Privacy Policy

What nowbuild.ing collects, why, who sees it, and what you can do about it.

Effective 18 September 2026 · Operated by WinLabs LLC

The short version

We collect what is needed to run a task manager: your account details, the work you and your team put into workspaces, and technical data needed to keep the Service secure.
There are no advertising, analytics or tracking scripts in the Service, and we do not sell personal information.
Records, files and sign-in live with Supabase; the application runs on Render; email goes through Resend. All three host the Service in the United States.
One cookie keeps you signed in. Your theme, motion, shortcut and last-workspace choices stay in your browser.
Agents you connect report usage counters (model, client, token counts), never prompts, responses or reasoning. What your agent reads goes back to your own client, which may forward it to whatever model you run.
Nothing is public until a workspace admin publishes it.
You can export a workspace at any time, correct your profile yourself, and ask us to delete your account; deletion is handled by hand and section 10 says exactly what it removes today.

1. Who we are

WinLabs LLC operates nowbuild.ing and is the controller of the personal information described in this policy. Where a team decides what to put into its workspace, the workspace admins are responsible for having the right to store that material; we process it on their and your instructions. Contact details are in section 13.

2. What we collect

Account details. Your name, email address, an optional profile photo, your role in each workspace, and the agent connections you create (their names, scope, creation and revocation times; tokens are stored only as hashes). When you set or enter a password, our servers pass it to Supabase Auth, which stores it in hashed form; our servers never store or log it, and our staff never see it.
Workspace content. Tickets, projects, comments, notes, decisions, Product brain notes, handoff summaries, attachments (up to 50 MB each) and their change history, including who made each change and when. If a workspace admin imports from Linear, the imported records and their source identifiers become workspace content.
Agent activity and telemetry. Which agent did what and when; the model and client names your agent reports; token counters; the work phase; the API-equivalent cost calculated from public list prices; and, for Claude Code’s telemetry export, a short hash of its session identifier. We do not store prompts, model responses, agent reasoning or provider credentials: the telemetry object on MCP and API requests accepts only the documented counters and rejects a request that carries anything else, and the separate Claude Code log intake keeps only its allow-listed usage attributes and drops the rest, prompts included.
Public journal interactions. Pressing I’d use this on a public roadmap item stores a hashed visitor identifier so the click counts once.
Visitor feature requests. The short title, optional explanation and optional email from Ask for a feature on a public journal. They become a ticket in that project’s workspace. We do not send a confirmation. If a workspace admin turns on Show visitor feature requests on this page, the titles (not emails or ticket identifiers) may appear on that page.
Waitlist. The email address you enter and the time you entered it.
Technical data. Our hosting provider, Render, keeps the server logs of the application under its own plan and retention terms; such logs commonly include the network address a request came from. The application itself writes error logs that name the failed operation and its error code or message (for example a provider’s error text when an email cannot be sent), not ticket content or the addresses being emailed, and holds network addresses briefly in memory to limit repeated requests.
Messages you send us, such as a deletion request or a support question.

3. Cookies and browser storage

We use no advertising or analytics cookies.

nowbuilding: keeps you signed in for up to 30 days; removed when you sign out. It is HTTP-only and belongs to the host you signed in on, so nowbuild.ing and the direct onrender.com address of the application each keep their own.
nowbuilding_visitor: set on public journal pages only after you press I’d use this, so your click counts once; kept for one year.
Local storage in your browser holds your theme (nowbuilding-theme), motion preference (nowbuilding-quiet-motion), keyboard-shortcut setting (nowbuilding-shortcuts) and the workspace you last had open (nowbuilding-workspace). The first three never leave your browser. The remembered workspace id is what the app asks our server to open when you return, so it is sent in those requests like any workspace you select.
The pre-rename cookie names winwork and ww_visitor are still accepted and replaced by the ones above; we plan to retire that compatibility after 11 October 2026.

4. Why we use it and our legal bases

Where the GDPR or a similar law applies, we rely on the bases in brackets.

To provide the Service you asked for: sign-in, workspaces, notifications, exports, agent access and publication on your admin’s instruction (performance of a contract).
To keep the Service secure and working: request logs, rate limits, error logs, backups, and investigating abuse (our legitimate interests in running a secure service, and yours in a service that works).
To send Service messages: invitations, password reset links, replies to your requests, and notice of changes to the Service or these policies (performance of a contract and legitimate interests).
To tell waitlist members when access opens (your consent, which you can withdraw at any time by asking us to remove your address).
To show how agents are used inside a workspace so teams can understand effort and cost (performance of a contract and legitimate interests).
To comply with the law and respond to lawful requests (legal obligation).

We do not use personal information or workspace content for advertising, for profiling, or to train machine-learning models.

6. Our providers and other recipients

These providers process data on our behalf to run the Service:

Supabase (sign-in, database and private file storage; project hosted in the us-east-1 region, United States). Holds account records, workspace content, attachments, encrypted session credentials and the waitlist.
Render (application servers; Virginia, United States). Runs the application and keeps its server logs.
Resend (transactional email). Delivers invitations and password reset links, so it processes the recipient address and message content.
GitHub (backups). A portable application archive is scheduled daily and kept as a private GitHub Actions artifact that expires after 90 days. It holds the application’s own records (accounts, workspaces, memberships, invitations, agent connections, tickets and other records, history, runs, imports, file references and interest clicks) together with the attachments and profile photos they reference. It is not a full backup: sign-in sessions, agent usage counters, in-app notifications, Supabase Auth identities and Supabase platform settings are not in it.

These parties receive data under their own terms, not as our processors:

Google Fonts. The public pages, including this one, load their typefaces from Google, which receives your IP address and handles it as an independent controller under its own privacy terms. The signed-in application does not load them.
Slack. A new waitlist signup posts the email address and time to a private WinLabs LLC channel so the team notices it.
Linear, chosen by a workspace admin who imports from it: the Service fetches that team’s data from Linear with the key the admin enters, uses it for that import only and does not store it.
X, chosen by a workspace admin who approves the exact text of a post. Production currently runs X delivery in preview mode, so nothing is sent; when live delivery is configured, the approved text goes to X under its terms.
Your AI provider, if your agent client forwards what it reads to one; that relationship is yours.

7. Where data is kept and international transfers

The Service is hosted in the United States. If you use it from the European Economic Area, the United Kingdom, Switzerland or another place with data-transfer rules, your information is transferred to the United States and handled under the data processing terms of the providers in section 6. Contact us if you need details of the transfer safeguards that apply to a particular provider.

8. How long we keep it

Account details: while your account exists, then handled as described in section 10.
Sign-in sessions: up to 30 days, or until you sign out or change your password.
Workspace content, history, notifications and agent telemetry: until members edit or delete it, or until the workspace is deleted. Deleting a workspace removes its records and file references from the live database in one step; the stored file bytes are then deleted from storage, and if that cleanup fails they stay in storage, unreachable through the Service.
Backup archives (the application records and referenced files described in section 6): scheduled daily and kept for 90 days, so something you delete can remain in an archive taken before the deletion until it expires.
Public interest clicks: as hashed identifiers, until the roadmap item or its workspace is deleted.
Waitlist addresses: there is no automatic deletion. WinLabs LLC removes an address by hand when you ask, and decides when the list itself is retired.
Server logs: for as long as our hosting provider’s plan keeps them.
Messages you send us: as long as needed to handle your request and keep a record of it.

9. Security

Connections use HTTPS. Passwords are handled by Supabase Auth, session credentials are encrypted at rest, and agent tokens are stored as hashes. Files live in private storage and are served only after a membership check; database tables are never exposed directly to browsers or agents. Every agent token is scoped to one workspace and can be revoked at any time. No system is perfectly secure; if you find a problem, please tell us using the contact in section 13.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to withdraw consent. We honor these for everyone as far as we can:

Access and portability. Export space in People & agents downloads a workspace’s records and files as JSON plus the original attachments.
Correction. Change your name, photo and password on Your profile. Ask us to change your sign-in email.
Leaving. Leave workspace in People & agents removes your access; your earlier work stays with the team and agents you connected there stop.
Deleting a workspace. The person who created a workspace can Delete workspace after downloading an export. It removes the workspace for everyone and cannot be undone.
Deleting your account. Delete your account on your profile opens an email to us, to be sent from your sign-in address. Requests are handled by a person. Today that means: we confirm with you, ask you to export and to leave or delete workspaces where the safeguards allow, then disable the account (ending its sessions, withdrawing its invitations and revoking its agents) and delete its sign-in identity, so nobody can sign in as you again. What the Service does not yet remove on its own: your account record (name, email address and profile photo), your remaining memberships and the workspaces you could not leave or delete, the person records that stand for you in workspaces, and the history entries attributed to you. Removing or anonymizing those is a manual, reviewed step; tell us what you want removed and we will do what the law requires. If you are the installation owner, ownership has to be transferred first. Backup copies expire within 90 days.
Waitlist. Ask us to remove your address at any time; removal is done by hand.

To exercise a right we cannot offer in the app, email us from your sign-in address so we can verify you. We answer within one month. If you are in the EEA, the United Kingdom or Switzerland you may also complain to your data protection authority. California residents have the rights to know, delete and correct, and not to be discriminated against for using them; we do not sell or share personal information as those terms are defined in California law.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from them. If you believe someone under 18 has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy. The current version, with its effective date, is always at nowbuild.ing/privacy. For material changes we will post the new version on this page before it takes effect and, where we have your email address, tell you. This version is effective 18 September 2026.

13. Contact

Email privacy@nowbuild.ing.