Privacy policy

Questions about this policy, and requests to see, correct, or delete your data, go to [email protected].

Tuskway keeps the plan, design, and tickets for a feature in one place, so the people on a team and the AI coding tools they use can read and update the same material. Connecting GitHub, GitLab, Linear, or Jira is optional.

To create an account we store your name, email address, and a password. The password is stored as a hash. We do not keep the password itself. If you sign in with GitHub or Google, we store the name, email address, and profile image they send, the account id from that service, and the access token from that sign-in. When that service sends a refresh token or an ID token, we store that too. That sign-in is separate from connecting a tracker.

While you are signed in we store a session: a random value, when it expires, the IP address Cloudflare reports for your connection, and the browser identifier your browser sends. We use that to keep you signed in and to slow down repeated sign-in attempts.

A workspace stores its name, its address on Tuskway, who created it, and each member's role. An invitation stores the invited email address, who sent it, and when it expires. We do not email that invitation. You share the link. Opening it sets a cookie, described below, so only that email address can create an account from it.

We store the epics, notes, design documents, and tickets your team writes, plus line comments, suggested changes, and earlier versions of notes. Each version records whether a person or a connected tool made the change. A search index of the note text stays on our server so the team can find it. We do not send that text to an outside model.

When you connect a tool such as Cursor, Claude Code, or ChatGPT, it signs in with your account, or with a workspace token an owner creates for a background job. We store the tool's name, the address it returns to, the permission you grant, and a hash of the token that keeps it connected. We do not keep a readable copy of that token after it is issued.

A workspace token is stored only as a hash. We keep the start of the token, the name you gave it, whether it can read or also write, when it was last used, and when it expires, so you can recognise it and turn it off. Turning it off stops the next request. The record of the token stays with the workspace.

The assistant you connect, such as ChatGPT, Claude, Grok, or another client, receives the notes, tickets, and other epic material it reads through Tuskway. That use is covered by the assistant provider's own terms.

When that assistant registers as a client, it sends its name, redirect URIs, client URI, icon, contacts, software id and version, grant types, and metadata. We do not receive the chat.

A workspace owner can connect GitHub, GitLab, Linear, or Jira so tickets can be published as issues and kept in step. We use the connection to list the projects you can publish to, to create and update issues, and to hear about changes. We do not read your source code.

Access credentials

For GitLab, Linear, and Jira we store the access token, and a refresh token when the service sends one. A GitLab personal access token, if you paste one, is stored the same way. These secrets are encrypted before they are saved.

For GitHub we store the installation id and the name of the GitHub account or organisation. We do not store your GitHub user token. When we need to create or update an issue, we ask GitHub for a short-lived token and keep it in the server's memory until it expires.

Issues

For issues you publish, or that later change, we store the title, description, status, assignee, and labels, and the address of the issue. We use this to show when the issue and the ticket in Tuskway no longer match.

When GitHub, GitLab, Linear, or Jira includes an assignee's email address, we store that email so we can match them to someone in the workspace. If the tracker names an assignee but hides the email, we leave the assignee already saved in Tuskway unchanged, and we do not store an account id in its place. We do store who opened or last changed the issue: a GitHub login, a GitLab username, a Linear name or email, or a Jira email or display name. For Jira, an Atlassian account ID is used only to set the assignee on the issue. We send that account ID to Jira and we do not save it. We store the assignee's email when Jira includes it.

We store which account is connected: the GitHub account or organisation, the GitLab username and user id, the Linear workspace name and id, and the Jira site name, web address, and Atlassian cloud id.

Disconnecting

Disconnecting a tracker stops Tuskway from reading or updating issues on it. The connection, including any encrypted token, stays on the workspace until that workspace is deleted. Issues already published stay in GitHub, GitLab, Linear, or Jira. Removing the tracker from one epic deletes our saved copy of the remote issue for that epic's tickets. The ticket text written in Tuskway stays.

We use this information to provide the accounts, workspaces, notes, comments, and optional issue sync you asked for, and to show the plan a workspace has subscribed to. Session and IP data keep you signed in and limit repeated sign-in attempts. Link charges the subscription; we do not use your information for advertising.

The application and its database run on a virtual server from OVH. Cloudflare sits in front of the site, and the server answers over HTTPS. Once a day, when backups are turned on, a full copy of the database is uploaded to Cloudflare R2. Older backup copies are not deleted on a schedule.

These are the services that handle data for the hosted product:

• Cloudflare proxies the website and stores the backup copies.
• GitHub or Google, if you choose that sign-in. They handle the sign-in and send us the profile above.
• GitHub, GitLab (gitlab.com or a GitLab server the owner names), Linear, or Atlassian, if a workspace owner connects that tracker. We send ticket titles and descriptions so the tracker can create and update issues, and we receive issue updates back.
• Stripe, through Link, when a workspace pays for a subscription. Link is the reseller and the payment processor. Details are in Payments below.
• Minilytics, the analytics tool we run ourselves on Cloudflare Workers. Details are in Analytics below.
• Brevo sends verification, password-reset, and other account emails through its SMTP relay. A message includes the recipient's address and the email we send. Brevo does not receive notes, tickets, or comments.
• Sentry, in the EU region at de.sentry.io, receives error reports from the site and the server. An event holds a stack trace, the route pattern, the browser and operating system, and the release. It does not hold note content, ticket text, comments, tokens, cookies, the Authorization header, query strings, or request bodies.

Search runs on our server.

We count visits with Minilytics, an open-source analytics tool that we host on our own Cloudflare account. Its data is stored in Cloudflare and is not shared with anyone else. It does not show ads, and we do not sell what it records.

On each page view the script sends the page address, the referring site, the screen width, how long the page stayed open, and two random ids from the cookies described below. Minilytics works out the browser, operating system, and device type from the user agent, and an approximate location (country, region, and city) from Cloudflare. It does not store your IP address or the full user agent. Query keys such as token, email, and code are removed from the address before it is sent.

When you are signed in, the script also sends your user id, email address, and name, so visits from your browsers count as one person. When you open checkout, we add the two cookie ids to the Stripe checkout so a subscription can be credited to the page or link that brought you. We also record clicks on sign-up, pricing, and checkout buttons.

The script does not run on invitation, password reset, email verification, unsubscribe, or AI tool consent pages, or on workspace search, so invitation links, one-time links, and what you search for are never sent. Inside a workspace, the page address includes workspace and epic names and note paths.

Minilytics data is kept until we delete it. To stop it counting your visits in a browser, open any page with ?ml_ignore=true at the end of the address. Blocking the script does not affect Tuskway.

Paid subscriptions are sold through Link, Stripe's merchant of record service. Link is the reseller and the payment processor. It receives the name, email address, billing address, and payment details of the person who checks out, and it handles the payment, VAT, receipts, and payment-related support. Stripe covers that data in its own privacy policy at stripe.com/privacy.

Tuskway keeps a billing record for the workspace (workspace_billing): the Stripe customer id, the Stripe subscription id, the plan, the number of seats, and the currency. We do not store card numbers or other card data.

We do not sell personal data. We do not sell data from connected trackers. We do not use your notes, tickets, comments, or tracker data to train models.

We keep account and workspace data, including the billing record, for as long as the account and workspace exist. Card numbers are not part of that record.

You can delete a workspace you own from its settings. Type the workspace slug to confirm. That cancels the paid subscription at the end of the period already paid, revokes that workspace's tokens, disconnects its trackers, and removes the workspace. Download an export from that page first if you want a copy. Deleting a workspace does not disconnect AI tools signed in as you. The workspace is gone, so those tools can no longer open it.

You can delete your account from Account. If you are the only owner of a workspace that still has other people, make someone else an owner, or delete that workspace, first. A workspace where you are the only person is deleted with your account. Enter your password, or sign in again if this sign-in is more than 10 minutes old. Workspace bot tokens you created stop working.

After an account is deleted, this is what remains:

• Text inside notes and comments is not rewritten. Your name is shown as Deleted user.
• The admin audit log keeps the email address.
• Analytics that names you stays until you ask us to delete it.
• MCP usage is deleted after 30 days.
• The Stripe customer and subscription continue until the end of the paid period.
• A backup can remain in Cloudflare R2 until we delete it.

Disconnecting a tracker, or removing it from one epic, works as described above. Identifiers we store only so a repeated tracker notification is ignored are deleted after 30 days. Copies of comments we store only so a notification email can list them together are deleted 30 days after that email is sent.

When a workspace token is used, we keep a hash of truncated network information for 30 days to detect token sharing. The hash covers a shortened address (the first three numbers of an IPv4 address, or the first three groups of an IPv6 address) and the tool's user agent. We do not store the full address or the user agent, and we do not block the token.

tuskway.com is served over HTTPS. Tracker access tokens and refresh tokens are encrypted before they are stored. Passwords, workspace tokens, and the tokens that keep an AI tool connected are stored as hashes. Session cookies cannot be read by scripts on the page.

We do not set advertising cookies. The analytics script sets two cookies on every page it runs on, including the public site. They are readable by scripts on the page, which is how the script reads them.

ml_vid

A random visitor id that lasts one year. It is SameSite=Lax, Secure on https, and set for tuskway.com and its subdomains. It lets analytics count a returning visitor once.

ml_sid

A random session id that lasts 30 minutes from your last page view. Same settings as ml_vid. It groups the pages of one visit.

__Secure-better-auth.session_token

After you sign in, we set one session cookie. It is HttpOnly, Secure, and SameSite=Lax. It lasts seven days, and using Tuskway refreshes it. It exists so you stay signed in. Signing out clears it.

__Secure-better-auth.state

Starting sign-in with GitHub or Google sets one more cookie for five minutes. It is HttpOnly, Secure, and SameSite=Lax. It ties that sign-in to this browser and is cleared when you return. Email sign-in does not set it.

tuskway_invite

Opening a workspace invite sets one more cookie for 14 days. It is HttpOnly and SameSite=Lax, and Secure on https. It records which invitation you opened, so the invited email address can create an account. A normal visit does not set it.

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email [email protected]. We may ask you to confirm that the request is yours. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

When this policy changes, we update the date at the top of the page. The current date is 10 November 2026.