Privacy Policy

This policy explains how Cincha (“Cincha,” “we,” “us,” or “our”), the operator of the Cincha service, handles personal information when you visit cincha.dev, create or use an account, use a guest workspace, or interact with Cincha applications and AI agents.

Information we collect

• Account and identity information: name, email address, profile image, account and provider identifiers, verification status, password hash, authentication records, and account status.
• Organization information: organization name, memberships, roles, invitations, administrator actions, account settings, and audit records.
• Google sign-in information: when you choose Continue with Google, we request only openid, email, and profile. We use this information to authenticate you and create or link your Cincha account. Google sign-in does not give Cincha access to Google Drive, Docs, Sheets, Gmail, or other Google product data.
• Content and workspace data: prompts, messages, tool results, files, generated output, application configuration and bundles, session records, and other material submitted, created, or retrieved through the Service.
• Connections and secrets: connection type and name, endpoint and network-allowlist information, API tokens, database credentials, and other secret values you provide, as well as data retrieved from a connected service at your direction.
• Usage and transaction information: selected application and model, token counts, model-provider request identifiers, raw provider cost, service fees, credit balances and ledger entries, purchase amount and status, Stripe customer and transaction identifiers, and related billing records. Cincha does not receive or store full payment-card numbers.
• Guest-workspace information: guest-token metadata, workspace expiration and spending limit, prompts, files, usage, and the technical information described below. We store a cryptographic hash rather than the raw guest token after it is issued.
• Communications: support requests, feedback, abuse reports, and other messages you send us.
• Technical information: IP address, browser and device data, timestamps, referring page, request, diagnostic, and security logs, and cookie or browser-storage identifiers needed to operate and protect the Service.

Where information comes from

We receive information directly from you; from the Customer or organization that provides your access; automatically from your browser and use of the Service; from identity, payment, model, email, and infrastructure providers; and from external services you choose to connect. Applications and agents may create new content or retrieve data from those connected services according to your instructions and permissions.

How we use information

We use information to:

• create, authenticate, administer, secure, and support accounts;
• provide organizations, workspaces, applications, files, connections, and AI output;
• execute requested tools and actions in connected services;
• process purchases, credits, usage accounting, reconciliation, taxes, and fraud prevention;
• send verification, password-reset, security, transaction, and service messages;
• monitor reliability, troubleshoot failures, investigate abuse, and enforce our Terms;
• analyze and improve Service performance and usability; and
• comply with law, protect rights and safety, and resolve disputes.

Where data-protection law requires a legal basis, we process information as necessary to perform our contract and provide the Service; for legitimate interests such as security, fraud prevention, support, and product improvement; with consent where we request it; and to comply with legal obligations. You may object to processing based on legitimate interests, and may withdraw consent at any time, subject to applicable law. Withdrawal does not affect prior lawful processing.

AI models and submitted content

When you use an AI-powered application, relevant prompts, conversation context, files, connected-source data, tool results, and instructions are sent to OpenRouter and the upstream model provider selected for the application. This is necessary to generate the requested response. The selected provider, model, routing, and features can affect where and how that information is processed. Provider retention and model-training practices may vary and are governed by their terms, privacy policies, and the configuration available for that model. Do not submit information you are not authorized to process or that is inappropriate for the selected provider.

Cincha uses Customer Content to provide, secure, maintain, and support the Service and as otherwise described in this policy. Cincha does not use Customer Content to train AI models unless the Customer affirmatively agrees. We may use aggregated or de-identified operational information to understand and improve the Service.

Applications, agents, and connections

An application may contain code supplied by Cincha or a third-party creator. That code and its agent can process the prompts, files, configuration, tool results, and connected data made available in the workspace. Availability or review of an application does not guarantee its privacy or security. Review application-specific descriptions and permissions before using it.

Connection credentials are encrypted in storage. During a session, a direct connection’s credential may be decrypted and made available inside the Customer’s isolated runtime so the application or agent can use it. For a brokered connection, Cincha keeps the credential on the platform side and uses it on the agent’s behalf. Our systems are designed to keep secret values out of ordinary transcripts and logs, but any application or agent given direct access can use those credentials and may expose them through its actions. Use least-privilege credentials and revoke them when no longer needed.

Organizations and account administrators

Information created in an organization account is controlled by that organization. Its owners and administrators may manage membership, settings, connections, files, sessions, content, usage, and retention, and may remove your access. Authorized Cincha personnel may access accounts or use audited administrative tools when needed for support, security, legal compliance, or enforcement. If your organization provides your account, direct questions about its use of your information to the organization first.

Guest workspaces

A guest link may be usable by anyone who has it until its time or spending limit is reached. The Customer that created the link may control the workspace and may be able to view its sessions, files, and usage. We use a short-lived cookie or credential to maintain guest access and process guest activity in the same ways described in this policy. Do not put personal or confidential information in a guest workspace unless you understand who created and can access it.

How we disclose information

We do not sell personal information or share it for cross-context behavioral advertising. We disclose information only as needed to operate the Service, complete your requests, administer the relevant Customer account, protect users, or comply with law. Recipients may include:

• Service providers: infrastructure, storage, authentication, transactional-email, payment, monitoring, support, and AI model providers. These may include Hetzner, Google, Resend, Stripe, OpenRouter, and upstream model providers.
• Customers and administrators: the individual or organization controlling the account in which information is created.
• Applications and connected services: application code and external services you direct the Service to use. Information sent to an external service is also subject to that service’s policies.
• Legal and safety recipients: courts, regulators, law enforcement, affected parties, or advisers when reasonably necessary to comply with law or protect rights, safety, and the Service.
• Business transaction recipients: parties and advisers involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.

Payments

Stripe processes payment details on its hosted payment pages. Cincha receives transaction status, amount, currency, customer and payment identifiers, and limited payment-method information needed for accounting, support, fraud prevention, refunds, and disputes. Stripe handles payment information under its own privacy policy.

Cookies and browser storage

Cincha uses cookies and browser storage needed for login security, OAuth transactions, session and guest-workspace continuity, preferences, and fraud prevention. We do not currently use third-party behavioral-advertising cookies. Providers such as Google or Stripe may set their own cookies when you visit their hosted login or payment pages.

Retention and deletion

Account-owned sessions, files, configuration, and workspace data have no automatic expiration by default. We retain them until an authorized Customer deletes them, closes the account, requests deletion, or applies an organization retention setting. Removing a User from an organization does not delete organization-owned data. Connection credentials are retained until the connection or controlling account is deleted, subject to delayed backup removal.

Guest workspaces are retained for their configured time and spending-limited lifecycle, then scheduled for garbage collection. Transaction, credit, security, abuse-prevention, and audit records may be retained after account deletion when reasonably necessary for accounting, legal compliance, dispute resolution, and protection of the Service. Deletion from versioned storage and backups may occur on a delayed rotation. We may retain de-identified information that cannot reasonably be linked to you.

Security

We use technical and organizational safeguards designed to protect information, including encrypted transport, encryption of stored connection secrets, access controls, scoped credentials, isolated execution, network restrictions, and audit logging. No online system, model, or sandbox is completely secure, and we cannot guarantee absolute security. If you believe an account or credential has been compromised, contact us and revoke affected credentials promptly.

Your choices and rights

You can update some account information and control files, connections, and settings through the Service. You may disconnect Google sign-in from your Google account permissions page, although that does not delete your Cincha account. Organization-controlled requests may need to be made through the organization’s administrator.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; object to or restrict processing; withdraw consent; opt out of certain disclosures; use an authorized agent; appeal a denied request; and complain to a data-protection regulator. You will not be discriminated against for exercising a privacy right. Contact us to make a request. We may verify your identity and authority and may deny or limit a request where permitted by law, including to protect another person’s rights.

Cincha does not sell or share personal information for cross-context behavioral advertising and does not use sensitive personal information to infer characteristics about you. We therefore do not offer an opt-out for those practices.

International processing

Cincha and its providers may process information in countries other than your own, including where our infrastructure, model providers, and support personnel operate. Those countries may have different data-protection laws. Where required, we use contractual or other legally recognized safeguards for restricted transfers.

Children

The Service is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as the Service changes. We will post the revised version here and update the effective date. Material changes may also be communicated through the Service or by email.

Contact

Questions, privacy requests, and account-deletion requests can be sent to privacy@cincha.dev.