Privacy policy

Last updated 29 October 2026.

Weave is a personal project run by one developer. It is not a company and is not affiliated with any employer. In this policy, "I" means that developer and "you" means anyone who uses Weave. Questions and requests go to yuvrajsanghai9@gmail.com.

What Weave collects

• Your account: your name, email address, company name, and a hash of your password. Weave never stores the password itself.
• Content from the tools your company connects. Weave stores the text of each item, split into searchable pieces, along with metadata such as titles, authors, times, and links. Up to 100,000 characters are kept per item. Only the tools an owner connects are read:
  • Slack: messages in public channels the Weave app is in.
  • Notion: pages shared with the integration.
  • Google Drive: the Docs that are shared with Weave.
  • GitHub: issues, pull requests, and their comments in the repositories you install the app on.
• Sign-in details for those tools. Access tokens are encrypted before they are stored.
• Your questions and Weave's answers. These come from the setup page, the desktop pet, Cursor, and Slack. Weave also keeps a record of which sources each answer used.
• Email drafts you ask about. When you use the Gmail helper, the recipients, subject, and text of the draft go to Weave so it can suggest wording. They are not added to your company's knowledge.
• Technical data: server logs with request paths, times, and IP addresses. Logs do not contain passwords or tokens.

Weave uses one cookie, to keep you signed in. It does not use advertising or analytics cookies, and it does not track you across other sites.

How it is used

Data is used only to run Weave for you and your company:

• to answer questions with sources the person asking is allowed to see;
• to keep your account secure;
• to send account emails, such as verification, password reset, and invites.

Weave does not sell your data, does not use it for advertising, and does not use it to train AI models.

I do not read your company's content, except in three cases: when you ask me to for support, when it is needed for security, or when the law requires it.

Google user data

Weave's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Weave reads only the Google Drive Docs that are shared with it, and only to answer your company's questions.
• It never writes to, moves, or deletes your Drive files.
• Google data is never used to train AI models, never shown in ads, and never sold.

Who else handles it

• Amazon Web Services (Sydney, Australia) runs Weave's servers and keeps its logs.
• Neon (Ohio, United States) stores accounts, encrypted tool tokens, the searchable text of items, questions, and answers.
• FalkorDB Cloud (Mumbai, India) stores short excerpts and metadata from connected tools.
• Groq (United States) receives your question and the passages Weave found, so it can write the answer. A company can use its own Groq key instead.
• Google sends Weave's account emails through Gmail.

So your data may be stored and processed outside your country.

How long it is kept

• Server logs: 7 days.
• Sign-in sessions: 14 days.
• Tokens for the pet and Cursor: 30 days.
• Email links: 30 minutes to 7 days, depending on the link.
• Everything else: kept until you ask for it to be deleted.
• Deleted or trashed items: when an item is deleted or trashed in a connected tool, Weave removes its text on the next sync, or within a day at the latest. The same goes for an item that is moved out of a connected folder or no longer shared with Weave.

Your choices

• A company owner can disconnect a tool at any time from the tool's own settings. That stops new data from being read.
• Revoking a token on the setup page signs that device out.
• To get a copy of your data, or to have your account or your company's data deleted, email yuvrajsanghai9@gmail.com. I will act on it within 30 days.

Security

• Traffic is encrypted with HTTPS.
• Tool tokens are encrypted at rest. Passwords are hashed with Argon2.
• Each company's data is kept apart from every other company's.

No system is perfectly secure. If a breach affects you, I will tell you.

Children

Weave is for work use and is not meant for anyone under 16.

Changes

If this policy changes, the date at the top changes. If a change is significant, account owners are emailed.