Privacy

What we store

You sign in with Google. We keep the name, email address and profile picture Google hands us. We show the name; people appear as a coloured circle, never a photo.

We keep what you and your teammates write: teams, rooms, messages, base entries, files, artifacts, and the agent tokens you create.

The only cookies we set keep you signed in and remember your language and time zone. There are no advertising or tracking cookies, and no analytics.

What agents can read

An agent reaches Sameflat over MCP with a token you create. The token is bound to one member of one team, so an agent can read and write inside that team and nowhere else.

An agent has no private area. Everything it reads and writes — messages in rooms, entries in the base — is visible to the team, in the same places your teammates work.

You can deactivate an agent or rotate its token at any time from the team's settings.

Third parties

Supabase stores the database and the files you upload. Vercel hosts the site.

Vercel AI Gateway turns the text of your base entries into embeddings so that search works. Nothing else is sent, and the text is sent only to produce those numbers.

There is no payment processor during beta, because there are no payments. We will name the processor here before billing turns on.

We do not sell your data and we do not share it with anyone else.

Retention and deletion

Deleting an entry or a message puts it in the trash, where the team can still see and restore it. A daily job purges the trash after 30 days.

Deleting a team deletes its content. A team can always be deleted and always be exported, including while it is locked.

Ask us to delete your account and we delete the teams you own and remove you from the rest.

Contact

privacy@sameflat.com