Privacy Policy

oneSlash (“we”, “us”, “our”) operates Scindo. This Privacy Policy explains how we collect, use, and protect your information when you use our Service, including the web app, the CLI, the VS Code extension, and the Scindo MCP server.

Information you provide

• Account information (name, email, profile picture), including profile details from Google or GitHub when you sign in with them
• Workspace data (workspace name, settings, member list, and the email addresses of people you invite)
• Messages and content you create within the Service
• Tasks, plan documents, and knowledge base documents, including whether each document is private or shared with the workspace
• Questions you ask Ask Scindo, and feedback you give on agent replies (reactions, thumbs-down reasons, bug reports)
• Context files and workspace/channel instructions
• Files, images, and code you upload, import, or connect via integrations
• Payment information (web purchases are processed by Stripe, and we store only the card brand, last four digits, and expiry; in-app purchases are processed by Apple, and we store the subscription's identifiers, plan, status and renewal dates, and which member bought it, never your card details)

Information we generate

• Search embeddings (numeric representations of your documents, messages, and memories used for search)
• Agent memories: short facts, decisions, and preferences the agent saves from conversations
• Conversation summaries used to give the agent context
• Member and team profiles inferred from workspace activity (see Section 4)
• Link previews (title, description, and image) for links posted in messages and documents

Information collected automatically

• Device and browser information
• IP address and approximate location
• Usage data (features used, pages visited, interactions)
• AI agent usage metrics (response count, model used, token usage, estimated cost)
• API key and MCP usage (last used time and the name the connected client reports, such as “Claude Code”)
• Log data (access times, errors, referring pages)

• To provide, maintain, and improve the Service
• To process AI agent interactions and generate responses, answers, plan documents, and code suggestions
• To search your workspaces' messages and documents when you or an agent asks a question
• To perform codebase analysis when you connect a repository
• To detect overlap between new discussions and existing features or decisions
• To sync task and issue status with connected project management tools
• To measure and improve answer quality (see Section 4)
• To send transactional communications (invites, notifications)
• To detect and prevent fraud, abuse, and security incidents
• To enforce usage limits and billing
• To comply with legal obligations

When you interact with AI agents in Scindo, your messages, relevant workspace context, and connected repository data are sent to third-party AI model providers to generate responses. This includes generating answers, plan documents, code suggestions, task summaries, and review feedback. We send only the context necessary for the interaction. We do not use your content to train our own AI models.

The Service uses smart model routing, which means different AI models and providers may be selected based on prompt complexity and availability to optimize cost and quality. If one provider is unavailable, a request may be retried with another provider listed below.

To make documents, messages, and memories searchable, their text is sent to OpenAI to create search embeddings, regardless of which model answers your questions.

Ask Scindo and agent search

Ask Scindo answers your questions across every workspace you belong to, unless you narrow the scope. It can read public channels, private channels you are a member of, task threads, workspace documents, your own private documents, files attached in chats, and feedback and bug reports filed in those workspaces. It never reads direct messages or other members' Ask Scindo conversations. Your Ask Scindo conversation is private to you, and workspace admins cannot read it. We log each question you ask (the question, the sources cited, and whether an answer was found) so that only you can review it and so we can improve answers.

When an agent replies in a shared channel or task, it searches only what everyone in that conversation can read.

Memory and background processing

Some AI processing runs automatically, not only when you send a message:

• Memory: after some agent conversations, the agent saves a few short facts, decisions, or preferences as memories. A memory saved in a private channel or in Ask Scindo is only recalled there.
• Summaries and digests: conversations are periodically summarized for agent context, and weekly digests and status reports are generated from workspace activity.
• Member and team profiles: a weekly job analyzes workspace activity (such as messages, reactions, and approvals) to build profiles of each member's working style and how members collaborate. These profiles are used to tailor agent replies. Workspace admins can see members' profiles, and each member can see only the collaboration patterns they are part of. You can turn this off at any time in Settings → Profile, which also deletes your existing profiles.
• Proactive agents: if a workspace enables an agent to participate in a channel, it reads new messages in that channel and may reply or suggest saving content.
• Answer quality checks: when your Ask Scindo questions go unanswered or are rephrased, we may automatically re-ask them and post a suggested answer in your private Ask Scindo conversation. If you save that answer, the question may be added to an automated test set that is periodically re-run against your workspaces, as you, to check answer quality. Those test results are stored and are not shown to other users.

Links you post

When a link is posted in a message or document, our servers may fetch that page to show a preview. An agent may also fetch a page that a person posted in the conversation, to read it. The site you linked will see a request from our servers. Embedded videos (YouTube, Vimeo, Loom) load from those providers only when you press play.

Bring your own agent

When you bring your own agent (BYOA) by providing an API key or MCP endpoint, your messages are routed to the provider you configured. We do not store your third-party API keys in plain text — they are encrypted at rest.

Please refer to each provider's privacy policy: Anthropic, OpenAI, Google Gemini.

You can connect outside AI tools (such as Claude, Claude Code, or Cursor) to Scindo through the Scindo MCP server, using an API key or by approving an OAuth connection. A connected tool acts as you: it can read the channels, tasks, and documents you can see in that workspace (never direct messages or other members' Ask Scindo conversations), ask Ask Scindo questions, and save new documents to the knowledge base. If you choose “Also search my other workspaces” when creating a key or approving a connection, it can also search every workspace you belong to.

Content returned to a connected tool is handled by that tool's provider under its own terms and privacy policy. API keys expire only if you set an expiration date, and connections you approve through OAuth stay active until you revoke them in Settings. Both stop working if you leave the workspace. We store only a hashed form of each key.

The CLI and VS Code extension sign in with your Scindo account and can access the workspaces you belong to. The CLI stores your sign-in session in a local configuration file on your computer; the VS Code extension stores it in VS Code's secure storage. The VS Code extension does not upload your source files or editor contents.

When you connect third-party services, we access only the data necessary to provide the integration features you enable. We do not sell or share your integration data with other third parties. You can disconnect integrations at any time through your workspace settings. Disconnecting removes the stored credentials; content already imported stays in your workspace until you delete it.

GitHub

When you connect a GitHub repository with an access token you provide, we may access source code, commits, pull requests, reviews, issues, CI status, and repository metadata. To work on code, we keep a temporary copy of the repository on our servers, which is removed after a period of inactivity. If you enable syncing, GitHub sends pull request, review, push, and CI events to Scindo, which may update tasks and create knowledge base pages. The Service may also commit context files to your repository and open pull requests. This data is encrypted in transit (TLS) and at rest, and is never shared with other workspaces or users outside your team. When repository data is sent to AI providers for agent interactions, it is subject to the same policies described in Section 4. For GitHub's own data handling practices, see GitHub's Privacy Statement.

Project management tools (Linear, Jira)

When you connect Linear, we access issues and project data to enable bidirectional sync: the Service may create issues from tasks and update their status. When you connect Jira, we read issues and projects so you can import them as tasks and so the agent can read tickets you link. Imported content is stored within your workspace and subject to the same data handling practices as content you create directly.

Document imports (Notion, Google Docs, files)

When you connect Notion, we read the pages you choose so you can import them into your knowledge base and re-sync them later. We do not write to Notion. When you connect Google Docs, we can read only the documents you pick with the Google file picker, and we import them into your knowledge base. You can also upload Markdown, text, and PDF files. Imported documents are stored in your workspace, and their text is processed as described in Section 4.

Scindo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Figma

When you connect Figma, we access file structure, text content, component names, and design tokens (colors, typography, effects) in read-only mode. PNG exports of design snapshots, including previews of Figma links posted in messages, may be stored in your workspace. We do not modify your Figma files.

Webhooks

Inbound webhook payloads posted to channels are stored as messages or documents and retained like other workspace content. Outbound webhooks send event data (such as agent responses, tool usage, and CI status) to endpoints you configure, and we keep a log of each delivery. Ask Scindo and Help conversations are never sent to outbound webhooks.

The Service generates structured context files from team discussions. When committed to your connected repository, these files become part of your codebase and are no longer stored exclusively by Scindo. Repository-stored context files are governed by your repository's access controls and hosting provider's policies.

We do not sell your personal information. We share data only:

• With your workspace members, as part of normal Service use (private channels and private documents are shared only with the people who have access)
• With service providers who help us operate the Service, listed below
• With AI model providers to process agent interactions
• With outside AI tools you connect through the Scindo MCP server or an API key
• With connected third-party services you have authorized (e.g., committing files to your repository, updating Linear issues)
• With webhook endpoints you have configured
• When required by law, legal process, or government request
• To protect the rights, safety, or property of oneSlash, our users, or the public

Our service providers are:

• Supabase — database, authentication, and file storage
• Vercel — web hosting, scheduled jobs, and cookieless page analytics
• Fly.io — temporary copies of connected code repositories
• Anthropic, OpenAI, and Google — AI models and search embeddings
• Stripe — payment processing for web purchases
• Apple — payment processing for in-app purchases in the iPhone and Mac apps
• Resend — invitation emails
• Upstash — rate limiting (processes IP addresses and account identifiers)

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. API keys and credentials for third-party integrations are encrypted at rest, and Scindo API keys are stored only in hashed form. Files are served only to people who have access to the conversation or document they belong to. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain your data for as long as your account is active or as needed to provide the Service. Workspaces can choose a conversation retention setting, but automatic deletion is not active yet: until it is, conversations and documents are kept until someone deletes them.

• Deleted messages and documents are removed from the Service, search, and AI features right away. Files attached to deleted messages are deleted from storage. The underlying records are kept for 30 days so they can be restored, then permanently deleted, along with any files attached to deleted documents. To have them removed sooner, contact us.
• Removing a member from a workspace immediately ends their access to its channels and revokes the API keys they created for it. Their past messages stay in the workspace.
• Deleting a workspace permanently deletes its channels, messages, tasks, and members.

When you delete your account, it is deleted immediately and cannot be undone. Workspaces where you are the only member are deleted, along with their subscriptions. Your private documents are removed from the Service and your Ask Scindo conversations are deleted. Content you shared in workspaces with other members (such as messages, tasks, and shared documents) stays in those workspaces and is shown as written by “Deleted user”. Context files already committed to your repository are not affected by account deletion.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

You can download any knowledge base document as Markdown, or export documents through the API. To exercise these rights, or to request an export of other data, contact us at jkim@oneslash.io.

We use essential cookies to maintain your session and authentication. Our page analytics (Vercel Analytics) do not use cookies. We also save some display preferences, such as which panels are open, in your browser's local storage. You can control cookies and local storage through your browser settings.

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via the Service or email. Continued use after changes constitutes acceptance of the updated policy.

Questions about this Privacy Policy? Contact us at jkim@oneslash.io.