Privacy Policy

01. Overview & Scope

Builderthread ("we", "our", or "us") provides a spec-driven development platform for software builders and AI coding agents. This Privacy Policy details how we handle personal data, project blueprints, AI agent context files, GitHub integrations, Model Context Protocol (MCP) connections, and payment details when you use our website, APIs, or services at builderthread.dev.

02. Information We Collect

We collect information necessary to deliver spec generation, starter code scaffolding, and agent context synchronization:

• Account Credentials: Email address, name, password hash, and OAuth authentication tokens (GitHub, Google).
• Project & Spec Inputs: Project descriptions, target competitor reference URLs, questionnaire answers (tech stack, frontend/backend preferences), and generated Living PRD documents.
• GitHub Connection Data: Scoped OAuth tokens, repository IDs created or connected, branch names, commit hashes, and milestone completion timestamps used to compute GitHub Build Momentum.
• MCP & Agent Telemetry: Ephemeral MCP tokens, session heartbeat timestamps, and prompt packet sync logs.
• Billing Information: Billing records, subscription tiers, and transaction IDs handled securely via our Merchant of Record, Polar (Polar Software Inc.). We do not store raw credit card numbers.
• Technical Logs: Browser user agent, IP address, request timestamps, and system performance metrics for security and diagnostics.

03. How We Use Your Information

We use your information exclusively to provide and enhance platform functionality:

• Deconstructing product references and synthesizing live market signals (Reddit, G2, Trustpilot) into structured Living PRDs.
• Generating customized production-grade starter repositories matching your accepted tech stack decision.
• Creating and syncing agent context files (AGENTS.md, CLAUDE.md, .cursorrules) and serving real-time MCP context to your local coding agents.
• Tracking project execution progress and delivering build status updates via Discord bot integrations.
• Managing billing, credit allocations, and customer support.

04. AI Processing & Large Language Models (LLMs)

Builderthread interfaces with state-of-the-art AI infrastructure providers (such as Anthropic, OpenAI, and Google Gemini) to generate specifications and code architecture.

Data sent to third-party model APIs is processed under zero-data-retention commercial API terms. Your proprietary inputs, PRD content, and code snippets are never used to train or fine-tune public foundation AI models.

05. GitHub Integration & Repository Privacy

When you connect your GitHub account to Builderthread, you authorize scoped actions including creating starter repositories, committing context files, and reading commit metadata.

• Private by Default: All repositories initialized by Builderthread are created as private unless you explicitly elect otherwise.
• Scoped Access: We request only the minimum required OAuth permissions needed to scaffold repos and listen to commit events for milestone tracking.
• Revocation: You can disconnect your GitHub account and revoke access at any time from your Builderthread workspace settings or your GitHub OAuth settings.

06. Third-Party Sub-processors & Infrastructure

We work with trusted third-party providers who adhere to strict data security and privacy standards:

• Hosting & Database: Vercel (frontend deployment), Supabase / PostgreSQL (encrypted database storage).
• Background Orchestration: Trigger.dev (background tasks and reliable task execution).
• Payments & Merchant of Record: Polar Software Inc. (PCI-DSS compliant payment processing, merchant of record, and invoicing).
• Analytics: Privacy-focused usage telemetry to monitor platform reliability.

07. Data Security & Encryption

We enforce industry-standard security protocols to protect your information:

• All data in transit is encrypted using TLS 1.3.
• OAuth tokens, MCP secrets, and sensitive database records are encrypted at rest using AES-256 encryption.
• Continuous automated vulnerability audits and role-based access controls for internal systems.

08. Your Rights & Data Deletion

Under GDPR, CCPA, and global privacy standards, you have full control over your personal data:

• Access & Export: You can export all your Living PRDs, Kanban boards, and context files at any time.
• Deletion (Right to be Forgotten): Deleting a project or your account permanently purges your project files, PRDs, and database records from our active servers.
• Opt-Out: You may opt out of non-essential marketing emails at any time.