Privacy policy

Last updated: November 13, 2026

This policy explains what personal data Product Weaver collects, why, who else handles it, how long we keep it, and what you can do about it. It covers the website at www.productweaver.com, Product Weaver accounts, and the Product Weaver plugin.

The short version

• The plugin runs on your own machine and sends nothing to us, unless you say yes to anonymous usage statistics for a study. Those never hold your interviews, names, quotes, prompts or file names.
• If you sign in, we keep your name, email address and picture from Google or GitHub, and the workspaces you belong to.
• We never sell your personal data, never share it for advertising, never show ads, and never use your data to train AI models.
• We use PostHog to learn how people find and use the website. Until you sign in, it sets no cookies and stores nothing in your browser. We never record your screen or what you type.
• We use the cookies that sign-in needs, and one analytics cookie after you sign in. No advertising cookies.
• You can delete your account at any time in Settings, and write to us about anything else.

Who we are

Product Weaver is run by Product Expanse LLC, a California limited liability company based in Berkeley, California, USA (“we”, “us”). We decide how and why your personal data is used, so under European data protection law we are the controller. Write to us at privacy@productweaver.com.

What we collect

When you visit the website

• Server logs. Our hosting provider, Vercel, records technical data about each request, such as the IP address, the browser type, the page asked for and the time. We use these logs only to keep the website running and secure.
• Your theme choice. If you switch between the light and dark theme, your browser remembers the choice in its local storage. It is never sent to us.
• Analytics. We use PostHog, an analytics service, to learn how people find and use the website. For each visit it records the pages you open, the page you came from, your browser, operating system and screen size, how far you scroll each page, which buttons and links you click and their text, where on the page you click and move the mouse, and a few actions by name, such as copying an install command or a prompt, starting to sign in, or opening a link to another site. We also note which AI assistant sent you here, such as ChatGPT, when the link or your browser says so.
• Without cookies until you sign in. PostHog then sets no cookies and stores nothing in your browser. It recognizes a repeat visit on the same day from a one-way hash of your IP address, your browser and a value that changes every day, made on PostHog's servers, and it does not store the IP address with the visit. Your browser sends this data to our own website, and we pass it on to PostHog without our cookies.
• What we never record. We make no session recordings of your screen, and we never record what you type into a field.
• AI crawlers and assistants. When a known AI crawler or assistant, such as GPTBot or ClaudeBot, fetches a page, we record its name, the page and the time.

When you sign in

You sign in with Google or GitHub. We never see or store a password.

• Your profile. Google or GitHub gives us your name, email address, profile picture and your account ID there. We ask Google for openid, email and profile, and GitHub for read:user and user:email. These give read-only access to your profile and email address, and no access to your repositories, files or contacts.
• Sign-in tokens. The provider sends tokens that prove the sign-in. We store them with your account.
• Sessions. For each browser you sign in with, we keep the IP address and the browser type, for security.
• Rate limits. To stop abuse, we count requests to the sign-in pages per IP address.
• Analytics after sign-in. Signing in opts your browser in: PostHog then sets a first-party cookie, keeps a few values in your browser's local storage, and links what you do on the website and in the app to your account ID and workspace, never to your name or email address. On pages that show account data, such as Settings, it records no text of what you click. We also record when you sign up, create a workspace, or send or accept an invitation, with IDs only. The link ends when you sign out, when you open the sign-in page, or a week after you last used the app. Your browser then goes back to analytics without cookies, and one setting in its local storage remembers that.

When you use a workspace

• Workspaces. Each workspace's name, its members and their roles.
• Invitations. When someone invites a person, we keep that person's email address, their role and who invited them. The invited person may not have an account yet. We use the address only so that they, and nobody else, can join.
• Audit log. A record of changes in a workspace: which account made the change, what kind of change it was, and when. It does not keep what you typed.

When you write to us

We keep your email address and what you wrote, so we can answer.

The plugin

The Product Weaver plugin runs on your own machine, inside your AI assistant. Unless you say yes to usage statistics for a study (see below), it makes no network calls of its own and sends nothing to us. The knowledge base, the review sheet, the discovery map and the other files it writes stay in your folders. The plugin page lists every file.

Plugin usage statistics

If you say yes to usage statistics for a study, the plugin sends small usage events to us. They show which parts of the plugin work and which do not, so we can fix them. It asks at most once for each study, and each person who works on the study answers for themselves. Without your yes, it sends nothing.

What is sent. Which steps ran and when, how long each took, whether they worked, and how many tries a batch took. Yes-or-no facts about a run, such as whether it was only a trial. Whether you approved or rejected a suggested change, and what kind of change it was. How you started (with interviews, without them, or with a study you already had), whether you were asked at a new or an existing study, whether an interview guide was written, and whether the discovery map opened in your browser. Counts, such as how many interviews a study holds, and error and warning codes. If a script crashed, the class name of the crash. The language of the study, the format version a study was upgraded from, and whether the study folder is in git. The AI assistant and the model, the plugin and script versions, the Python version, the operating system family (macOS, Windows, Linux or other), and a random ID for each event. Every field has a fixed form (a number, yes or no, a version, a time or a short code), and our server refuses any event that does not fit. The plugin's list of usage events gives every field and the values it may hold.

What is never sent.

• Interviews, transcripts, names, quotes, prompts, notes or file names.
• Error or warning messages. Only codes and counts leave.
• The text of any label, the arguments of any command, or the paths of your files.
• The fingerprints (hashes) of your knowledge base and of the patches you merge.
• Times finer than a minute.
• Anything, when you say no or stop sharing.

How events are linked. When you say yes, the plugin makes a random study number. It comes from nothing else. The events of one study share that number, and nothing else links them to you. Under European data protection law, that makes them pseudonymous. We add no name and no email address, and we do not pass your IP address to PostHog.

Where it goes. The plugin sends the events to our own address, www.productweaver.com/api/plugin-usage. We check them and pass them on to PostHog in the United States. Like every request to our servers, the request shows in our hosting logs, as described above.

How long. 2 years.

How to stop. Tell your assistant to stop sharing. That also deletes the events that are waiting to be sent. You can also do it yourself: in .pw-kb/usage/settings.json, change "share": true to "share": false. Nothing more is then recorded or sent for that study, and events still waiting stay in the folder, unsent. Or set KB_TOOL_USAGE=0 or DO_NOT_TRACK=1 in your environment. With either setting, nothing is recorded or sent, whatever the study says. Events that were already waiting stay in the folder, and would go out if you removed the setting.

How to see what was sent. The file .pw-kb/usage/sent.jsonl in your study holds every event exactly as it left.

How to have it deleted. Write to privacy@productweaver.com with the study number from .pw-kb/usage/settings.json. We then stop accepting events for that study at once, and ask PostHog to delete the ones it already holds. Anything that remains is deleted when the 2 years end.

The choice stays with the folder. Your yes is saved in .pw-kb/usage/, so a study you hand to someone else keeps it. Delete that folder before you hand a study over. It also holds the study number, the only key for a deletion request, so note your number first if you may want those events deleted.

Your AI assistant handles the files it reads under its own provider's terms and privacy policy. Interview transcripts often hold personal data about the people you talked to, so check that your assistant's settings fit the promises you made to them.

Cookies

We set the cookies that sign-in needs and, only after you sign in, one analytics cookie.

• Session cookie (better-auth.session_token). Keeps you signed in. It lasts 7 days and renews while you use the site. Signing out deletes it.
• Sign-in check cookie. Set while Google or GitHub signs you in, to make sure the answer comes back to the same browser. It lasts at most 10 minutes.
• Analytics cookie (ph_…_posthog). Set by PostHog only after you sign in. It holds a random ID that links your use of the website and the app to your account ID. It is deleted when that link ends (see above), and lasts at most a year.

The two sign-in cookies are strictly necessary for a service you asked for, so we do not ask for consent for them. On secure connections their names start with __Secure-. Visitors who are not signed in get no analytics cookie, so we show no cookie banner.

Why we use your data

For people in the European Union, the United Kingdom and Switzerland, the law asks us to name a legal basis for each use.

• To give you an account and workspaces: our contract with you (the terms).
• To keep the service safe and working (logs, sessions, rate limits, audit log): our legitimate interest in a secure, reliable service.
• To learn how people find and use Product Weaver, and to improve it (analytics): our legitimate interest in knowing which pages help people and where they get stuck.
• To learn which parts of the plugin work (plugin usage statistics, only if you say yes): your consent, which you can withdraw at any time by stopping sharing.
• To let an invited person join a workspace: the legitimate interest of the person who invited them, and ours, in letting teams work together.
• To answer your messages: our legitimate interest in helping you, and our legal duty when you use a privacy right.
• To keep records of privacy requests: our legal duties.

We make no automated decisions about you that have legal or similarly significant effects.

What we never do

• We never sell your personal data, and never share it for advertising based on what you do on other sites.
• We never show ads.
• We never use your data or your content to train AI models, ours or anyone else's.

Who else handles your data

These companies handle personal data for us. Vercel, Neon and PostHog work under data processing terms that let them use it only to provide their service to us. Proton hosts our mailboxes. Google and GitHub run the sign-in under their own privacy policies, and learn that you signed in to Product Weaver.

We may also disclose personal data when the law requires it, such as a valid court order, or to protect someone's safety or our rights. If Product Expanse LLC is merged or sold, your data would pass to the new owner under this policy, and we would tell you first.

Where your data is stored

We are in the United States, and we store your data there: accounts and workspaces in Oregon, analytics with PostHog. If you use Product Weaver from another country, including from the European Union or the United Kingdom, you send your data to us in the United States.

Vercel, Neon (through Databricks), Google and GitHub each state that they comply with the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework. The data processing terms of Vercel and Neon also include the European Commission's Standard Contractual Clauses for data from Europe. PostHog's data processing terms cover data from Europe with the Data Privacy Framework or the Standard Contractual Clauses. Our email stays with Proton in Switzerland, Germany or Norway.

How long we keep it

When you delete your account

You can delete your account at any time in Settings, under Profile. We then delete, right away

• your profile, your sign-in link with Google or GitHub and its tokens, and your sessions;
• each workspace where you are the only member, with its invitations and audit log;
• invitations sent to your email address.

Workspaces you share stay with the other members. If you are the owner, the admin who joined first becomes the owner, or else the member who joined first. In those workspaces the audit log keeps its entries, without your account on them. Copies in database backups disappear when the backups expire (see the table above).

How we protect your data

• Every page is served over HTTPS only.
• The database is encrypted at rest (AES-256).
• There are no passwords to steal: you sign in with Google or GitHub.
• Only the people who run Product Weaver can reach the production systems, and every change in a workspace goes into its audit log.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to

• show you the personal data we hold about you, and give you a copy in a common format;
• correct it (you can change your name in Settings; your email address comes from Google or GitHub);
• delete it (in Settings, under Profile, or by writing to us);
• stop or limit a use of it you object to.

Write to privacy@productweaver.com from the email address of your account, so we know it is you. We answer within 30 days, free of charge. We will never treat you worse for using these rights.

In the European Union, the United Kingdom and Switzerland

You also have the right to complain to a data protection authority: in the European Union, the one in your country; in the United Kingdom, the ICO; in Switzerland, the FDPIC. We would be glad to hear from you first.

In California

The personal information we collect falls into two categories of California law: identifiers (name, email address, IP address and account IDs) and internet activity (server logs, sessions and analytics). We collect it from you, from your browser, and from Google or GitHub, for the purposes above. California law gives you the rights to know, delete and correct it, to opt out of its sale or sharing, and not to be treated worse for using these rights. We give these rights to everyone, as described above. We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you. We do not disclose personal information to third parties for their direct marketing (California's “Shine the Light” law).

Do Not Track and Global Privacy Control

We do not track you across other websites, and we let no one else do so on ours. Our analytics covers only this website, the app, and the plugin usage statistics you say yes to. So signals such as Do Not Track and Global Privacy Control change nothing here. We would treat Global Privacy Control as a request to opt out of sale or sharing, which we never do anyway. The plugin does honour DO_NOT_TRACK=1: it then records and sends no usage statistics.

Children

Product Weaver accounts are for people aged 18 and over. We do not knowingly collect personal data from children. If you think a child has given us personal data, write to us and we will delete it.

The earlier Product Weaver app

An earlier app at this address offered accounts. It closed on November 10, 2026. We keep its database until December 10, 2026, in case something must be restored, and then delete it. If you had an account there and want your data deleted sooner, or want a copy of it, write to us.

Changes to this policy

Before a material change takes effect, we email account holders at least 30 days ahead and post the new version here. For other changes, we post the new version here and change the date at the top.

• November 13, 2026. Adds anonymous plugin usage statistics, only if you say yes. Adds analytics with PostHog: without cookies before you sign in, with an analytics cookie after, and a record of AI crawlers that fetch pages.
• November 11, 2026. Names Product Expanse LLC. Covers accounts, workspaces, cookies, the companies that handle data, how long we keep it, account deletion and your rights.
• November 10, 2026. First version, for the website and the plugin.

Contact

Product Expanse LLC, Berkeley, California, USA.
Questions about this policy or about your data: privacy@productweaver.com.