Privacy Policy

This policy explains what Develosaur collects when you use the website, the web app, the MCP gateway at mcp.develosaur.com and the desktop app, why, and what you can do about it. Questions go to info@develosaur.com.

What we collect

• Account: your email address, which is how you sign in (we send a sign-in link, there is no password), your plan and your subscription status.
• Boards: the projects, nodes, text, tags, links, priorities and history that you, your teammates and your connected agents create. Search indexes for your boards are computed in your browser and stored with the board.
• Attachments: images you or your agents attach are stored in file storage and served from links. Anyone holding such a link can open the file, so do not attach secrets.
• Connected agents: when you authorize an AI client such as Claude, ChatGPT or Cursor, we store the authorization, the client name, the boards it may use and when it was last seen. Access tokens are stored only as one-way hashes.
• Payments: Polar processes payments as merchant of record. We receive your plan, seat count, subscription status and renewal dates. We never see or store card numbers.
• Usage: Google Analytics and Microsoft Clarity record page views, clicks, device and browser details and, for Clarity, session replays and heatmaps with typed input masked. We also log product milestones such as a try-out board created, a sign-up, a connector authorized or an agent returning, tied to your account or to a short reference, together with the label of the ad, post or site that first brought you here.
• Email and messages: invitations, collaboration notices and messages you send through the contact form.

What stays out of our hands

• Try-out boards made without an account live only in our server memory and are discarded after an hour without activity, unless you claim them into an account.
• The desktop app keeps your boards on your own computer. Nothing reaches our servers unless you sign in and sync.
• API keys for AI providers that you enter in Settings are stored only in your browser.

How we use it

• To run the service: sign you in, store and sync your boards, let the people and agents you authorize read and write them, and enforce plan limits.
• To bill you through Polar and to send the emails the product needs.
• To understand which parts of the product work and fix the ones that do not.

We do not sell personal data, we do not show ads, and we do not use your board content to train AI models.

AI agents you connect

A connected agent can read and write the boards you authorized, just as you can. What the agent's provider (for example Anthropic, OpenAI or Google) does with what its agent reads is governed by that provider's own terms and privacy policy.

You can see and revoke connected agents at any time under Settings, Connected agents. A revoked agent loses access immediately.

Who processes data for us

• Supabase: database, sign-in and file storage.
• Vercel: hosting for the website and web app.
• Polar: payments and subscriptions.
• Resend: email delivery.
• Google Analytics and Microsoft Clarity: usage analytics.
• Google Fonts: web fonts, which your browser loads from Google.

The MCP gateway runs on a server we operate. Some of these providers process data outside your country, including in the United States.

Sharing

People you invite to a board and anyone you give a share link to can see that board. We disclose data to others only when the law requires it or to protect the service and its users from abuse.

Cookies and local storage

We use browser storage to keep you signed in, to remember settings and, for 90 days, to remember which ad, post or site first brought you here. Google Analytics and Microsoft Clarity set their own cookies. You can block analytics cookies in your browser without losing access to the product.

Retention and deletion

We keep your account and boards while your account exists. You can delete a board yourself at any time. To delete your account and its data, or to get a copy of it, email us from the address on the account and we will do it within 30 days. Billing records may be kept longer where tax law requires it.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data and to object to or restrict how it is used. Email info@develosaur.com and we will answer within 30 days. You may also complain to your local data protection authority.

Security

Traffic is encrypted in transit. Database access rules limit every board to its owner and the people and agents they authorized, and tokens are stored hashed. No system is perfectly secure, so please report anything suspicious to us.

Children

Develosaur is not meant for children under 16 and we do not knowingly collect their data.

Changes

When this policy changes we update the date on this page. For significant changes we also tell account holders by email before they take effect.