sinatra.dev
Sign inStart free

Privacy Policy

Last updated: October 16, 2026

This Privacy Policy explains what information Sinatra collects, how we use it, and the choices you have. It applies to our website, app, and the coding agent (together, the "Service").

1. Information we collect

  • Account information. Your name, email, organization, and similar details when you sign up. If you set a password, we store only a salted one-way hash of it, never the password itself. When you choose one, we check it against a public list of breached passwords by sending only a short prefix of its hash.
  • Integration and repository data. When you connect a tool such as GitHub, Linear or Slack, we access the issues, repositories, messages and related content needed to do the work you assign, including the source code Sinatra reads and changes. We keep the issue, comment and message text these tools send us with your workspace. When our prompt-injection screen flags a piece of incoming text, we keep that text with the flag so the decision can be checked later. Section 5 covers Slack in detail.
  • Tasks you start from the CLI, MCP server or API. The messages you send Sinatra this way and the replies it posts back are kept as the task's conversation. If you create an access token, or sign in from the CLI or an AI app, we store a one-way hash of the token and its last four characters, never the token itself, along with the token's or app's name and when it was last used.
  • Credentials you provide. If you connect your own model keys or a provider subscription, we store them in encrypted form so the Service can use them on your behalf.
  • Usage and log data. Technical information about how you use the Service, such as activity, timestamps, your IP address and browser when you sign in, and diagnostic logs. Our website and app use cookies and similar storage to keep you signed in and for analytics, and our analytics provider records how pages are used, with form inputs masked.
  • Payment information. On a paid plan, our payment processor handles your payment details. We do not store full card numbers.

2. How we use information

We use the information we collect to:

  • operate the Service and run the agent on the tasks you assign;
  • authenticate you and secure your account;
  • provide support and respond to you;
  • send you email about your account and the tasks you assign, such as sign-in links, workspace invitations, setup reminders and alerts when a task needs you. Reminders and alerts have an unsubscribe link, and you can turn them off at any time. When a workspace owner invites you, we email the address they entered. If you ask Sinatra for work from a Linear account that isn't linked to Sinatra, we may email the address on that Linear account to explain how to link it;
  • process billing for paid plans;
  • monitor for abuse and keep the Service safe and reliable;
  • maintain and improve the Service.

3. How we share information

We share information only as needed to run the Service:

  • with the model provider you connect, which processes the content of each task your account or workspace runs, under your agreement with that provider;
  • with model providers we use for internal checks, such as screening incoming text, deciding whether a message or Slack reply is meant for Sinatra, describing your repositories and summarizing changes. These checks can include a task's messages, issue, comment and thread text, a repository's README and file list, and parts of a pull request's diff. These providers are set up not to train on what we send them. Checks that only return a decision, such as the screen, go only to providers that don't keep the data after they answer;
  • with cloud infrastructure providers that host and run the Service;
  • with service providers that run analytics, error reporting, bot protection at sign-in and email delivery for the Service;
  • with our payment processor, to handle billing;
  • when required by law, or to protect our rights, our users, or the Service;
  • as part of a business transfer, such as a merger or acquisition.

We do not sell your personal information.

4. Your code and credentials

We treat the code and credentials you connect as sensitive. Each task works in its own isolated sandbox, where Sinatra checks out your repository and does the work. Credentials you provide are stored encrypted and used only to run the Service for you. We do not use your code or content to train our own models, and we do not sell it.

5. Slack

A workspace owner or admin can connect a Slack workspace to Sinatra. Sinatra only sees messages in channels it has been invited to. When it's connected:

  • What we store. The Slack workspace's ID and name, the permissions it granted, and Sinatra's Slack access token, which is encrypted. For each person whose Slack account is linked to Sinatra, their Slack user ID and the name Slack gives us; for people who link with Sign in with Slack, that name can be their email address. The events Slack sends us, including the text of messages posted in channels Sinatra is in, are recorded when they arrive so a request isn't lost or handled twice. For threads Sinatra works in, we also keep the thread's messages and the replies Sinatra posts, and any message our prompt-injection screen flags is kept with the flag.
  • How we use it. To pick up the tasks you give Sinatra in a thread, to give the agent the thread as context, to post progress and answers back to the thread, and to tell whether a reply is meant for Sinatra. The agent reads the thread, and any files attached to it, from Slack when it runs, and that content is sent to the model provider that runs the task.
  • Email addresses. When someone who hasn't linked their Slack account mentions Sinatra, replies in a thread it's working in, or clicks one of its buttons, we look up their Slack profile email to match a Sinatra account with the same verified email. If one matches, their Slack account is linked to it. We use the email only for that match and don't store it or add it to anyone's account. If no account matches, the person can link their Slack account with Sign in with Slack instead.
  • What we don't do. We don't use Slack data to train our own models, sell it, or use one organization's Slack data for anyone else. Sinatra doesn't read direct messages.
  • Disconnecting. Disconnecting Slack from Sinatra's settings uninstalls the app and deletes the access token and the linked Slack identities straight away. If the app is removed from the Slack side instead, Sinatra stops using the token at once. The token and the linked Slack identities are deleted when an owner or admin releases the connection in settings, and reconnecting Slack replaces the token. Otherwise, linked Slack identities are not removed when the app is uninstalled from Slack or when the Sinatra workspace is deleted; ask us and we will remove them. Messages and event records already stored stay with the Sinatra workspace until it is deleted or you ask us to delete them. To have them deleted, email us from an owner or admin account; see section 8.

6. Data retention

We keep information for as long as your account is active or as needed to provide the Service, and longer only where we need to meet legal, accounting, or security obligations. Each task works in its own sandbox. A sandbox stops after two hours without activity, and a sandbox that goes 30 days without activity is deleted along with its files. Deleting a Sinatra workspace deletes its tasks, the messages and events stored with them, and its stored integration tokens. Operational records, such as job histories, logs and error reports, can also contain task content; they expire on their own schedules. Deleted information can stay in backups for a limited period until they are overwritten. You can ask us to delete your information, and we will do so unless we are required to keep it.

7. Security

We use reasonable measures to protect your information, including encryption in transit and at rest for sensitive data and access controls that limit who and what can reach it. No service can promise perfect security, and to the fullest extent permitted by law we are not liable for unauthorized access, loss, or disclosure beyond what the law requires.

8. Your choices and requests

You can access or update your account information, disconnect integrations, and revoke any keys or access tokens you have connected at any time. You can also ask us to:

  • tell you what information we hold about you or your workspace;
  • send you a copy of it that you can take elsewhere;
  • correct it;
  • close your account or delete a workspace; or
  • delete your information, including the Slack data stored for your workspace, unless we are required to keep it.

To make a request, email contact@sinatra.dev from the address on your Sinatra account. For workspace data, such as a Slack workspace's messages, the request needs to come from an owner or admin of that workspace. If you don't have a Sinatra account, for example if you use Slack in a workspace that has connected Sinatra, email us from any address and tell us your Slack workspace and the name you use there. We may ask you to confirm the request before we act on it.

9. Where information is processed

We and the providers we use may process and store information in the countries where we or they operate. By using the Service, you understand that your information may be processed in locations other than where you live.

10. Children

The Service is not intended for children, and we do not knowingly collect information from anyone under the age required to consent in their country. If you believe a child has provided us information, contact us and we will remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top. If the changes are significant, we will take reasonable steps to let you know.

12. Contact

Questions about privacy or your information? Reach us at contact@sinatra.dev. We reply within 2 business days.