Privacy Policy

The mode you pick in Settings → Mode changes one thing: where the answer is generated. It never changes where your content is stored.

Remote mode requires a WorkspaceGPT account, created by signing in with GitHub. This is the complete list of what our servers hold. There is nothing else:

• Your GitHub numeric user id and login handle, plus the account-creation date GitHub reports — used to identify your account and to reject brand-new accounts created for abuse.
• Your plan and account status (for example “free” / “active”).
• An opaque session token, so you stay signed in. It expires automatically after 30 days and is deleted when you sign out.
• How many credits you have used this week, to enforce your plan’s weekly allowance. A number only — not what you asked.

We request only the read:user scope from GitHub. We never receive access to your repositories, and the extension never even sees your GitHub token — our server completes the sign-in exchange and hands back only its own session token.

Our inference endpoint does not log request or response bodies. Operational errors are recorded as a status code and an error type — never your prompt, never the model’s answer, never the retrieved content.

In Remote mode, the actual text generation is performed by an upstream model provider (currently OpenRouter, which routes to the model we select). Your question and the retrieved snippets reach that provider in order to produce an answer, and are handled under its own privacy and retention policy.

We state this plainly rather than claiming end-to-end zero retention on someone else’s behalf: WorkspaceGPT retains nothing, and we do not opt our provider account into any prompt-logging or data-sharing programme, but that provider — not us — is the authority on its own handling. If your organisation needs a contractual zero-retention guarantee across the whole path, use Local mode with a local model, which involves no third party at all.

When you connect Confluence, Jira, Azure DevOps, GitHub, or Vercel, authentication happens directly between your machine and that service (OAuth, or a token you paste). The resulting credentials are stored in your IDE’s encrypted secret storage (in the macOS Keychain or Windows Credential Manager for WorkspaceGPT Desktop) on your own device and are never transmitted to us. Content synced from those sources is indexed locally.

If you connect Confluence with page-editing access, the agent can change or create a page only after you approve the exact change in a review card. The request goes from your machine directly to Atlassian, under your own account; it does not pass through us. Runs that apply edits without review never write to Confluence.

The extension and WorkspaceGPT Desktop send anonymous product-usage events to PostHog (EU-hosted) to understand which features are used. This happens in both Local and Remote mode.

Each event contains:

• An event name describing an action — for example ado_sync_started, chat_turn, remote_sign_in_started.
• A random identifier generated on your machine on first run. It is not derived from your name, email, GitHub account, IP address, or machine id, and we cannot use it to identify you.
• The extension version, your editor version, and whether the event came from the editor extension or WorkspaceGPT Desktop.
• Occasionally a coarse, non-identifying attribute of the action — for example which mode was active, or that a message was blocked because no model was selected.

These events contain no prompt text, no answers, no file contents, no file paths, no document titles, and no source-code identifiers. They tell us that a feature was used, never what you used it on.

This website uses Vercel Analytics, which is cookie-less and does not build a profile of you.

The WorkspaceGPT Chrome extension can let WorkspaceGPT Desktop use your browser. It is off until you check Let WorkspaceGPT use this browser in the extension’s settings; Chrome asks for your permission at that point, and unchecking it removes that permission again.

When it is on, the extension talks to WorkspaceGPT Desktop on the same computer through Chrome’s native messaging, a local channel between two programs on your machine. No WorkspaceGPT server is involved. The extension does not export your cookies or saved passwords; the agent works inside your browser session, the way you would.

The agent acts only in its own “WorkspaceGPT” tab group or on the tab you are looking at, and it refuses to type into password fields. Chrome shows a bar saying the browser is being debugged whenever the agent is acting; clicking Cancel there stops it.

What the agent reads in the browser, such as page text, screenshots, and console or network output, becomes part of the conversation, like any other context. It is sent wherever your answers are generated: to your own model provider in Local mode (nowhere, with a local model), or to our endpoint and the upstream model provider in Remote mode, where it is processed in memory and not retained, as described above.

• Store your prompts, answers, documents, code, or vector index.
• Use your data to train or fine-tune any model.
• Sell or share your data for anyone else’s purposes.
• Use your data for any purpose unrelated to answering your questions, and never for creditworthiness or lending decisions.
• Require an account, a network connection, or telemetry for Local mode.

Switch to Local mode at any time — it needs no account and, with a local model, makes no external calls. Signing out of Remote mode deletes your session token immediately. To delete your account and the handful of fields listed above, email us and we will remove them.

Settings → Reset in the extension clears your local index and stored settings from your machine.

The usage analytics described above do not yet have an in-extension toggle. If you want them off, block eu.i.posthog.com at your network or firewall, or email us and we will exclude your identifier.

If we change what is transmitted or retained, we will update this page and its “last updated” date before the change takes effect.

Questions about this policy, or a data-deletion request? Email contact@workspacegpt.in.