Punchlist

Privacy policy

Punchlist is operated by DENT Studios. Last updated 10 October 2026.

This policy says what personal data Punchlist (punchlistio.com) collects, why, who else handles it, how long it is kept and what you can do about it. Questions go to nick@rwfab.com. The terms of service cover the rest of the agreement.

  1. 1. What we collect

    • Your account: your email address, the display name you choose, and your password, which our sign-in provider keeps only as a one-way hash. If you sign in with GitHub, the email and name GitHub shares with us.
    • Your workspace: the boards, cards, acceptance criteria, notes, rules, batches and documents you and your teammates create, and their history: who changed what, and when.
    • Your agents: when you connect an agent such as Claude or Cursor, a record of each request it makes (the time, the tool, and whether it was allowed or refused). Its changes to your boards appear in their history under the agent's name.
    • Public feedback: if a board's owner shares its public feedback page, the people who send feedback or vote there give a name and an email address. These belong to that board's owner, who can see them.
    • The waitlist: an email address left on our home page, and which page it was left on.
    • Support messages: what you send from our support page: your email address, the name you give if any, what it is about and your message, and, if you are signed in, which account sent it.
    • Billing: for a paid plan, Stripe takes the payment. We keep the plan, Stripe's customer and subscription references, and the billing events Stripe sends us. We never see or store card numbers.
    • Technical data: the services we run on keep ordinary request logs, such as IP addresses and browser details, for security and reliability.

  2. 2. How we use it

    To run Punchlist for you; to send account emails (confirming an address, sign-in links, password resets); to send the What's new emails a board's owner publishes, to the people who asked for or voted on what shipped, each with a one-click unsubscribe; to bill paid plans; to answer support messages; to keep the service secure and fix what breaks; and to write to the waitlist about Punchlist.

    We do not sell personal data, we do not use it for advertising, and we do not use your workspace's content to train AI models. An agent you connect reads and writes your boards on your behalf; what that agent's provider does with what it reads is between you and that provider.

  3. 3. Who sees it

    The members of a workspace see its content. A board's public page shows only what its owner chooses to publish there. Agents you connect act with your access, in your workspace and nowhere else.

    These services process data for us, under their own security and privacy terms:

    • Supabase: database, sign-in and file storage (United States)
    • Lovable: builds and serves the punchlistio.com web app
    • Stripe: payments for paid plans; card details go to Stripe, never to Punchlist
    • Resend: sends account and What's new emails, and delivers support messages to us
    • GitHub: reports a board's CI results, when its owner connects a repository

    We disclose data to others only when the law requires it.

  4. 4. How long we keep it

    • Your account and your workspace's content: for as long as they exist.
    • Agent request records: 30 days.
    • Deleting a workspace: an owner can delete it in Settings. It is held for 7 days, during which the deletion can be cancelled; then everything it holds is removed from the live service. Copies remain in our backups until they age out: daily backups after 7 days and weekly exports after 12 weeks.
    • Deleting your account: write to nick@rwfab.com and we will remove it within 30 days.
    • The waitlist: until you ask us to take your address off it.
    • Support messages: 365 days.

  5. 5. Your choices

    A workspace owner can download everything the workspace holds, as one file, from Settings. Anyone can ask us for a copy of their personal data, or ask us to correct or delete it, by writing to nick@rwfab.com; we answer within 30 days. Every What's new email has a link that stops them. Depending on where you live, including the European Economic Area, the United Kingdom and California, you may have further rights over your data, and you can use them the same way.

  6. 6. Security

    Data travels encrypted. Every table is walled by workspace in the database itself, and before each release we run a check that tries to reach one workspace's data from another. Agent tokens are stored only as hashes, and a connected agent can be revoked at any time from the Rules page.

  7. 7. Where it is processed

    Punchlist runs on providers in the United States, and your data may be processed there and in other countries where those providers operate.

  8. 8. Children

    Punchlist is not meant for anyone under 16, and we do not knowingly collect their data.

  9. 9. Changes to this policy

    When this policy changes, the new version appears here with a new date. If a change matters to how your data is used, we will also email workspace owners before it takes effect.

  10. 10. Contact

    DENT Studios, the operator of Punchlist: nick@rwfab.com.