Privacy Policy

Throughline turns a product brief into requirements, architecture, a backlog and UI prompts, and traces every output back to the decisions it came from.

• Account data: your email address and authentication identifiers, handled through Supabase Auth.
• Project content you enter or approve: briefs, generated requirements, architecture, backlog items and UI prompts, decisions, and approval history.
• Records of outputs created in external services: repository name and URL, Jira issue keys and links, and Google Stitch project references.
• Usage metadata for AI generation runs: model, token counts, cost and status. It is not used as advertising data.

Throughline can work with GitHub, Jira (Atlassian) and Google Stitch. When you connect an account or key, the credentials are used only to act on your behalf when you ask, for example to create a repository, export issues or generate a prototype.

• Credentials are kept on the server only. They are never sent to your browser or written to logs.
• You can disconnect or stop using a connected service at any time.
• Removing a repository link in Throughline does not delete anything on GitHub. Items already created in an external service stay there until you remove them there.

• Supabase provides our database, authentication and file storage.
• Vercel hosts the application.
• OpenAI receives the project text you submit so it can generate artifacts.
• GitHub, Atlassian and Google Stitch receive only what you ask Throughline to create there.

We do not sell your data, we show no advertising, and we use no analytics trackers.

We keep your data while your account and projects exist. Deleting a project removes its content and records. To delete your whole account, contact the operator of the instance you use.

• Data is encrypted in transit with HTTPS.
• Access to a project is limited to its owner.
• Connected-service credentials stay on the server.

We use only essential authentication and session cookies, plus short-lived state cookies while you connect an account if that flow needs them. We use no advertising cookies.

You can ask to access, correct or delete the personal data we hold about you. To do so, contact the operator of the instance you use.

Throughline is not intended for anyone under 16.

If we change this policy we will update the “Last updated” date at the top of this page.