields remain visible where delivery and authorization require them.

03 · Your hostsLocal Data Storage

The Glueprint desktop application stores all operational data locally in the ~/.glueprint/ directory. This includes:

• Session transcripts (JSONL format)
• Work item configurations (YAML format)
• Workflow and methodology definitions
• Audit logs
• Project metadata
• Application settings and preferences

This data remains on your machine unless you explicitly enable a cloud feature. When the cloud relay is enabled, classified free-text payloads are transmitted as ciphertext, while the routing metadata and selected fixed-enum control fields described in Sections 1 and 2 remain visible to the Service.

04 · ProvidersThird-Party AI Services

Glueprint orchestrates interactions with third-party AI services (such as Anthropic's Claude) on your behalf. The agent tool sends prompts and receives AI-generated output under the provider account configured on your host. If you control that host remotely, related content may cross the Glueprint relay as encrypted event or control traffic before reaching the host; the configured AI provider receives plaintext needed to perform the request. Each provider operates under its own privacy policy and terms of service; please review Section 5 ("Third-Party AI Services") of our Terms of Service for additional details.

05 · ProcessorsThird-Party Infrastructure Services

We use or may use the following third-party infrastructure services:

• Authentication provider — for PKCE OAuth login flows
• Payment processor — we may use third-party payment processors for subscription billing; if so, we do not store full credit card numbers
• Analytics — PostHog (PostHog Cloud, US region) for website, web-portal, download, and desktop usage metrics, configured cookieless. The marketing-site and download metrics are anonymized; the signed-in web portal's metrics, and desktop telemetry after you sign in to the app with your account, are linked to your account (see Section 1, "Usage Analytics")
• Error & crash reporting — Sentry (Sentry, US region) for error messages and stack traces from our websites and apps, linked to your account on the signed-in web portal (see Section 1, "Usage Analytics")

Each third-party service operates under its own privacy policy. We share only the minimum data required for each service to function.

06 · CredentialsCookies, Local Storage & Credential Files

The Glueprint web portal uses browser session storage for authentication state and may cache raw DEK bytes in a tab-scoped record bound to the current user and tenant so the key survives a reload. Session storage is cleared when the browser tab's session ends, and Glueprint clears its key record on logout. Our marketing site and web portal use browser local storage, not cookies, to hold analytics state. Glueprint web surfaces also use first-party functional cookies shared across Glueprint subdomains. One remembers the selected color theme and contains only the theme identifier. The other is written only when you arrive through a partner referral link: it holds that partner’s referral code and the time of your click, can persist for up to 30 days (subject to browser storage retention limits), and exists solely so that a resulting signup can be credited to the partner who referred you. Neither contains account, analytics, or session data, and neither is used to build a profile of you or to track you across other companies’ websites.

The desktop application stores user tokens and API keys in separate files under the Glueprint data directory. On Unix, these files are written with owner-only permissions. The shared credential store also supports an environment-variable override. These credentials are not universally backed by an operating-system keychain or encrypted at rest, so operating-system account controls, filesystem permissions, and disk protection remain part of the endpoint security boundary. We do not use third-party advertising cookies or cross-site tracking cookies; the browsing cookies set by Glueprint web surfaces are the first-party functional theme and referral cookies described above. When you open a forwarded port from one of your hosts in the web portal, Glueprint sets one additional first-party functional cookie, named gp_pf, on the separate preview domain that serves that port. It contains only a signed, short-lived reference to the preview session you opened, is marked HttpOnly and Secure, is never sent to any other Glueprint domain, and expires with that preview session.

07 · LifecycleData Retention & Deletion

Account data is retained for the duration of your subscription. Encrypted event data in the cloud relay is retained for approximately one hour to support real-time delivery and short-term recovery, then automatically purged. Session routing metadata (session identifiers and sequence counters) is retained for up to 24 hours. You may request deletion of your account and all associated server-side data at any time by contacting us. Local data stored on your device is under your control and can be deleted at any time by removing the ~/.glueprint/ directory.

08 · RegionsInternational Data Transfers

Our cloud relay infrastructure is hosted in the United States. If you access the Service from outside the United States, your routing metadata and encrypted event data will be transferred to and processed in the United States. Session content is encrypted before relay transmission; the applicable password or Enterprise SSO key-delivery trust model is described in Section 2. We take appropriate safeguards to ensure that any transfer of personal data complies with applicable data protection laws.

09 · EligibilityChildren's Privacy

Glueprint is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from anyone under 18. If you believe that someone under 18 has provided us with personal data, please contact us and we will promptly delete it.

10 · ControlYour Rights

Depending on your jurisdiction (including under the GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Request that we correct inaccurate data
• Deletion — Request that we delete your personal data
• Portability — Request your data in a machine-readable format
• Objection — Object to processing of your data for certain purposes

To exercise any of these rights, contact us at the address below.

11 · RevisionsChanges to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the effective date above. Your continued use of the Service after changes constitutes acceptance of the revised policy.

12 · ContactContact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: privacy@glueprint.ai