Privacy Policy

Account data: your name, email address and password hash (bcrypt — we never store the password itself). If you sign in with Google we store the provider identifier and the profile fields Google returns.

Content: the maps, topics, notes, comments and files you create. This is yours; we store it so we can show it back to you and to the people you share it with.

Operational data: session records (an opaque token hash, IP address, user agent and timestamps) so you can review and revoke sessions, plus rate-limit counters.

We do not sell your data.

We do not use your maps, notes or comments to train machine-learning models.

We do not read your content except where you explicitly ask us to — for example when you trigger an AI action, which sends only the text relevant to that action.

Payment processing is handled by Stripe; we store only the customer and subscription identifiers they return, never card details.

AI features send the text you submit to the configured provider (Anthropic or OpenAI, or a self-hosted endpoint on self-managed deployments) at the moment you trigger them.

Transactional email (verification, password reset, invitations) is delivered through the configured mail provider.

Maps you delete go to Trash and can be restored. Emptying Trash removes them permanently, along with their topics, comments, attachments and version history.

Deleting your account removes your personal data and any maps you own. Maps owned by others that you contributed to remain, with your contributions attributed to a removed user.

You can export any map at any time in JSON, Markdown, PDF, SVG or PNG — including after downgrading or cancelling.

You can review and revoke active sessions from Settings → Security.

You can request a copy of your data or its deletion by writing to contact@untangling.app.

We set one essential cookie for your session, and two short-lived cookies during a Google sign-in to protect the flow against forgery. We do not use advertising or cross-site tracking cookies.