Privacy Policy

Effective 12 August 2026 · Last updated 12 August 2026 · Version 1.1

This Privacy Policy explains how Pathrule ("Pathrule", "we", "us", "our") collects, uses, discloses, and safeguards information when you use the Pathrule desktop application (Pathrule Studio), the Pathrule CLI, the Pathrule VS Code extension, the Pathrule iOS app, the Pathrule cloud service, the local and hosted MCP servers, the public design-artifact viewer, or the website at pathrule.io (together, the "Service").

If you do not agree with this Policy, please do not use the Service.

About Pathrule. Pathrule is a shared memory, rule, and skill layer for AI coding agents (such as Claude Code, Cursor, Codex, and other MCP-compatible clients). It runs partly on your computer (a native desktop app, a command-line runtime, an editor extension, and a local hook supervisor that observes your AI agent's tool calls), partly on your phone (an iOS companion app), and partly in our cloud (a Supabase-hosted database, Edge Functions, and an AI router). The cloud component is the source of truth for the memories, rules, and skills you author.

End-to-end encrypted conversation content. Conversation content that Pathrule Studio syncs so you can continue a session from another device (message bodies, titles, diffs, todos, turn summaries) is end-to-end encrypted on your devices before it reaches our cloud. We store ciphertext and cannot read it. See Section 10.1.

0. At a glance

• Operator: Pathrule
• Registered address: 30 Ağustos Zafer Mah. 73. Sok. No:3, Bursa/Nilüfer, Türkiye
• Privacy contact: [email protected]
• Website: pathrule.io
• Jurisdictions: European Union (GDPR), Türkiye (KVKK), United States including California (CCPA / CPRA)
• AI sub-processor: Anthropic (Claude models)
• Speech sub-processor: ElevenLabs (cloud dictation only, when you use it)
• Sale of data: We do not sell or share personal data for cross-context behavioural advertising
• Minimum age: 16

1. Information we collect

We collect only what is necessary to operate the Service and to comply with the law.

1.1 Information you provide directly

• Account information. Your email address and the basic profile attributes returned by the OAuth identity provider you choose (for example Google) via Supabase Auth.
• Profile and workspace settings. Workspace names, display preferences, locale.
• User-authored content. Memories, rules, skills, tasks, designs, and activity-log task summaries that you, or your AI agent acting on your behalf, write into Pathrule. This is the core knowledge graph the Service exists to manage.
• Voice recordings for dictation. If you use dictation, the audio clip you record is transcribed. On macOS this can happen entirely on your device; when the cloud engine is used, the clip is sent to our speech sub-processor for transcription and is not retained after the transcript is returned. See Section 3.1.
• Design material you import or share. Frames, layers, styles, and assets you transfer from a connected design tool (for example Figma) into your workspace, and the design payload you explicitly publish to a public artifact link.
• Support communications. When you email us or report an issue, we keep the message and any attachments.

1.2 Information collected automatically

• Workspace metadata. Node paths in your workspace tree, the workspace-relative file paths your AI agent reports as "touched" in an activity log, and timestamps. We do not receive the contents of those files unless you (or your agent) explicitly paste them into a memory, rule, or skill.
• AI agent telemetry. Prompts, responses, tool calls, and tool-call results that are routed through the Pathrule MCP server or the Pathrule AI router (including routing classifications, intent labels, latency, and token counts).
• Internal product analytics. Usage events stored in our own Supabase tables (feature usage, error events, route timings) used to operate, debug, and improve the Service.
• Usage meters. Counters we need to enforce plan limits and bill correctly: seconds of dictated audio per organisation per week, signal-ingestion counts, AI token counts and cost per feature.
• Runtime signals (Signals). If you enable Pathrule Signals for a workspace, runtime errors and events your instrumented application reports are stored and linked to the related code and tasks. Signals is opt-in and is not a web-analytics product: it does not track end users, sessions, or funnels. You decide which points in your own code emit a signal, and you are responsible for not putting personal data into a signal payload.
• Device and connection data. Operating system, app version, device model, IP address, coarse geolocation derived from IP, language, time zone, crash reports, and diagnostic logs.
• Push notification tokens. If you use the iOS app and allow notifications, we store the device push token needed to deliver them.
• Cookies and similar technologies. The website uses cookies described in Section 9. The desktop app does not set HTTP cookies; it stores settings locally in the app's OS-level data directory.

1.3 Information from third parties

• Identity providers. The OAuth provider you sign in with returns your email and basic profile.
• Connected design tools. If you connect a design tool such as Figma, we receive the file, node, and asset data you select for transfer, plus the account metadata that tool returns with the credential you supply.
• Stripe. When you purchase a subscription, Stripe shares with us a customer ID, subscription status, the last 4 digits and brand of the card, billing country, and invoice metadata. We never receive or store full card numbers, CVC, or full bank details; those are handled exclusively by Stripe.

1.4 Sensitive content you may write into Pathrule

Pathrule is not designed to receive special-category data (health, biometric, political, religious, racial or ethnic origin, trade-union membership, sexual orientation, criminal records) or developer secrets such as API keys, access tokens, or customer data. If you choose to paste such content into a memory, rule, or skill, you do so at your own risk and you remain solely responsible for ensuring you have a lawful basis to process it. Cloud rows are protected with Supabase Row Level Security so that only members of the owning workspace can read them, but Pathrule disclaims liability for content the user voluntarily inserts. We strongly recommend not storing secrets or special-category data in Pathrule.

2. How we collect information

• Directly from you. When you sign up, configure a workspace, write memories, rules, or skills, install third-party skills, or contact support.
• Automatically from the desktop app and MCP server. When the local hook supervisor records your AI agent's tool calls and forwards activity logs to the cloud, and when the MCP server proxies AI requests through the Pathrule AI router.
• Automatically from the website, through cookies and analytics described in Section 9.
• From third parties: identity providers (OAuth sign-in), Stripe (billing), and Anthropic (the AI provider that the AI router currently forwards prompts to).

3. How we use information

We use information for the following specific purposes:

1. Provide the Service. Authenticate you, store and retrieve your memories, rules, and skills, route AI requests, deliver path-scoped context to your AI agent, and sync activity logs.
2. Operate the AI router and MCP server. Classify intent, route to the right model, attach the right context, and log the call for debugging and quota enforcement.
3. Billing. Manage subscriptions, process payments via Stripe, issue invoices, and comply with applicable tax law.
4. Improve the product. Analyse aggregated usage patterns (which features people use, which routing decisions correlate with successful AI outcomes, where users hit errors) so we can prioritise fixes and new features.
5. Cost and quality monitoring. Track per-user, per-model, per-feature LLM cost and latency to detect regressions and prevent abuse.
6. Support and communication. Reply to your support emails and send transactional emails such as account confirmation, billing receipts, and security alerts.
7. Security and abuse prevention. Detect fraudulent sign-ups, rate-limit abusive callers, and investigate suspected misuse of the Service.
8. Legal compliance. Respond to lawful requests and retain records that tax or commercial law requires us to keep.
9. Marketing communications. If you opt in, we send product update emails and a product newsletter via Resend. You can unsubscribe at any time using the link in every marketing email.
10. Dictation. Turn a voice clip you record into text, and meter the seconds used against your organisation's weekly allowance.
11. Design transfer and sharing. Import the design material you select from a connected tool, render it in your workspace, and serve a design you explicitly publish to a public artifact link.
12. Mobile continuity and notifications. Deliver your encrypted conversation content to your own approved devices and send the push notifications you enabled.

We will not use your data for materially different purposes without first updating this Policy and, where required, obtaining your consent.

3.1 Voice dictation

Dictation is off until you start it, and it runs on one of two engines:

• Cloud (default). The clip is uploaded over TLS to our Edge Function, forwarded to our speech sub-processor (ElevenLabs, United States), and the transcript is returned to your app. We derive the billable duration from the audio server-side, count it against your organisation's weekly allowance, and do not store the audio afterwards. Failed provider calls are counted for diagnostics but not billed. A short list of domain terms (product, package, and repository names from your workspace) is sent with the request to bias recognition.
• On-device (macOS). The clip is transcribed locally by the operating system's speech engine and the audio never leaves your machine. This engine is used when the cloud path is unavailable, when your organisation's weekly allowance is exhausted, or when cloud dictation is disabled for the installation.

The transcript becomes ordinary input in your app, exactly as if you had typed it. Cloud dictation can be turned off for a whole installation with the PATHRULE_CLOUD_SPEECH_DISABLED environment variable, which self-hosted deployments and organisations with a no-third-party-audio policy can set; there is no per-user provider switch. If you do not want audio processed at all, do not use dictation.

4. Legal basis for processing (GDPR / KVKK)

We rely on the following legal bases:

You can withdraw consent at any time without affecting processing carried out before the withdrawal.

5. Data sharing and sub-processors

We share information only with the categories of recipients listed below, and only as needed for the purposes in Section 3.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising as defined by CCPA / CPRA. We do not engage in targeted advertising of any kind.

6. International data transfers

Because Pathrule's primary cloud backend (Supabase) and several sub-processors (Stripe, Cloudflare, Vercel, Resend, Anthropic, ElevenLabs, Voyage AI, Apple) are located outside Türkiye and the EU/EEA, your personal data is transferred internationally, primarily to the United States.

For these transfers we rely on the following safeguards:

• EU/EEA users: Standard Contractual Clauses (Module 2 / Module 3 as applicable) with each sub-processor, supplemented by encryption in transit and at rest, strict access controls, and contractual confidentiality obligations.
• UK users: the UK International Data Transfer Addendum to the EU SCCs.
• KVKK transfers (Türkiye): açık rıza (KVKK m. 9) ve sektörel olarak uygun olduğu hallerde KVK Kurulu tarafından onaylanmış taahhütname mekanizmaları.

7. Data retention

We keep personal data only as long as needed for the purpose it was collected for, after which it is deleted or irreversibly anonymised. The retention model below is enforced by a daily retention job.

7.1 Activity logs

• Full-detail activity logs are retained for 30 days.
• Between 30 and 180 days the entries are summarised and decayed into a compact form for long-term context.
• After 180 days the entries are purged. If an entry has already been promoted into the work-episode layer it is purged earlier as soon as the promotion completes.

7.2 Work episodes

• Low-confidence episodes are kept for 30 days.
• Medium- and high-confidence episodes are kept for 180 days; whenever an episode is reused its expiry is rolled forward by another 180 days. There is no hard cap while the workspace remains active.
• Expired episodes are removed by the daily retention job.

7.3 Workspaces, memories, rules, skills

• Archived workspaces are auto-purged 90 days after archiving.
• Memories, rules, and skills that you delete are soft-deleted and remain restorable for 30 days, after which they are permanently deleted.

7.4 Billing lifecycle

• If a paid organisation becomes unpaid, we apply a 30-day grace period before any cleanup. We send warning emails 7 days and 3 days before the grace period ends.
• Invoices and payment records are kept for the period required by applicable tax and commercial law (currently 10 years under Turkish law).

7.5 Account deletion

• Account deletions are reversible for a minimum of 30 days. If your paid organisation has a billing period that ends later, the deletion window is extended to that period end.
• After the window closes, account data is deleted within 90 days, except where we are required to retain specific records (for example billing records) by law.

7.6 Dictation, Signals, shared artifacts

• Voice clips. Not retained. The audio is held only for the duration of the transcription call; we keep the resulting transcript (as your own content) and the metered number of seconds, not the recording.
• Runtime signals. Kept on the lifecycle documented in the Signals docs: unseen unlinked production incidents 14 days, unseen unlinked development or preview incidents 7 days, unseen stale declarations 30 days, and verified or card-linked incidents cold-compacted 90 days after the last evidence.
• Shared design artifacts. A published artifact is stored encrypted, with the decryption key carried in the link fragment rather than sent to us, so we hold ciphertext we cannot read. It stays available until you revoke the link or delete the design. Revoking stops the viewer from serving it; copies already downloaded by people who had the link are outside our control.
• Push notification tokens. Deleted when you disable notifications, sign out of the device, or the device token is rejected as invalid.

7.7 Other retention windows

• AI prompt and response payloads routed through the AI router: 30 days in raw form for debugging, then deleted or aggregated to non-identifying telemetry.
• Support email correspondence: 24 months after the ticket is closed.
• Encrypted database backups: 35 days rolling.
• Security and abuse logs: 12 months.

8. Your rights

Subject to local law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal retention obligations.
• Restrict processing in certain situations.
• Object to processing that is based on our legitimate interests, including profiling.
• Data portability. Receive your data in a structured, machine-readable format and ask us to transmit it to another controller where technically feasible.
• Withdraw consent at any time, without affecting prior lawful processing.
• Not be discriminated against for exercising your privacy rights (CCPA / CPRA).
• Opt out of "sale" or "sharing" of personal data. We do not sell or share, but we will still honour the signal.
• Lodge a complaint with a supervisory authority such as the Kişisel Verileri Koruma Kurumu (Türkiye), your local Data Protection Authority (EU/EEA), or the California Privacy Protection Agency / California Attorney General.

How to exercise your rights. Email [email protected] from the address associated with your account, or use the in-app Settings → Privacy → Export / Delete my data tools when available. We respond within 30 days for GDPR / KVKK requests (extendable by 60 days where the request is complex) and within 45 days for CCPA requests. We may ask you to verify your identity before fulfilling a request.

9. Cookies and tracking

The website at pathrule.io uses the following categories of cookies:

You can manage cookies via the in-product cookie banner or your browser settings. Disabling strictly-necessary cookies will break the site. For the full list of cookies we set, their purposes, durations and providers, see our Cookie Policy (/cookie-policy).

The Pathrule desktop app does not use HTTP cookies. Settings are stored in the app's OS-level data directory; on macOS, credentials are stored in the Keychain.

10. Security

We implement reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2 or higher) and encryption at rest at the database and object-storage layers.
• Strict access controls: least-privilege role-based access for our team, and user JWT only on the data path so user-facing endpoints cannot bypass row-level security.
• Supabase Row Level Security on every user-data table so that only members of the owning workspace can read or write rows.
• Workspace access checks on every Edge Function before reading or writing user data.
• Secrets stored in Cloudflare and Supabase secret stores; never committed to source control.
• Regular dependency updates, code review, and a documented incident response process.
• Logged and audited administrative access.

10.1 End-to-end encryption of conversation content

Conversation content that Pathrule Studio syncs between your devices (message bodies, titles, diffs, todos, turn summaries) is encrypted on your device before upload, using X25519 key agreement, HKDF-SHA256 key derivation, and AES-256-GCM.

• Device private keys never leave the device. The per-account content key is sealed to each of your approved device public keys and unwrapped only on-device.
• We store ciphertext and a nonce. We cannot read this content, and neither can a teammate whose device is not holding your key.
• Documented exception. If you mark a scheduled task's result conversation as team visible, that is an explicit share: the result is stored workspace-readable in plaintext (protected by row-level security so only members of that workspace can read it) rather than end-to-end encrypted, because no shared device key exists for a run that happens without you. Conversations that are not team visible stay end-to-end encrypted.
• Embeddings. So that past sessions can be recalled, a turn summary is sent to Voyage AI to be converted into a vector. The vector is stored under owner-only row-level security. The summary text is transmitted for that call; the encrypted copy in the conversation store remains the version we hold at rest.

10.2 Breach notification

If we become aware of a personal-data breach, we will notify the relevant supervisory authority within 72 hours where required, and notify affected users without undue delay where the breach is likely to result in a high risk to their rights.

No system is 100% secure, and we cannot guarantee absolute security.

11. Children's privacy

Pathrule is intended for professional developers and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, please contact [email protected] and we will delete it.

12. Contact

• Operator: Pathrule
• Registered address: 30 Ağustos Zafer Mah. 73. Sok. No:3, Bursa/Nilüfer, Türkiye
• Privacy contact: [email protected]
• Data Protection & KVKK contact person: Sertan Helvacı, [email protected]
• Response time: we aim to respond to all rights requests within 30 days (GDPR / KVKK) or 45 days (CCPA).

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users by email and via an in-app banner at least 14 days before the changes take effect (30 days where the changes involve new categories of processing).
• For changes that require consent, request fresh consent before the change applies to you.

If you disagree with material changes you may close your account before they take effect.

14. Additional provisions

• No sale of data. We do not sell or share your personal data for cross-context behavioural advertising or any other purpose.
• Third-party links. The Service may link to or interoperate with third-party services such as GitHub, the Stripe billing portal, and the Anthropic Console. Their privacy practices are governed by their own policies.
• Governing law. This Policy is governed by the laws of the Republic of Türkiye, without prejudice to the mandatory protections that GDPR, UK GDPR, or CCPA give to users in those jurisdictions.
• Language. This Policy is published in English. Where translations are provided for convenience, the English version prevails in case of inconsistency.
• Effective date. 12 August 2026.

Questions about this Policy? Email [email protected].