Privacy Policy

This Privacy Policy explains how WindOp, operated by Unknown Projects (“WindOp,” “we,” “us,” or “our”), handles personal information when you visit windop.app, download or use the WindOp desktop application, create an account, join a waitlist, buy a plan, use managed AI, contact us, or otherwise interact with related services (together, the “Services”). We act as the controller (or, under California law, the “business”) for the personal information described here.

This policy does not cover independent third parties. AI model providers, OpenRouter, Stripe, sign-in providers, MCP servers, Discord, Anthropic, OpenAI, and other integrations have their own privacy practices, which apply when you choose to use them. Our Terms of Service govern your use of the Services.

WindOp behaves differently depending on how you use it. Knowing which path you are on tells you almost everything about where your data goes.

“Local-first” never means “nothing ever leaves your device.” A prompt, file, or screenshot that you or an automation include in a task can be transmitted to whichever AI or integration completes it. Review what you attach before you send it.

Information you provide

• account details such as name, email address, profile image, and sign-in identifiers (including from Google or GitHub if you use them);
• your email address and chosen plan if you join a Pro or Team waitlist from our pricing page;
• support requests, feedback, and security reports;
• billing details such as plan, subscription status, purchase amounts, and invoices (Stripe handles your full card details; we never see or store them);
• prompts, messages, attachments, tool context, and outputs when you use managed AI; and
• credentials or tokens you choose to connect, used only as needed to provide that connection.

Information collected automatically

• website page views, navigation, clicks, browser, operating system, screen size, approximate location, and performance or error data, but only after you accept analytics;
• anonymous desktop usage analytics (such as app launches, feature usage, and model selection), tagged with a random install ID rather than your name, email, or account;
• first- and last-touch referrer and UTM campaign values, kept in your browser for up to 30 days and used to understand which links bring people to us;
• server request data such as IP address, user agent, timestamps, requested route, and security or rate-limit events;
• download-delivery records, meaning each time our server begins serving an installer, with approximate country and a de-duplication digest (this counts installer deliveries, not confirmed completed downloads);
• for signed-in users, authentication events, session and device identifiers, subscription state, credit balance and ledger, and managed AI usage metadata (model, token counts, cost, and request identifiers); and
• cookies and local-storage values described in the section on website analytics and cookies.

We do not intentionally store the text of your managed AI prompts or responses. Your requests still pass through our servers and OpenRouter in order to be answered, and the metadata above is retained for billing, abuse prevention, and reliability.

WindOp can read, create, edit, move, and delete files, run commands, inspect applications, capture screens, and use connected services when you ask it to or enable an automation. That activity happens on your device. It is transmitted off-device only when the task needs it, for example when file contents or a screenshot are included in an AI request, sent to an integration, or attached to a support report you choose to send.

We do not automatically receive your keystrokes, clipboard, local files, screenshots, or conversation database. Anything you deliberately include in a prompt or workflow can be sent to the AI provider, our managed AI endpoint, or the integration needed to complete it.

Secrets you save in WindOp are protected with the operating system’s facilities where available, such as Windows DPAPI or the macOS Keychain. Protection differs by platform and feature, so treat any credential you give an AI tool as something the tool can use.

WindOp supports many models and providers. With your own key, requests go from the app to the provider you configure. With managed AI, requests pass through WindOp’s API and OpenRouter, which routes them to the model provider you selected, using a per-account key we provision and limit to your balance. Request data can include prompts, earlier messages sent for context, images or files you attach, tool definitions and results, and technical metadata.

Retention and training practices differ between providers, and some models are served by third parties chosen by OpenRouter. We don’t control those practices. Read the relevant provider and OpenRouter policies before sending sensitive information. WindOp does not sell prompts or use your private desktop content to train our own general-purpose AI models.

AI output can be wrong or unexpected, and we do not use it to make legal or similarly significant decisions about you. If you use WindOp to process other people’s personal information, you are responsible for having a lawful basis to do so.

On windop.app we use PostHog for analytics only after you click Accept. It helps us understand page visits, navigation, clicks, conversion paths, broad device and browser information, errors, and performance, and, where enabled, session recordings with privacy masking. If you decline, PostHog does not load. Your choice is stored in your browser and we ask again after 90 days. You can change your mind sooner by clearing this site’s local storage, after which the banner returns.

Here is what the site stores in your browser:

Required server-side authentication and security events for signed-in users can be recorded even if you decline browser analytics. They do not include raw IP addresses and are sent to PostHog only if you accepted analytics. Browsers’ “Do Not Track” and similar signals are not needed to keep analytics off, because analytics start only after you opt in.

The desktop app can send anonymous, aggregate usage events (for instance that the app opened or that a feature was used) so we can measure reliability and adoption. Each install has a random ID generated on your device. We do not attach your name, email, account, or conversation content to these events, and we do not link the install ID to your identity. As with any internet request, the receiving servers see the network address the request came from.

This is on by default and you can turn it off at any time under Settings → General → Anonymous Usage Analytics. When it is off, the app sends no analytics events. Clearing the app’s local data creates a new random ID.

• provide, authenticate, and operate the Services and provision managed AI access;
• route AI requests, run the integrations you enable, and sync data if you turn on preview sync features;
• process payments, manage trials, subscriptions, refunds, disputes, and credits, and prevent billing abuse;
• secure accounts, detect fraud and misuse, enforce rate limits, and protect users and infrastructure;
• diagnose failures, measure performance, and improve the website and managed services;
• contact you about support, security, transactions, waitlists you joined, and policy changes; and
• comply with law and establish, exercise, or defend legal claims.

Where the GDPR or UK GDPR applies, we rely on: contract to provide the Services you request; consent for optional website analytics; legitimate interests in securing, improving, and supporting the Services and preventing fraud, balanced against your rights; and legal obligation for tax, accounting, and lawful requests. Anonymous desktop analytics rely on our legitimate interest in understanding product reliability, with an easy opt-out. You may withdraw consent at any time without affecting earlier processing.

We do not use personal information for solely automated decisions that have legal or similarly significant effects on you.

We disclose information to:

• AI and integration providers you direct us to use, including OpenRouter and the model providers behind it;
• Stripe, which processes payments, subscriptions, invoices, refunds, disputes, and fraud screening;
• infrastructure and service providers for hosting, authentication, analytics (PostHog), email delivery, security, and operations, under confidentiality and data-protection commitments;
• Cloudflare Turnstile, when a security check appears on sign-in, sign-up, or password-reset forms; it receives your IP address and browser signals to tell people from automated abuse;
• sign-in and connected platforms such as Google, GitHub, Discord, or MCP services when you connect them;
• authorities or other parties when reasonably necessary to comply with law or legal process, protect rights and safety, or investigate abuse; and
• a successor in a merger, financing, reorganization, or sale of all or part of the business, subject to appropriate protections.

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.

Local desktop data stays on your device until you delete it, reset the app, or uninstall it. For data we hold, we keep it only as long as reasonably needed for the purposes above:

Backups and logs can persist briefly after deletion. Providers such as Stripe, OpenRouter, and model providers apply their own retention schedules.

We use safeguards appropriate to the Services, including encryption in transit, access controls, hashing of IP addresses in auth logs, rate limiting, download screening, and operating-system secret protection in the app. Cloud sync is a preview feature: when you turn it on, synced categories are encrypted on your device with a key derived from a passphrase only you know, and we store only the ciphertext plus metadata such as category, version, device ID, device name and sync times. API keys, tokens and chat history are not synced. Chat backup is not offered yet. No system is perfectly secure.

If a breach affects your personal information, we will notify you and regulators as required by applicable law, including Pennsylvania’s Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.). You can reduce risk by keeping Windows and WindOp updated, using strong unique credentials, limiting tool permissions, reviewing automations, and avoiding sensitive data in prompts unless needed. Report vulnerabilities to [email protected].

WindOp is operated from the United States, and our providers process information in the United States and other countries. If you are in the EEA, UK, or Switzerland, your information is transferred to countries that may not offer the same protection. Where required, we rely on recognized safeguards such as adequacy decisions (including the EU–U.S. Data Privacy Framework for certified providers) or Standard Contractual Clauses.

Whatever your location, you can ask us to tell you what we hold about you, correct it, delete it, or give you a copy, and you can turn off optional analytics at any time. Depending on where you live, you may also have the right to:

• object to or restrict certain processing;
• withdraw consent;
• receive your data in a portable format;
• appeal a decision on your request; and
• complain to your data-protection authority, or to the California Privacy Protection Agency or your state attorney general.

Account export and deletion controls are still being built, so for now please email [email protected] and we will handle the request manually. We may need to verify your identity, and an authorized agent may submit a request for you where local law allows. We aim to respond within 30 days (45 days for certain U.S. state requests, extendable where the law permits) and will explain any limits. We will not discriminate against you for exercising your rights.

California and other U.S. states. We do not sell or share personal information as those terms are defined in the CCPA and comparable state laws, so there is no sale or sharing to opt out of. WindOp is a small operator and may fall below the CCPA’s revenue and volume thresholds; we extend the rights described here to all users regardless. Pennsylvania does not yet have a comprehensive consumer privacy statute, and we will update this policy if that changes.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them, consistent with the Children’s Online Privacy Protection Act and the FTC’s COPPA Rule (16 C.F.R. Part 312). If you believe a child has given us personal information, contact [email protected] and we will delete it. A higher minimum age applies where local law requires it.

We may update this policy as WindOp evolves. When we do, we will change the effective date above and, for material changes, give reasonable notice on the website, in the app, or by email.

Privacy requests: [email protected]. General support: [email protected]. Security reports: [email protected]. If you need a postal address for a formal notice, ask support and we will provide one.