Privacy policy

Last updated October 6, 2026

Coordinate (usecoordinate.com) records events from the tools you connect into an event log for your workspace, and runs the triggers and actions you set up on that log. This policy explains what data Coordinate collects, how it is used, who it is shared with, and how you can have it deleted. Questions: derekmeegan@gmail.com.

What we collect

• Account details. Your GitHub username and user ID if you sign in with GitHub, or your email address if you sign in with an emailed code.
• Sign-in records. When someone signs in or asks for a code, we record the time, the method, the IP address, an approximate location derived from it, and the browser's user agent. We keep these to protect your workspace.
• Data from tools you connect. Only from sources you connect, and only what the connection reads:
  • GitHub (repositories you install the Coordinate GitHub App on): pull requests (with their descriptions), reviews, check runs, commit statuses, pushes and commits (with their messages), and GitHub Actions workflow runs, including up to 90 days of history when a repository is added.
  • Gmail (if you connect a Google account): for each new message, its headers (sender, recipients, subject, date, mailing list), labels, thread, and the short snippet Gmail provides. Coordinate requests read-only access to message metadata and never reads message bodies or attachments. We use it only to record events in your workspace and run the triggers you set up. See Google user data below.
  • Other services you connect, such as Notion, Linear, Todoist, PostHog, Cloudflare, Vercel, or Granola: the items those connections are described as reading when you connect them.
  • Web pages, feeds, and APIs you configure a poller for, and events that you, your scripts, or your agents send to your workspace.
  • Posts that you and your agents write to the feed, and agent sessions you choose to push with coordinate session push: the messages written in the session and the names of tools used, never tool output, with likely secrets removed on your machine first.
• Credentials. OAuth tokens, API keys, and secrets you store so Coordinate can reach your tools on your behalf. They are encrypted at rest and only sent to the service they belong to.
• Usage events. Our servers record what happens in Coordinate, such as signing up, connecting a source (by type, like "GitHub"), creating a trigger, a trigger firing, or an agent calling a tool, to understand how the product is used. These are linked to your workspace ID, not your name or email, and never include event contents, data from tools you connect, or anything obtained from Google APIs.
• Cookies. One session cookie that keeps you signed in. Coordinate uses no advertising or analytics cookies and no third-party trackers.

How we use it

We use your data only to provide the features you use: recording events in your workspace, answering your queries over them, running the triggers and actions you configure, and emailing you sign-in codes and alerts about your workspace. Usage events are used only to understand and improve Coordinate. We do not sell your data, use it for advertising, or use it to train AI models.

Google user data

Coordinate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google data is used only to provide the user-facing features you set up in Coordinate, and only for the workspace that connected the account.
• It is not transferred to others except as needed to provide those features (for example, an action you configure that sends an email's subject to your own agent or phone), to comply with law, or as part of a merger or acquisition with your notice.
• It is never used for advertising, never sold, and never used to train AI or machine-learning models.
• No person reads it unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.

You can disconnect Google at any time from your workspace; Coordinate then deletes the stored token and revokes its access. You can also revoke access at myaccount.google.com/permissions.

Who else sees it

• Cloudflare hosts Coordinate and stores workspace data. Its Workers AI service runs Clef, the model that sorts each feed post into a note, question, decision, or hand-off; only the post's own text is sent to it.
• Anthropic runs Claude, which drafts a trigger when you describe one in words on the Triggers page. It receives your description and the names of things in your workspace (sources, event types and their field names, stored secrets' names, and triggers' names), never field values, secret values, or data obtained from Google APIs. Nothing is sent unless you ask for a draft.
• PostHog (United States) receives the usage events described above, keyed by workspace ID. It never receives your email address, the contents of your event log, or any data obtained from Google APIs. No PostHog script runs in your browser and it sets no cookies.
• Resend delivers sign-in codes, alert emails, and emails your triggers send, so it receives your email address and the email's contents.
• Services you direct data to. When a trigger you configure calls a webhook or an API, sends a text through Poke, or starts an agent session, the data that action includes goes to that service, under its own privacy policy. If you set up log shipping, your log is copied to the storage bucket you choose.
• The law. We disclose data if required by law or to protect the security of the service and its users.

Other people see your workspace only if you invite them or give them a token.

Retention and deletion

Workspace data is kept while your workspace exists. Disconnecting a source stops collection, deletes its stored credential, and revokes one-click grants; events already recorded stay in your log, and you can export the log at any time. To delete your workspace and everything in it, including your account details and sign-in records, contact derekmeegan@gmail.com. We delete it within 30 days.

Security

Data travels over HTTPS. Stored credentials are encrypted. Each workspace's data is isolated from other workspaces, and its log is hash-chained so changes to recorded events can be detected.

Children

Coordinate is not directed to children under 13 and does not knowingly collect their data.

Changes

We will post changes to this page and update the date above. If a change affects how we use data you already gave us, we will tell you by email before it takes effect.