Privacy Policy

What stays in your repository, what reaches Pathmode, and what changes when you connect a workspace.

Last updated: September 4, 2026

1. Introduction

Pathmode Oy (Business ID: FI35979677) ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at pathmode.io (the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

The keyless boundary

When the Pathmode MCP server runs without an API key, it reads and writes intent.md on your machine and makes no requests to Pathmode. We receive no file contents, repository paths, usage signals, or telemetry from that mode. Your coding agent may still process the file under its own provider's settings; that is a separate data flow controlled by the agent you choose.

2. Information We Collect

2.1 Information We Do Not Receive in Keyless Local Mode

The keyless MCP server operates on your filesystem. Pathmode does not receive the contents of intent.md, your local repository path, your Git remote, tool arguments, or a record of which local tools you run. Files remain under your own filesystem and version-control policies.

2.2 Information You Provide

Account Information: Name, email address, and password when you create an account
Connected Workspace Data: Intent specifications, evidence items, decisions, implementation findings, product research, and other content you create, upload, or sync after connecting a workspace
Profile Information: Your name and profile information you choose to provide
Communication: Information you provide when contacting us for support or feedback

2.3 Automatically Collected Information

Usage Data: How you interact with our Service, including pages visited and features used
Device Information: Browser type, operating system, IP address, and device identifiers
Performance Metrics: Page load times, Core Web Vitals (LCP, FID, CLS), and other performance data to improve service quality
Cookies and Browser Storage: Essential session cookies and pseudonymous analytics identifiers stored by PostHog in cookies or local storage (see Section 7). We do not set advertising cookies.
Email Engagement: Product update and newsletter emails contain a small image that tells us the message was opened, and links in them carry campaign parameters so we can see which email brought you to the site. We use this to judge whether an update was worth sending. It is never used for advertising or shared with anyone. Transactional email such as sign-in and account notices is not tracked this way, and you can stop all product email at any time using the unsubscribe link in any of it.

2.4 Third-Party Authentication

If you choose to sign in with Google, we receive your email address and name from Google's authentication service. We do not access or store your Google password.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Process your transactions and manage your account
Enable collaboration features within workspaces
Send you technical notices, updates, and support messages
Respond to your comments, questions, and requests
Monitor and analyze usage patterns to improve user experience
Detect, prevent, and address technical issues and security threats
Comply with legal obligations and enforce our terms

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Service Providers

We share information with trusted service providers who help us operate our Service:

Supabase: Database and authentication services (data stored in AWS regions)
Vercel: Hosting, edge network services, analytics, and performance monitoring (Vercel Analytics and Speed Insights)
Google AI Services: Hosted AI processing through Vertex AI, with a server-side Gemini API fallback. Inputs required for the feature you invoke are sent to Google; retention depends on the service, feature, and configuration in use. Google states that Vertex AI customer data is not used to train or fine-tune models without permission.
PostHog: Product analytics and error tracking on an EU-hosted instance. Browser analytics may use cookies and local storage as described in Section 7; connected MCP usage signals are sent server-side.
Resend: Email delivery services (transactional email, plus product update and newsletter email you can unsubscribe from at any time). Resend records whether a product update was opened, as described in Section 2.3.
Upstash: Redis database and rate limiting services (data stored in AWS regions)
Lemon Squeezy: Subscription billing and payment processing as merchant of record, processed in the United States. Lemon Squeezy is an independent controller for payment transaction data under its own terms. Pathmode does not receive or store your payment card details.

All service providers are bound by data processing agreements and are required to protect your information.

These providers apply only to the Pathmode features that use them. The deterministic keyless preflight does not send repository data to Pathmode, Google, PostHog, or another Pathmode service provider.

4.3 MCP Server & AI Agent Integrations

The Pathmode MCP (Model Context Protocol) server runs on your machine and exposes tools to AI coding agents such as Claude Code, Codex, Cursor, and Windsurf. Its data flow depends on the mode you choose:

Keyless local mode: The server reads and writes repo-local intent files and runs the deterministic readiness preflight without calling the Pathmode API. Pathmode receives no content or usage signal from this mode.
Connected mode: The server sends authenticated requests directly to the Pathmode API. Workspace data requested or changed by a connected tool travels between that API and the local MCP server, then between the MCP server and your agent over local STDIO.
Authentication: A connected API key is stored on your machine and used by the local MCP server only as the bearer credential for requests to Pathmode; it is not included in tool responses. Evidence-ingest keys are deliberately designed to be placed in another tool you choose, such as a webhook sender. They can only post evidence and can be revoked individually.
Usage signals in connected mode: At launch, Pathmode receives the MCP client name and version plus the Pathmode server version. For each tool that executes, we record its allowlisted name, whether it returned successfully, and — when the client exposes one unambiguous network Git remote — an opaque hash-derived repository identifier. The raw remote URL, repository name, local path, tool arguments, spec contents, and file contents are not analytics fields. The repository identifier is scoped to the workspace before it is stored in analytics.
Connected writes: A connected tool may sync intent.md or create and update workspace records. Those requests are subject to the same authentication, workspace authorization, and access controls as the public API and web application.
Your agent provider: The MCP connection to the agent is local, but the agent may send context to its own model provider. That processing is governed by the provider and configuration you choose, not by Pathmode's local-mode promise.

4.4 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect our rights, property, or safety.

5. Data Security

We implement industry-standard security measures to protect your information:

Encryption: AES-256 encryption at rest and TLS 1.3 encryption in transit
Authentication: Secure password requirements and OAuth integration
Access Controls: Row-level security (RLS) policies and role-based access control
API Security: API keys are never exposed client-side
Regular Audits: We conduct regular security reviews and updates

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Right to Access

You can request a copy of all personal data we hold about you. Contact us at privacy@pathmode.io to request your data export.

Right to Rectification

You can update your account information at any time through your account settings.

Right to Erasure (Right to be Forgotten)

You can request deletion of your account and all associated data. Data will be permanently removed within 30 days of your request. Contact us at privacy@pathmode.io.

Right to Data Portability

You can export your workspace data in machine-readable format. Contact us for assistance with data export.

Right to Object

You can object to certain processing of your personal data. Contact us to discuss your concerns.

Right to Withdraw Consent

Where we rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.

7. Cookies

7.1 Essential Cookies We Set

We use only strictly necessary cookies required to operate the Service:

Authentication & session: Supabase sets HTTP-only cookies to keep you signed in across requests. Without these, you cannot use the Service.

7.2 Analytics Storage

PostHog may store pseudonymous browser and session identifiers in cookies and local storage so product events can be associated across page loads and visits. When you are signed in, analytics events may be associated with your Pathmode account identifier. We use this for product analytics, error tracking, and performance measurement, not advertising.

Some of our sites sit on separate domains (for example intentspec.org and preflight.pathmode.io), and a browser keeps their storage apart, so by default we cannot tell that a visit to one followed a click on the other. Where we need that count, the link carries a single-use correlation token in its address. It is generated fresh on each click, and it is deliberately not your account identifier and not the pseudonymous analytics identifier described above. It is, however, recorded as a property on both analytics events — the click and the arrival — and each of those events is associated with that site's pseudonymous visitor profile. So the token does link those two visits to each other: that is the whole reason it exists, and it is the minimum needed to count how many people who start a step finish it. The receiving page removes it from the address bar as soon as it has been recorded, so it is not carried into your browser history, bookmarks, or any link you share.

7.3 What We Don't Do

We do not set advertising cookies or third-party marketing pixels.
We do not sell or share cookie data with advertising networks.
Vercel Analytics and Speed Insights measure performance without setting cookies — only aggregated, anonymized signals.

You can block or clear cookies and local storage through your browser settings. Blocking essential authentication cookies will prevent you from signing in; clearing analytics storage resets the browser identifier but does not disable future analytics collection.

8. Data Retention

We retain your personal information for as long as necessary to:

Provide our Service to you
Comply with legal obligations
Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes.

Repo-local files created in keyless mode are not stored by Pathmode and are therefore outside our retention and deletion process; you control them through your filesystem and version control. If you connect and sync an intent, the connected workspace copy is retained under this policy.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our primary data storage is in AWS EU regions (via Supabase). Product analytics are processed on PostHog's EU instance. Some processing may occur in other regions through our sub-processors (e.g., Google Cloud Platform for AI inference).

We ensure appropriate safeguards are in place for international data transfers, including standard contractual clauses and compliance with applicable data protection laws.

10. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately at privacy@pathmode.io.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

Posting the new Privacy Policy on this page
Updating the "Last updated" date at the top of this policy
Sending you an email notification for material changes

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

12. Third-Party Integrations

Pathmode integrates with third-party productivity tools so that intents and evidence in your workspace can be linked to issues, tickets, and conversations in the tools your team already uses. The sections below describe what data flows between Pathmode and each integration.

Atlassian (Jira Cloud — Marketplace & Basic-auth)

Pathmode offers two ways to integrate with Jira: an API token (Basic-auth) integration configured in your workspace settings, and a Forge app ("Pathmode for Jira") installed from the Atlassian Marketplace. The data flows are:

Data we receive from Atlassian: Atlassian cloud id and site URL of the installed instance, Jira issue keys and IDs for issues that link to a Pathmode intent, the Atlassian account ID of the user viewing the panel, and issue status changes delivered by Jira webhook. We do not import issue descriptions, comments, attachments, or other issue content.
Data we send to Atlassian: When you click "Push to Jira" on an intent, we create a Jira issue containing the intent's summary, description, and a reference to the Pathmode intent ID. No personal data of other Pathmode users is sent.
Authentication: Marketplace requests are authenticated with an Atlassian-signed Forge Invocation Token (asymmetric JWT) verified against Atlassian's public JWKS. Basic-auth requests use an API token issued by the Atlassian account holder.
Storage: Mapping rows (cloud id ↔ workspace, Jira issue key ↔ intent id) are stored in our Supabase database (encrypted at rest, AES-256). API tokens are stored encrypted in the same database. We do not cache or persist issue content beyond what is necessary to render the linked intent.
Retention: Mapping rows persist while the integration is connected. Uninstalling the Forge app from your Atlassian site triggers a lifecycle event that marks the install row as uninstalled; you can request full deletion by emailing privacy@pathmode.io.
Scope: The Forge app requests only the read:jira-work scope. The Basic-auth integration uses your API token's permissions.

Other Integrations

Linear, GitHub, Slack, Notion, and Google Analytics integrations are optional and follow the same principles: we store only the mapping information and credentials required to make linked calls, never the underlying content of issues, PRs, messages, or analytics events beyond what each workspace member explicitly imports as evidence.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Additional Resources

For more information about our security practices, visit our Trust Center.

For information about the terms and conditions of using our Service, please review our Terms of Service.

This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable privacy laws.