Privacy Policy

Last updated: August 9, 2026

DeerDawn ("we", "our", "us") respects your privacy. This policy explains how we handle data.

1. Data Minimization and Scope

Our architecture is designed to minimize data retention. DeerDawn stores the structured context needed to sync your AI tools, not full raw conversation transcripts. A connected MCP client receives only the result of the tool you or the client asks DeerDawn to run; DeerDawn does not independently read the rest of your conversation.

2. No Training on Customer Data

We do not use customer data, project context, imported source content, or conversation excerpts to train machine learning models. Your data is used solely to provide the context-sync service you have contracted for.

To power context extraction and matching, project context and conversation excerpts are sent to our LLM subprocessor (OpenAI) via its API under terms that prohibit training on API data and provide limited retention. Processing therefore involves this disclosed third-party subprocessor (see our DPA) rather than remaining solely within DeerDawn's own systems.

3. Data We Collect

We collect and process the following categories of data:

• Account and billing information: Email address, organization name, authentication identifiers, subscription status, and payment metadata. Payment card details are processed by Stripe and are not stored by DeerDawn.
• Context data: Project names, current tasks, goals, open questions, recent decisions, tech-stack notes, file paths, imported source metadata, and excerpts you explicitly submit for extraction or matching.
• Connection and authorization data: MCP client registrations, granted OAuth scopes, token metadata, connection status, and revocation events. OAuth credentials are stored encrypted or one-way hashed as appropriate.
• Technical and security data: IP addresses, request IDs, timestamps, setup and sync events, error codes, rate-limit events, and administrative audit records. We redact credentials and avoid placing customer context in application logs.
• Usage information: Feature usage and aggregate analytics used to operate the service, diagnose failures, prevent abuse, and improve onboarding.

You should not store secrets, passwords, API keys, payment details, or unnecessary personal data in project context. DeerDawn provides export and deletion controls in the dashboard.

4. How We Use and Share Data

We use these categories only to provide, secure, support, bill for, and improve DeerDawn; comply with law; and communicate about the service. We do not sell customer context or use it for advertising profiles.

When you connect Claude, ChatGPT, Codex, or another MCP client, that provider may receive the tool output you requested. Its handling of that output is governed by its own terms and privacy policy. You can disconnect a client or revoke its authorization at any time.

Our service providers process limited data on our behalf, including Clerk for authentication, Stripe for billing, OpenAI for context extraction and matching, Resend for service email, PostHog and Google for analytics where enabled, and infrastructure, database, caching, monitoring, and security providers. We may also disclose data when required by law, to protect users or the service, or as part of a corporate transaction subject to appropriate safeguards.

5. Analytics, Cookies & Tracking

Our websites use the following analytics and advertising tools, which set cookies or similar identifiers:

• PostHog: product analytics including autocapture of clicks/inputs/pageviews, heatmaps, and session replay (with input fields masked) to understand and improve the product
• Google Analytics (GA4): aggregate website usage measurement
• Google Ads: advertising conversion measurement

You can limit or block these tools through your browser settings or by contacting us. We are rolling out a consent control for visitors in regions where prior consent is required; where that applies, non-essential analytics and advertising will be gated on your choice.

6. Data Retention and Deletion

Free workspaces keep a rolling 7-day context-history window. Paid workspaces retain context while the subscription is active, subject to workspace settings and any shorter TTL you choose. OAuth authorization requests expire after 10 minutes, authorization codes after 60 seconds, and access and refresh grants no later than 90 days unless revoked earlier.

Deleting your account removes active workspace data, API keys, OAuth grants, connected-service credentials, and owner-scoped audit records from the primary database as part of the deletion transaction. Encrypted backups age out on their normal cycle, no later than 30 days, unless a narrow legal obligation requires longer retention.

While an account is active, security and administrative audit records may be retained for up to one year. Operational logs are retained only as long as reasonably necessary for reliability, fraud prevention, and security investigations. Legal holds may temporarily override these periods where required by law.

7. Your Controls and Rights

You can view and edit context, export account data, delete projects, revoke connected MCP clients and API keys, or permanently delete your account from DeerDawn settings. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing and to receive a portable copy. We will verify requests before acting on them.

8. Security and Restricted Data

We use HTTPS for MCP and OAuth traffic, encrypt sensitive credentials at rest, apply scoped authorization and tenant isolation, redact sensitive logs, and audit successful MCP writes. No system is perfectly secure. Do not place passwords, private keys, authentication tokens, payment-card data, health records, or other regulated or unnecessary sensitive personal data in DeerDawn context.

9. International Processing and Children

DeerDawn and its service providers may process data in the United States and other countries with appropriate contractual safeguards. The service is for users 18 and older and is not directed to children.

10. Contact

For privacy requests, contact [email protected]. Report security concerns to [email protected].