Last updated October 27, 2026

Privacy Policy

This policy explains what Alex Miller, doing business as AIMHUGE ("Weft", "we", "us"), collects when you use weft.zip, the Weft app and the services described in our Terms of Service, why, and what you can do about it. We are the controller of this data. Questions go to legal@weft.zip.

1. The short version

• The Weft app runs on your Mac. Your board, prompts, code and replies stay there unless you turn on a feature that sends them.
• Analytics on weft.zip (Google Analytics and PostHog, with session replay) start only after you accept them.
• The app sends anonymous onboarding stats by default; you can switch them off in Settings → Security.
• We don't sell your data, and we don't use your content to train AI models.
• If you connect a Google account, its data goes from Google to your Mac and nowhere we can see. See Google user data.

2. What we collect, and why

Your account. When you sign in with GitHub we get your email address, name, GitHub username and avatar, and we record when you last signed in. We use them to run your account and workspaces, to show your profile if you make one public, and to contact you about the services.

What you choose to sync or share. Cloud sync is off until you turn it on for a project. Then the cards, threads, tool output, images, attachments and pages of that project are uploaded so your other devices, the web board, your workspace and share links can show them. They travel encrypted and our database host encrypts them at rest, but they aren't end-to-end encrypted: we could technically read them, and only do so to run, secure or fix the services, or when the law requires it. Secrets in the 🔐 vault are the exception: they're end-to-end encrypted and we only ever hold ciphertext.

Site notes you save are scrubbed of query strings, tokens, emails and similar before they leave your Mac, and go to your workspace, or to everyone only if you choose public and press Send.

Feedback. When you send feedback from the app we store the conversation, its summary, your name, email and app version, and post the summary with your name and email to our team's Slack.

Security log. While you're signed in, the app records when the 🔐 vault is unlocked or a secret is used (which secret, when, from which card), never the secret itself, in an audit log in your account, so you can see what touched your keys.

Billing. If you buy Pro, Stripe collects your payment details; we receive your plan, billing status and what Stripe shares with us about the payment, never your full card number.

Email and webhooks. Mail sent to a weft.zip address is received and held by our email provider and forwarded on. Webhook deliveries to the relay pass through our servers to your Mac.

AI features we run. When weft.zip runs an AI model for you (the feedback interview, a title, a summary), the text sent to the model and its reply are logged with token counts and timing in our product analytics, so we can find bugs and keep costs in check. AI agents you run on your Mac talk to their own providers under those providers' terms, not through us.

Analytics on weft.zip, only after you accept: pages viewed, clicks, device and browser, approximate location from your IP address, errors, and recordings of how you used the page (session replay). If you're signed in, PostHog links this to your account id, name and email. We use it to understand what works and to fix what doesn't. More in Cookies.

Desktop onboarding stats. The app reports which welcome steps you went through, as anonymous events tied to a hashed device id: never a prompt, project name, path, email or card. They're on by default; switch them off in the app under Settings → Security.

Server logs. Our hosts keep request logs (IP address, time, page, browser) for security and debugging.

Google user data

You can connect a Google account in the app (Settings → Connectors) so your AI agents can work with your Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts and Tasks. Weft asks Google only for the access those tasks need, and you see each permission on Google's consent screen before you grant it.

• Where it lives. Google's sign-in token is kept in your Mac's Keychain. Your mail, events, files, contacts and tasks are fetched by the app on your Mac straight from Google; they don't pass through or get stored on weft.zip, and we never see them.
• How it's used. Only to do what you ask: an agent reads, drafts, sends, files or edits when you tell it to. When an agent works with Google data, the part it needs goes to the AI provider that agent runs on (for example Anthropic), under that provider's terms, to produce the answer you asked for.
• What we never do. We don't sell Google user data, use it for advertising, let people read it (except with your permission, for security, or when the law requires it), or use it to develop, improve or train AI or machine-learning models.
• Removing access. Remove the account in Settings → Connectors, which deletes its token from your Keychain, or revoke Weft at myaccount.google.com/permissions.

Weft's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Legal bases

Where the GDPR or UK GDPR applies, we rely on: contract for your account, sync, sharing, email, the relay and billing; consent for analytics cookies and session replay on weft.zip; and legitimate interests for security logs, feedback you send, AI usage logs, and the anonymous onboarding stats, which you can switch off. We keep billing records because the law requires it.

4. Who processes it for us

• Vercel: hosts weft.zip and runs its servers (Singapore region).
• Supabase: our database, sign-in and file storage (Singapore region).
• GitHub: sign-in.
• Google Analytics and PostHog: website and product analytics, session replay, error reports.
• Stripe: payments and invoices.
• Slack: where our team reads feedback.
• Resend: email to and from weft.zip addresses.
• Anthropic and Puku: the AI models weft.zip calls for its own features.

Some of them are in the United States or elsewhere outside your country. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses. We share data with others only when the law requires it, to protect people or the services, or as part of a sale or transfer of Weft, under this policy.

5. Cookies and analytics

weft.zip uses a sign-in cookie and stores your theme and this choice in your browser; these are needed for the site to work. Google Analytics and PostHog set their own cookies and record sessions, and they only load after you press Accept in the banner. Declining, or ignoring the banner, keeps them off. You can change your mind here at any time:

Analytics cookies in this browser: off (you haven't chosen yet). Turn them on

A Weft running on your own Mac never loads either of them.

6. How long we keep it

• Account, synced content, site notes and the security log: until you delete them or your account.
• Feedback: as long as it's useful for improving Weft, at most 3 years.
• Analytics, session replays and AI usage logs: as long as our analytics provider keeps them, at most 2 years.
• Billing records: as long as tax law requires, usually 5 to 10 years.
• Server logs: a few weeks.

7. Your rights and deleting your data

Depending on where you live, you can ask to see, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent at any time (which doesn't affect what happened before). You can turn sync off per project and delete synced cards yourself. To delete your account and everything in it, or for any other request, email legal@weft.zip from the address on your account; we'll reply within 30 days. You can also complain to your data protection authority.

California residents: we don't sell or share personal information for cross-context behavioral advertising, and you won't be treated differently for using these rights.

8. Security

We encrypt data in transit, keep vault secrets end-to-end encrypted, and limit who can reach our systems. No service is perfectly secure; if a breach affects you, we'll tell you as the law requires. Report security issues to legal@weft.zip.

9. Children

Weft is not for anyone under 16, and we don't knowingly collect their data. If you think a child has given us data, write to us and we'll delete it.

10. Changes

We'll update this page when what we collect changes, and change the date at the top. For a material change we'll give at least 14 days' notice by email or in the app.

11. Law

This policy is governed by the laws of Thailand, including the Personal Data Protection Act, and the courts of Chiang Mai have jurisdiction, as in our Terms, except where the law of the country you live in gives you more protection or the right to bring a claim at home.

Contact

legal@weft.zip