Privacy Policy

Last updated: September 11, 2026

Overview

Pipeworx ("we", "our", "us") is operated by Mojibake Inc. This policy describes how we collect, use, and protect information when you use pipeworx.io and the Pipeworx API gateway.

Information We Collect

Account Information

When you sign up via GitHub OAuth, we receive your GitHub username, email address, and avatar URL. We use this to create and manage your account.

OAuth Connections

When you connect third-party services (e.g., Google Sheets, Salesforce, Jira, Slack), we store encrypted OAuth tokens to access those services on your behalf. Tokens are encrypted at rest using AES-256-GCM. We do not store your passwords for any connected service.

API Usage

We log every API request for rate limiting, billing, monitoring, and to decide which data sources to build next. A request log records the time, the tool name, the response status, how long the call took, the client user-agent, and an identifier for the caller. Tool names, timings and statuses are also written to the Pipeworx usage table in Supabase; the fuller request logs go to Cloudflare Workers Analytics Engine.

For ask_pipeworx we also store the first 200 characters of the question you asked, in the same log row as the caller identifier. We keep question text because the questions we cannot answer are the backlog that decides which data sources we build or licence next. We do not sell it and we do not use it to build a profile of you.

The caller identifier is not anonymized. If you are signed in it is your Pipeworx account ID. If you authenticate with your own API key it is your IP address together with a SHA-256 hash of that key. If you call anonymously it is your IP address: the full address for IPv4, or the first 64 bits (the /64 prefix) for IPv6.

The playground at pipeworx.io/try keeps a fuller record: the question as typed, up to 2,000 characters, next to the answer we returned, so that answer quality can be graded. Those records carry no caller identifier. We also keep a small sample of answer payloads from gateway traffic, to check whether an answer was actually about the thing that was asked about. Text that looks like a credential is redacted before either record is stored, and both expire automatically after 14 days.

Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or payment details directly. Stripe's privacy policy applies to payment data.

How We Use Your Information

  • To authenticate you and provide access to the Pipeworx gateway
  • To connect to third-party services you authorize
  • To enforce rate limits and usage-based billing
  • To monitor service health and prevent abuse
  • To find out which data sources agents ask for and we do not yet have, so we know what to build or licence next
  • To communicate important service updates

Data Sharing

We do not sell your personal information. We share data only:

  • With third-party services you explicitly connect (using your encrypted OAuth tokens)
  • With Stripe for payment processing
  • When required by law or to protect our rights

Data Storage and Security

Data is stored on Cloudflare Workers KV, Cloudflare Workers Analytics Engine, Supabase (PostgreSQL), and Upstash (Redis). Daily rate-limit counters are held in Cloudflare Durable Objects and discarded when the day rolls over. OAuth tokens are encrypted at rest with AES-256-GCM. All data is transmitted over HTTPS.

Data Retention

Account data is retained as long as your account is active. You can delete your account and all associated data by contacting us. OAuth tokens are deleted immediately when you disconnect a service. Request logs written to Cloudflare Workers Analytics Engine are kept for three months, which is Cloudflare's retention period for that product rather than one we set. Playground and answer-sample records expire automatically 14 days after they are written. We state no retention period for the usage rows in Supabase.

Your Rights

You can:

  • View and manage your connected services on the account page
  • Disconnect any third-party service at any time
  • Request deletion of your account and all associated data
  • Request a copy of your data

Cookies

We use a session cookie for authentication. We do not use tracking cookies or third-party analytics.

Changes

We may update this policy from time to time. Material changes will be communicated via the website.

Contact

For privacy questions or data requests, contact us at [email protected].