Privacy Policy

When you use pen.dev, we collect:

We use your information to:

• Let you sign in and personalize your onboarding
• Provide the cloud storage and sharing features you use
• Process subscriptions and payments, and apply plan limits
• Credit partners who refer new users to pen.dev
• Improve pen.dev based on how people actually use it
• Communicate about updates, new features, or policy changes
• Keep our systems secure and reliable

We use PostHog (US Cloud) to understand how people use pen.dev.

What we collect. PostHog collects usage data (e.g., clicks, time spent in features, device/browser information, and error logs). In our implementation, these events are linked to your profile so we can provide product analytics, support, and security. We do not use analytics to target advertising. We may also create aggregated or anonymized statistics that no longer identify you.

What we do not collect. Our PostHog implementation is configured to exclude user Inputs and Outputs from analytics events. This means no prompts, no AI-generated content, and no source code are captured by analytics. We use analytics only to understand feature usage, performance, reliability, and security signals — not to track your personal activity outside of pen.dev.

No sale of data. We do not sell or rent your data.

International transfers. PostHog is hosted in the United States. For users in the EEA/UK, we rely on appropriate transfer safeguards (Standard Contractual Clauses, and for the UK, the UK Addendum/IDTA).

Error monitoring. We use Sentry to detect and diagnose crashes and errors. Error reports include technical context such as IP address, user identifier, device and OS information, and stack traces. Our implementation is configured not to include your Inputs or Outputs in error reports.

Web analytics. We also use GoatCounter, a cookie-free web analytics service, to measure aggregate website traffic without collecting personal information.

Cookies and similar technologies. Our website and web app use cookies and browser storage that are needed to keep you signed in and to remember your settings. On the pen.dev website, PostHog also stores an identifier in cookies and browser storage to recognize returning visitors. In the web app (app.pen.dev), analytics stays off until you accept the cookie notice. You can block or delete cookies in your browser settings; sign-in and other essential features may then stop working.

Referral attribution and marketing measurement. On pen.dev and docs.pen.dev, marketing measurement stays off until you accept the cookie notice. If you accept, we store cookies that expire after 30 days. They hold an anonymous visitor identifier and, where present, the referral or affiliate code, advertising click identifiers and campaign (UTM) parameters from the link you followed, and the address of the external page you came from. We then send a record to our referral partner, Evangelist, when you view our marketing, sign-up or sign-in pages, create an account, sign in, download the app, or make a purchase, so that we can measure our marketing and referrers can be credited. The record contains the information from those cookies (the visitor identifier in hashed form), the address of the page, your IP address and browser user agent, and, where available, hashed forms of your account identifier and email address, the operating system of the app you downloaded, the purchase amount and currency, and Meta (Facebook) click identifiers already stored in your browser. If you sign up or make a purchase after arriving through a referral or affiliate link, we also record that event, including the purchase amount and currency, in our product analytics. If you decline the cookie notice, we do not store these cookies, we delete any that were stored earlier, and we send nothing to Evangelist. We keep your choice in your browser, including in a cookie that lasts one year, so that we do not ask again.

Google Ads conversion measurement. If you accept the cookie notice, we also load Google's advertising tag (gtag.js) on the pen.dev marketing pages and on our sign-up and sign-in pages, and we report to Google Ads when an account is created (as a conversion with a nominal value of USD 1), so that we can measure which of our advertising campaigns lead to sign-ups. Google uses its own cookies and identifiers for this and receives the address of the page you are on, your IP address and browser user agent, and advertising click identifiers from the link you followed. We do not send Google your name or email address. Google's handling of this data is described in Google's privacy policy. If you decline the cookie notice, the tag is not loaded.

pen.dev uses third-party services to generate, edit, or source images and SVG graphics, including Google Gemini, OpenAI, Quiver AI, Recraft, and Unsplash.

How the image and SVG flow works. Image- and SVG-related features operate differently from text-based AI features and hosted AI models. When you use image generation, SVG generation, image editing (such as background removal or vectorization), or stock-image features, your request and any content you intentionally submit, including an image you choose to edit, are transmitted through High Agency, Inc. servers to the relevant third-party provider. This transmission is the minimum technically necessary to fulfill your request and is performed in real time. We do not store, record, log, or cache this content on our servers — it is forwarded to the third-party provider and the response is returned to you along the same path. For image editing, the provider makes the edited result available at a temporary address, from which your device downloads it directly. For stock image search (Unsplash), pen.dev's agent generates search queries derived from your project context; your prompts are not transmitted verbatim to Unsplash.

Third-party retention. Once forwarded, content is subject to the third-party provider's own terms, privacy policies, and retention practices. We do not control, and are not responsible for, those practices. Your use of third-party services is also subject to the providers' own licensing terms, including any attribution or usage requirements.

International transfers. Image providers may process data outside the EEA/UK. We rely on appropriate transfer safeguards (e.g., Standard Contractual Clauses) where required.

Some pen.dev features let you save files to your pen.dev workspace or share your work with others. These features work differently from the AI request flows described above: content you deliberately save or share is stored on our infrastructure (Google Cloud Platform, in the United States) so we can provide these features.

What we store. When you use cloud or sharing features, we store the files and designs you save to your workspace (including their version history), preview thumbnails we generate from them, export archives you create, share links, and comments posted on shared files (including the commenter's name, the comment text, any images attached to the comment, and — for signed-in users — their account identifier).

This applies only to content you deliberately save or share using these features. The commitments above remain unchanged for everything else: AI requests continue to pass through in real time without being stored, and files you work with locally stay on your device.

Who can access shared content. By default, anyone with a share link can view, comment on, and download the shared file. Where available, sharing controls let you restrict access — for example to your organization or workspace members, specific people, or email domains — and choose what recipients can do (view, comment, or download). Restricted links require the recipient to sign in with a pen.dev account, Google, Microsoft, or a one-time code sent by email; we then process the recipient's email address and sign-in identifier to verify access and keep them signed in.

Comment notifications. When someone comments on a file you shared, we may email you a summary that includes the comment text and the file name. You can manage these emails in your account settings.

Deletion. You can delete stored files, versions, shares, and comments at any time. Deleted files and shares move to the workspace trash, where a workspace owner or admin can restore them or delete them permanently; permanent deletion removes them from our storage. Deleted comments are no longer shown. Deleting your account permanently deletes the content of your personal workspace and the shares you created, and removes your comments from shared files; content you saved in an organization's workspace stays with that organization.

Email. We use Twilio SendGrid to send onboarding, product communications, and transactional emails (e.g., access confirmations, account notifications, and comment notifications). To send product communications, we keep your name and email address in a contact list with this provider. You can unsubscribe from marketing emails anytime using the link inside the email. Transactional emails necessary to provide the service may still be sent.

Sub-processors. We share personal data with sub-processors acting on our instructions. A current list of our sub-processors and their purposes is maintained at pen.dev/sub-processors. We update that list prior to engaging any new sub-processor.

Data handled. These sub-processors process account data and operational metadata (e.g., email addresses, authentication tokens, usage events, error logs). Our infrastructure providers also store the cloud files and shared content described in Section 4b, our email provider delivers comment notifications that include comment text, and our payment processor handles the billing details described in Section 1. Sub-processors do not receive or store Inputs/Outputs from text-based AI features used with your own provider accounts, which are exchanged directly between your device and the relevant third-party AI provider. Where you use hosted AI models, your Inputs and Outputs pass through our servers in real time to the model hosting provider identified at pen.dev/sub-processors and are not stored by us. Image, SVG, image editing, and stock image requests transit through our infrastructure in real time but are not stored.

Safeguards. We do not sell or rent your data. We enter into data-processing agreements with all sub-processors and require appropriate security measures. International transfers from the EEA/UK rely on Standard Contractual Clauses (and, for the UK, the UK Addendum/IDTA) or another valid transfer mechanism.

Data Processing Agreement (DPA). For regulated, enterprise, or business customers requiring a signed Data Processing Agreement, please contact hq@pen.dev.

Inputs and Outputs. Inputs and Outputs from text-based AI features used with your own provider accounts are not stored on our servers — they are exchanged directly between your device and the relevant third-party AI provider. Inputs and Outputs from hosted AI models pass through our servers in real time on their way to our model hosting provider and are not stored, recorded, logged, or cached on our servers. Image, SVG generation, image editing, and stock image requests likewise transit through our infrastructure in real time and are not stored, recorded, logged, or cached. Inputs and Outputs may be stored locally on your device (e.g., localStorage or filesystem), and you can delete them by clearing local storage or removing local files.

Security. Account data, operational metadata, and the cloud files and shared content described in Section 4b are stored securely using modern encryption (in transit and at rest) and access controls. We keep data only as long as needed to run pen.dev or as required by law.

Deletion requests. If you delete your account or ask us to remove your information, we will do so within a reasonable timeframe unless we are legally required to retain it.

Typical retention periods

The retention periods below apply to account data, operational metadata, and cloud files & shared content. They do not include Inputs/Outputs from text-based AI features or hosted AI models (not stored on our servers) or image, SVG, image editing, and stock image content (forwarded in real time, not retained).

Where legally required or necessary to establish, exercise, or defend legal claims, we may retain limited data for longer.

We may update this Privacy Policy from time to time.

If we make major changes, we'll post an update here or notify you directly.

Data controller. For the purposes of GDPR and UK GDPR, the controller of your personal data is High Agency, Inc.

Email: hq@pen.dev

For data subject requests (access, rectification, erasure, portability, objection, restriction, or withdrawal of consent), please contact us at hq@pen.dev with the subject line "Data Subject Request."