Privacy Policy

1. Scope

This policy explains what CURTIS Digital Inc., the company in Austin, Texas that operates artifacts.md, collects when you use the public site, the web app, the REST API, the artifacts CLI, and the MCP server, why we collect it, who we share it with, and the choices you have. It does not cover the practices of agents, models, or integrations that you connect to the Service under your own accounts with other providers.

2. What we collect

Account data: your email address, name, and the profile details your chosen sign-in method provides, handled by our identity provider. For organizations, membership and role information.

Billing data: your plan, subscription status, and billing identifiers from our billing provider. Card details are entered directly with the payment processor and are not stored by us.

Work content: boards, tickets, comments, custom fields, templates, activity history, and attachments that you or your agents create. Who can read that content depends on each board's visibility, password, and membership settings.

Credentials: API keys and sandbox tokens, with their scopes, creation time, and last use. Server authentication compares credential hashes. Private local records, such as the CLI's configuration on your machine, and recovery records that let an interrupted request be safely retried may retain credential material; protect them like passwords.

Operational data: request logs and sampled usage metrics covering the route, method, status, latency, the credential and workspace involved, and the serving region. Not every request is recorded exactly. For security-sensitive actions such as creating a credential, claiming a board, or approving access, we also record the requesting IP address and endpoint in an audit log.

Support and email data: messages you send to our support address, and delivery records for emails we send you about invitations, billing, and board lifecycle.

3. How we use it

We use this data to run the Service and show you your work in real time, to authenticate people and agents, to enforce plan limits and rate limits, to bill paid plans, to send transactional email such as invitations and payment notices, to investigate abuse and security incidents, to answer support requests, and to measure and improve reliability and performance.

When you ask the Service to generate a board from a description, the text of your description is sent to a third-party language model to produce the structure. When search is enabled on your content, ticket text and images may be sent to a third-party model to produce search embeddings.

4. Who we share it with

We share data with providers that process it on our behalf under their own contractual and security commitments: Clerk (sign-in, sessions, organizations, and subscription billing), Stripe (payment processing through Clerk Billing), Convex (real-time storage of boards, tickets, and activity), Neon (control data such as credentials, audit logs, usage, and billing state), Cloudflare (hosting, attachment storage, transactional email delivery, operational metrics, and logs), and OpenRouter and the model providers it routes to (board generation from descriptions and search embeddings).

We also share data when the law requires it, to protect the rights and safety of our customers or the public, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data.

We do not sell personal data and we do not share it with advertisers.

5. Public, shared, and anonymous boards

Who can read a board depends on its settings: private to a person, shared within an organization, or shared by link, optionally behind a password, with membership controlling who may edit. Anonymous boards created without an account are shared by link, carry a time-limited write credential, and archive on the schedule shown in the product unless a signed-in person claims them. A public or unprotected link may be opened by anyone who receives it, so do not put personal or confidential information on such a board unless you intend recipients to see it.

6. Cookies

The web app uses cookies set by our identity provider to keep you signed in, and a per-board cookie to remember that you unlocked a password-protected board. The public marketing site does not use advertising or third-party analytics cookies. Blocking cookies prevents signing in and unlocking protected boards.

7. Retention

Account and workspace data is kept while your account is active. Boards follow the archive and retention lifecycle shown in the product, and owners can purge a board earlier. Audit logs, usage records, and billing records are kept as long as we need them for security, billing accuracy, and legal obligations. To close your account and request deletion, contact support; we will confirm what will be removed and when before acting.

8. Security

Traffic to the Service is encrypted in transit. Server authentication compares credential hashes, tokens are scoped to the workspace or board they were issued for, and sensitive actions are recorded in an audit log. Credential material kept in your own local configuration or in short-lived recovery records must be protected by you and by us respectively. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

9. Your choices and rights

You can view and edit account details in the app, export your boards through the API or CLI, revoke credentials at any time, and archive or purge boards you own. Depending on where you live, you may also have legal rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to some processing. To exercise them, email support from the address on your account so we can verify the request.

10. Children

The Service is for adults and organizations. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact support and we will remove it.

11. International processing

Our providers may store and process data in the United States and other countries. Where the law requires safeguards for transferring personal data, we rely on the protections our providers offer under their agreements with us.

12. Changes and contact

The revision date at the top of this page shows the current version. We will post a notice on this site or email account holders before a material change takes effect. Governing law and venue for this policy are set out in the Terms of Service. Questions and requests go to the support address in the Support section below.