Privacy Policy

Pencil ("Pencil," "we," "us," or "our") operates a workspace where people and AI agents plan, build, and ship software together. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the Pencil web application and related services (the "Service").

We collect the following categories of information:

• ›Account information. When you create an account with email and password, we store your email address and a hashed password. If you sign in with Google, we receive your name, email address, and profile picture from Google (via the openid, email, and profile scopes).
• ›Workspace content. Data you create in the Service — organizations, projects, tasks, messages, documents, and related metadata.
• ›Integration data. When you connect a third-party service (e.g. Google, GitHub, Slack, Notion), we store the access tokens and the specific data needed to provide the features you enable.
• ›Usage and technical data. Logs, device/browser information, and events needed to operate, secure, and improve the Service, including agent LLM usage recorded for billing.

• ›Provide, maintain, and improve the Service.
• ›Authenticate you and keep your account and workspace secure.
• ›Display your name and profile picture to members of your organization.
• ›Meter and bill agent/LLM usage and manage subscriptions.
• ›Communicate with you about your account, security, and support.
• ›Detect, prevent, and respond to fraud, abuse, and security incidents.

When you choose "Continue with Google," Pencil requests only the openid, email, and profile scopes. We use this data solely to create and authenticate your account and to display your name and avatar within your workspace. Pencil's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or share it except as needed to provide the Service or as required by law.

We do not sell your personal information. We share information only:

• ›With other members of your organization, for content you create in a shared workspace.
• ›With service providers who process data on our behalf (e.g. hosting, email delivery, payment processing, and LLM providers), under contractual confidentiality and security obligations.
• ›When you connect a third-party integration, to the extent needed to provide that integration.
• ›To comply with law, enforce our terms, or protect the rights, safety, and security of Pencil, our users, or the public.

We retain your information for as long as your account is active or as needed to provide the Service. You may delete workspace content at any time. When you delete your account, we delete or de-identify associated personal data within a reasonable period, except where retention is required for legal, security, or billing purposes.

We use industry-standard measures to protect your data, including encryption in transit, hashed passwords, scoped access tokens, and server-side authorization checks. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

• ›Access, update, or delete your account information from Settings.
• ›Disconnect a third-party integration at any time from Settings.
• ›Revoke Pencil's access to your Google account at https://myaccount.google.com/permissions.
• ›Request access to or deletion of your personal data by emailing privacy@pencil.ink.

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal information.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.