Not yet reviewed by a lawyer. This is a complete draft written for that review; the blanks (governing law and so on) are filled in after incorporation.

Privacy Policy

Last updated: 2026-10-11

What we collect

• Account: email, name (if you enter one), sign-in times.
• Project data: projects, phases, tasks, decisions, activity summaries and who made them.
• Connections: the repo's local path and remote URL, commit hashes and message summaries.
• Session status: which tool ran when, what it is doing right now (running, waiting), and the first line of your question (120 characters).
• From the Mac app: the Mac's name, the path of the conversation file (it contains your macOS user name), the folders open in your editors (for "window open" and the switch buttons), and, with "Watch Cursor" on, Cursor chat titles.
• Usage: purpose, model and token counts of AI calls, so we can show you the cost.

What we do not collect

• AI transcripts. Only summaries reach the server. The transcript stays on your machine. Excerpts are stored only if you turn on "store session transcripts" for a project, and they are deleted after 90 days.
• Source code. Code analysis uses the file list and config excerpts only.
• Advertising identifiers, tracking pixels, third-party analytics.

What the Mac app does on your Mac

The Mac app works without a server. While you use it without one, it sends us nothing, and everything it keeps stays in ~/.philote on that Mac. What it reads (Claude Code and Codex conversation files, the open-window list of VS Code and Cursor, running programs), what it writes (session status, work history — first lines of questions and replies and changed file names) and how long it keeps it (work history 90 days by default, adjustable) are in the app privacy notice.

AI handoff. While it is on (it is on at first), a new Claude Code session receives, as its first message, what other AI sessions recently did in the same folder — first lines of questions and replies, changed file names. That message becomes part of the Claude Code conversation and goes to Anthropic. It does not pass through our servers; turn it off in the app under Settings → Behavior.

AI keys

Keys you enter are encrypted with the app key on the server; the screen shows only the last four characters. Summaries run on your own machine with your own key. Q&A and embeddings run on the server with the project owner's key, and what we send is the stored summaries and your question.

Who can see it

Only members of the same workspace and project. The database enforces this row by row. With "share current task text" off, what the AI is working on is visible to owners only.

Where it lives

In Supabase (Postgres). In self-owned mode everything stays in your own Supabase project and we have no access to it.

How long we keep it

• Account and project records: until you delete your account. Then they go immediately.
• Session transcript excerpts (only for projects that enabled them): deleted after 90 days.
• Read notifications: 30 days. Ingest errors: 30 days.
• Payment records: kept by the reseller for as long as tax law requires.

Deletion

Deleting a project deletes its activities, tasks, decisions and session records. Delete the whole account yourself in Settings > Account. You can export everything first.

Your rights

Wherever you live, you can ask for any of the following. Write to contact@zeroplusone.co from the address you sign in with and we will act within 30 days and tell you what we did. Asking never changes the service you get.

• Access — what we hold. Most of it you can pull yourself with export.
• Correction — fix what is wrong. Name and email you can change in settings.
• Deletion — your account and everything in it, from Settings > Account.
• Portability — in a machine-readable format (JSON). That is what export is.
• Objection — ask us to stop processing. We will tell you which parts of the service stop with it.

We do not sell your personal information, and we do not share it for advertising — neither “sale” nor “sharing” as California's CCPA/CPRA defines them. There is no opt-out link because there is nothing to opt out of.

In the EU you may complain to your supervisory authority; in Korea, to the Personal Information Protection Commission. Telling us first usually gets it fixed faster.

Why we are allowed to process it

• Contract — account, project records, payment. Without these there is no service.
• Legitimate interest — security records (request time and id) and error logs, used only to stop abuse and find faults.
• Consent — the weekly report email. Every one of them has an unsubscribe link.

Cookies

All of them are functional. No tracking cookies, no advertising cookies, no analytics.

• sb-…-auth-token — keeps you signed in. Delete it and you are signed out.
• wp_locale — the language you picked. One year.
• wp_workspace — the workspace you are looking at. One year.
• wp_supabase — when you connect a server you run yourself (Supabase), its address and public key. One year.

How we protect it

• Everything in transit is TLS.
• AI keys are encrypted with AES-256-GCM before they are stored, and the key that unlocks them does not live in the database.
• The wall between projects is enforced by the database (row-level security), not by screen code. A mistake in the UI still cannot return someone else's row.
• Backups are encrypted, and we test that they actually restore.
• If something does leak, we tell affected people within 72 hours.

What the AI produces

Summaries and phase estimates are generated. They are not judgements about people, and nothing is decided on their basis. They are there to read, and you can correct them on screen when they are wrong.

Children

Philote is not for anyone under 16 (14 in Korea). If we learn that a child's information reached us, we delete it.

Where the data goes

The server and database are in us-west1 (미국 오리건). Using the service means your data is transferred to the companies below. If you would rather it did not leave your own country, use self-owned mode with your own Supabase project.

Payments

Paddle is the merchant of record. Card numbers never pass through our servers. What we receive is which plan you are on, until when, and a billing email address.

Contact

ZERO PLUS ONE Inc. · contact@zeroplusone.co

Terms of Service · Refund Policy · App privacy notice · Support