Built for feedback workflows, not surveillance.

1. What Pincushion collects

• Feedback data: pin comments, thread replies, status changes, page URLs, selectors, viewport metadata (width/height at pin-drop time), a capped surrounding DOM snippet with scripts/styles removed (max 8 KB), optional acceptance criteria text the stakeholder writes (max 2 KB), and related metadata needed to locate the feedback on a page and make it implementation-ready for your agent. Likely-files inference (a list of source files your agent might want to edit) is computed locally in your MCP server at read time against your local Git repo — it is never stored in the cloud.
• Implementation traceability: when an agent resolves a pin, optional branch name, commit SHA, and pull-request URL can be recorded on the pin so stakeholders see "Resolved in PR #142". On the Pro plan, the deploy-hook can also write the production deploy URL back to the pin, and Pincushion AI can record a post-deploy verification verdict (verified / regressed / inconclusive) — both with optional plain-text notes.
• Pin screenshots: when you drop a pin, the Chrome extension captures the visible browser viewport as a PNG and uploads it to a Pincushion-hosted storage bucket. The URL of that screenshot is attached to the pin and rendered inline in Slack / Microsoft Teams notifications so reviewers can see what was annotated without clicking through. Screenshots are scoped to the page you were viewing at pin-drop time and never capture other tabs, the desktop, or browser chrome. The bucket is read-public (anyone with the URL can fetch the image) and the path uses random tokens to defeat enumeration.
• Account and billing data: name, email address, plan information, and Stripe transaction records needed to operate paid plans.
• Support and waitlist submissions: the email addresses you submit through support, launch waitlists, or send-to-desktop forms.
• Marketing-site analytics: Vercel Web Analytics (cookie-free) plus PostHog on the public website — pageviews and CTA events used to understand which pages and buttons convert. See section 4 for details.
• Extension usage telemetry: a small set of anonymous lifecycle events from the Chrome extension (extension installed, first time the pin button appears on a registered site, first pin dropped). These events carry a random identifier generated in your browser — never your email, browsing history, page contents, or the URLs you visit — and can be disabled in the extension's options.

2. What Pincushion does not do

• We do not sell personal data.
• We do not run advertising trackers on the product.
• We do not use the extension to track your general browsing behavior across unrelated websites.
• We do not collect custom event properties containing personal data from the marketing site.
• Workspace critiques and implementation use your connected agent and its model provider. Hosted Crit jobs use Pincushion's configured Codex worker and send the selected rendered-page evidence to OpenAI for analysis. Resulting pin records sync to the selected Pincushion project, including selector, body, tags, thread, and implementation evidence. See section 7 for the ChatGPT connection and its data controls.

3. How data is used

Pincushion uses the collected data to operate the extension, sync project feedback, connect MCP tools to the relevant project, process paid subscriptions, answer support requests, and understand how the marketing site performs at a high level.

4. Marketing-site analytics

The public website uses two analytics tools: Vercel Web Analytics (cookie-free) and PostHog (US cloud). Both are limited to pageviews plus a small set of CTA events such as install clicks, checkout clicks, docs navigation, support email clicks, and the success-page extension click. Those events only include simple location metadata such as hero or footer. PostHog may set a first-party cookie or localStorage entry to recognize repeat visits; we do not send it names, emails, or any form contents from the marketing site.

5. Slack and Microsoft Teams integrations

When a Slack workspace owner installs Pincushion via the "Add to Slack" flow, the OAuth grant scopes shown on Slack's consent screen are exactly what Pincushion uses. Specifically:

• What we read from Slack: workspace ID and name, the channel ID/name the installer chose, the bot user ID, the email of the installing user (so we can match them to a Pincushion account), and message content posted as thread replies to a Pincushion-anchored notification — used solely to relay that reply as a comment on the corresponding pin.
• What we never read: direct messages we did not initiate, channel history outside of Pincushion-anchored threads, files, audio, video, screen shares, or any data from channels Pincushion was not invited into.
• What we write to Slack: notifications about pin events (ready, mention, follow-up, optionally new and resolved) into the channel chosen at install, direct messages to project members @-mentioned in pin threads, an App Home tab summarizing connected projects and open pins, and replies to @pincushion mentions describing the app. Notifications include an inline image of the pin screenshot (rendered via Slack's image block — Slack fetches the image from our public storage URL, no auth handoff). To remove a screenshot already captured, email privacy@pincushion.io with the pin ID.
• How we store it: bot tokens are stored encrypted at rest in Supabase (US region), accessible only by the service role behind row-level-security deny policies on every Slack-related table. The webhook URL we receive is masked when listed back via the API.
• How to remove it: uninstall the Pincushion app from Slack and we mark the workspace revoked and pause all integrations within seconds. Or remove individual subscriptions via the remove_collaboration_integration MCP tool. For full account-level deletion, email privacy@pincushion.io.
• Microsoft Teams: we post Adaptive Card notifications to a Workflows webhook the user configures. We do not read messages from Teams; the integration is one-directional outbound only.

6. Storage and sharing

Feedback synchronized with Pincushion is stored in its hosted backend. Stripe processes billing. Vercel hosts the marketing site. Support and waitlist email flows use the configured mail provider. The connected agent and model-provider processing described in sections 2 and 7 also applies. Pincushion shares data with service providers as needed to operate the service.

7. ChatGPT plugin and hosted MCP connection

• Data received: the Pincushion account identity used at sign-in, the project and permissions you authorize, and the individual tool inputs you choose to send. These can include project names, page URLs, screenshot pixels, viewport and capture metadata, selected DOM snippets and selectors, feedback and thread text, approval decisions, and implementation evidence such as commit or pull-request references and check results. Pincushion does not request or reconstruct your full ChatGPT conversation or upload your entire repository through this connection. Repository access and development-server execution stay in the connected coding workspace.
• Purpose: authenticate the connection, enforce project membership and permissions, load the selected review, run the requested Crit, place and discuss pins, record approvals and implementation results, and prevent duplicate requests. Authorization, request, job, and capture records include identifiers, timestamps, status, and evidence needed for access checks, retry handling, and workflow traceability.
• Recipients: OpenAI receives the tool results and selected review evidence returned to ChatGPT, and the rendered-page evidence used by the hosted Codex Crit worker. Supabase stores hosted project data, captures, and authorization records; Vercel hosts the connection and web surfaces. Google provides the account identity when you choose Google sign-in. Their processing is governed by their respective policies and your applicable account settings. Only data needed for the requested review workflow is sent to these services.
• Private captures and sharing: captures uploaded through the native connection are private by default. Authorized review reads issue image links valid for 10 minutes. Explicitly choosing public sharing can make a report or capture available to anyone with its link. Link expiry does not delete the stored image or undo copies already received by a recipient. The public Chrome pin screenshots described in section 1 follow their separate sharing behavior.
• Your controls: choose the project and displayed permissions before connecting. You can disconnect the plugin in ChatGPT or revoke its project grant from Pincushion connected clients. Revocation prevents subsequent authorized access; it does not delete existing project feedback. Use project membership and sharing controls to limit other recipients, and contact privacy@pincushion.io to request deletion of account data, feedback, captures, or retained authorization records. OpenAI's controls govern copies held in your ChatGPT account.

8. Retention

Hosted project feedback, current captures, Crit results, implementation evidence, and workflow records are retained until they are removed through the applicable project controls or a deletion request is fulfilled. These records do not have a fixed automatic age-based deletion period. Ordinary pin history is not automatically deleted after 30 or 90 days based on plan. Client review packages follow their separate expiry rules. Snapshot history normally keeps the latest 20 published captures per project and page; older eligible captures are scheduled for cleanup as new captures arrive. Captures held for a client review or referenced by a review manifest can remain longer, and failed cleanup is retried.

ChatGPT connection access tokens expire after 15 minutes. Refresh-token families expire 30 days after issuance, and rotation does not extend that deadline. Pincushion stores token hashes rather than raw access or refresh tokens. Sign-in and authorization-request cookies expire after 15 and 10 minutes respectively. Expiry or revocation ends access but does not automatically erase the authorization and retry records; those remain until account deletion or a deletion request is fulfilled. A private image link expires after 10 minutes, independently of stored-capture retention.

Account, support, and waitlist records have no fixed automatic deletion period and remain until a deletion request is fulfilled. Billing records may be retained where needed for applicable accounting obligations. Analytics and copies held by other service providers follow their own retention settings and policies. Contact us for a request covering data held by Pincushion; removing a connection alone does not remove copies already shared with another service.

9. Access, deletion, and contact

If you need help with access, deletion, or privacy questions, email privacy@pincushion.io. For product or billing issues, contact support@pincushion.io.