Privacy Policy

Privacy at Weaves

Weaves is coordination infrastructure for AI coding agents. The product itself is local-first by design — your repository and coordination state stay on your machine. This policy covers something smaller and more concrete: what the weaves.dev website does with personal information today.

The short version, stated plainly:

• The website collects an email address — and optionally a company name and role — only when you submit the waitlist form.
• The website sets no cookies, runs no analytics, and loads no advertising or tracking scripts.
• We do not sell or share personal information for advertising or any other commercial purpose.
• We describe what the website actually does with verified operational practices.

Who We Are

This website and its waitlist are operated by:

We have not appointed a separate Data Protection Officer. Privacy inquiries, rights requests, and statutory notices are coordinated directly by the operating team via contact@getweaves.dev.

Scope

This policy applies to personal information processed through the weaves.dev website — its pages, its waitlist form, and the infrastructure that serves them.

It does not apply to:

• The Weaves product (the local-first Core, its agent surfaces, and any desktop application) when it becomes generally available. The product is pre-release and not distributed through this website; when it ships, its own data practices will be documented separately.
• Third-party websites or services linked from our pages, which have their own privacy practices.

If we later process repository contents, source code, Git history, agent activity, claims, conflicts, or local project state through any hosted service, that processing will be described in an updated policy before it happens. As of this version, the website does none of those things.

Information We Collect

A. Information you provide directly

The website has one form that accepts input: the waitlist form. When you join the waitlist, you provide:

We also store a record identifier and the date and time your entry was created. There is currently no separate contact or enquiry form on the website; the contact page directs enquiries to the waitlist form. If a direct enquiry channel is added, the information it accepts will be documented here first.

B. Information collected automatically

The website itself does not run analytics, does not set cookies, and does not use browser storage (localStorage or sessionStorage) for tracking. However, like almost any public website, the infrastructure that delivers and backs it may process standard request metadata — for example IP address, browser or device type, requested URL, and timestamps — in order to serve pages securely and to operate and defend the service. This metadata is generated by our hosting and database providers as a normal part of operating a secure web service; we do not use it to build behavioural profiles about you.

C. Information associated with Weaves product functionality

None is collected by this website. The Weaves product is designed to be local-first: its coordination state, repository observations, claims, and decision records live on the developer's own machine, next to the repository they describe. The website does not receive any of that data, and no product telemetry exists today. Any future hosted feature that changes this will be disclosed in an updated policy before it is enabled.

How We Use Information

We use the information described above only for the following purposes:

• Operating the website — serving pages and keeping the site functional.
• Processing waitlist registrations — recording your email (and optional company and role) so we can contact you about early access, and preventing duplicate signups.
• Responding to enquiries — the contact page routes enquiry-type information (role, company) through the waitlist so we can direct conversations.
• Communicating with you — emailing waitlist registrants when there is news relevant to early access. No automated marketing email program is currently operational; when email capability ships, this section will be updated to describe it.
• Security and abuse prevention — validating submissions against the server-side email format rule, enforcing duplicate protection, and defending against misuse.
• Debugging and service improvement — diagnosing failures of the form or infrastructure.
• Compliance with legal obligations — responding to valid legal process, where applicable.

We do not use personal information for advertising, behavioural targeting, profiling, or the training of machine-learning models.

Legal Bases for Processing

For processing in scope of GDPR-style rules, the bases we rely on, mapped to actual activities:

Under India's DPDP Act, 2023, processing on the website is grounded in your voluntary, informed consent given by submitting the waitlist form; see India — DPDP Act, 2023.

The Waitlist

The waitlist deserves its own description because it is the only place this website stores personal information.

• What is collected: your email address (required); company and role (both optional), exactly as listed in Information We Collect.
• Why: to hold your place for invite-paced early access and to contact you when the agent surface opens. Design-partner selection happens from this list.
• Where it is stored: in a dedicated database table (waitlist_signups) hosted by Supabase — a managed database service. Access controls on that table allow new signups to be written but deny read access to unauthenticated users, including any website visitor. Service credentials with read access are held only by the operators.
• It is not a newsletter. Joining the waitlist does not subscribe you to recurring marketing email. No automated email sending is currently implemented; see How We Use Information.
• How long it is kept: see Data Retention. Waitlist data is retained for the duration of the waitlist and early-access program, or until you request its removal.
• How to leave the waitlist: email contact@getweaves.dev from the address you registered and ask us to remove it. Removal requests are honored as described in Your Privacy Rights.

Third-Party Service Providers

These are the actual third parties involved in operating this website, identified from the implementation.

We do not use advertising networks, social media trackers, analytics platforms, or error-monitoring services on this website. If any of these are added, this section will be updated before they are enabled.

Cookies and Similar Technologies

Stated accurately: this website sets no cookies of its own and uses no local storage, session storage, fingerprinting, pixels, or similar technologies for tracking. The waitlist integration is configured with session persistence disabled, so it stores no authentication state in your browser. Because there are no non-essential cookies or trackers, the site does not display a cookie consent banner — there is nothing that would require consent.

Your requests for page resources (including Google Fonts) necessarily reveal your IP address to the servers that respond to them, as described in Third-Party Service Providers. This is transport-level behavior of the live web, not tracking we perform.

International Data Transfers

Waitlist data is stored in the Supabase project configured for the deployed website. The physical location of that project's servers, and the location of the hosting provider's servers, determine where your data is processed. Those locations are:

• Supabase project region: Managed Cloud Infrastructure (configured for waitlist services)
• Website hosting region and provider: Global Edge Network (Cloudflare)

Depending on those settings, information may cross borders — for example, data submitted from India or the EEA may be processed and stored in whichever region our providers operate. Where a transfer requires a legal safeguard mechanism (such as Standard Contractual Clauses for EEA-origin data, or a lawful mechanism under applicable statutory frameworks), we maintain appropriate vendor contractual commitments and technical safeguards. We do not claim a specific data-residency guarantee that has not been configured.

Data Retention

General principle we apply: personal information is kept only as long as it is needed for the purposes described in this policy — for waitlist entries, that means for as long as you remain on the list for early access, or until you ask us to remove your entry, whichever comes first.

Security

We apply measures appropriate to the small amount of data this website handles. At a high level, and without claiming absolute security:

• The site and its form submissions are served over HTTPS.
• The waitlist database enforces row-level security: anonymous users may insert a signup but cannot read the table; read access requires privileged credentials held by the operators.
• The database enforces an email-format check and a uniqueness constraint server-side, so malformed and duplicate entries are rejected at the storage layer.
• Only public, low-privilege browser credentials are used by the website; private keys that could read the table are never shipped to the browser, and secrets are kept out of the code repository.
• The site loads no third-party scripts beyond font files, which limits exposure to supply-chain compromise.

No system is perfectly secure. We do not claim certification, audit, or absolute protection, and none should be inferred from this section.

Your Privacy Rights

Depending on where you live, you may have some or all of the following rights with respect to the small amount of personal information this website holds:

Access / information

Ask what personal information we hold about you (in practice: whether your email is on the waitlist, and with what optional fields).

Correction / rectification

Ask us to fix inaccurate information in your entry.

Deletion / erasure

Ask us to remove your waitlist entry and any other personal information we hold about you, subject to limited legal exceptions.

Withdrawal of consent

Withdraw the consent you gave by submitting the form; the practical effect is deletion of your entry.

Objection and restriction

Where processing relies on legitimate interests, object to it or ask us to restrict its processing.

Portability

Where applicable, receive the information you provided to us in a structured, commonly used, machine-readable format (we can export your entry as JSON or CSV).

Grievance / complaint

Escalate to the applicable data-protection authority if you are not satisfied with our response — see the regional sections below.

How to exercise these rights: email contact@getweaves.dev from the address in question. We will respond within the timeframe required by applicable law, and in no case later than the periods noted in the regional sections. We do not charge for ordinary requests.

India — Digital Personal Data Protection Act, 2023

For individuals in India, processing is governed by the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025 as they are notified and enforced. Under that law, for the website's processing:

• Consent: submitting the waitlist form is a voluntary, informed consent to the processing described in this policy. Consent can be withdrawn at any time as described below.
• Data Principal rights: you may request information about the personal data we hold about you, its processing and its sharing; request correction and completion; request erasure; and nominate another person to exercise your rights in the event of your death or incapacity, to the extent the Rules provide for it.
• Grievance redressal: raise a request or grievance with us at contact@getweaves.dev. We are required to respond within the timeframes set by the Rules. If we fail to resolve your grievance, you may escalate to the Data Protection Board of India through the mechanism it specifies.
• This policy is written to be accurate under the DPDP framework; it is not a claim of certification or formal compliance status of any kind.

EEA and United Kingdom

If you are in the European Economic Area or the United Kingdom, we provide the following GDPR-style transparency. This website is not currently targeted at EEA or UK users, is not part of a GDPR-scoped commercial offering, and makes no claim of being "GDPR compliant." The information below is provided because accuracy is cheap and useful:

• Controller: estrategysocial — contact contact@getweaves.dev.
• Personal data, purposes, and legal bases: set out in Information We Collect, How We Use Information, and Legal Bases.
• Recipients: the service providers listed in Third-Party Service Providers.
• Transfers: described in International Data Transfers.
• Retention: described in Data Retention.
• Rights: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent (withdrawal does not affect processing already carried out). You also have the right to lodge a complaint with your local supervisory authority.
• No DPO: we have not appointed a Data Protection Officer and do not claim one. Questions can be directed to the privacy contact above.

California

For California residents, this section summarizes the personal information the website handles under the California Consumer Privacy Act as amended by the California Privacy Rights Act. These disclosures cover the 12 months preceding the "last updated" date above.

• We do not sell or share personal information. No "Do Not Sell or Share My Personal Information" link is provided because there is no sale or cross-context behavioral advertising — not because we have opted out of one.
• Your California rights: the right to know what personal information we collect, use, disclose, and retain about you; the right to delete it; the right to correct it; the right to limit use of sensitive personal information (we do not collect any); the right to non-discrimination for exercising these rights; and the right to withdraw consent where processing is based on consent.
• How to request: email contact@getweaves.dev. We will verify your request using information reasonably available to us — for a waitlist request, typically by asking you to write from the registered email address. Authorized agents may act on your behalf with your written permission. We aim to respond within 45 days, extendable once by a further 45 days where reasonably necessary.
• We maintain privacy practices for individuals under 16 as described in Children's Privacy; we do not have actual knowledge of selling or sharing the personal information of individuals under 16.

Children's Privacy

This website is directed at professional software developers and technical teams working with AI coding agents. It is not intended for use by children, and we do not knowingly collect personal information from children. The waitlist asks for a work email address and professional role; there is no functionality designed to attract users under the age of digital consent in their jurisdiction.

If we become aware that a child has submitted personal information through the website, we will delete it. If you believe this has happened, contact contact@getweaves.dev.

Changes to This Policy

We will update this policy when our data practices materially change — for example, when the website adds new forms, analytics, hosted product features, or new service providers. The revised version will be published at this URL with an updated "last updated" date above.

This page holds the current policy. We do not currently plan to email waitlist members about routine policy updates; if a change materially affects how existing personal information is used, we will consider notifying registrants directly. No previous version of this policy existed before V1 — this is version 1, and we do not backdate effective dates.

Contact

Questions, requests, and grievances about this policy or your personal information: