Skip to content
PINBOARD / THE DETAILS

Privacy Policy

Last updated: October 6, 2026

Version: October 6, 2026
Effective: October 6, 2026

This policy explains how Pinboard LLC ("Pinboard", "we", "us") handles personal information when individuals, and organizations and their people, use pinboard.ai, our desktop and mobile apps, our APIs and integrations (the "Service"), and when people visit our public website.

Pinboard is offered to individuals and to businesses and other organizations in the United States. It is not meant for anyone under 18.

1. Two roles we play

  • For your organization's workspace, we process content on behalf of the organization that owns the workspace (the "Customer"). The Customer decides who has access and what goes in. If you are a user in someone else's workspace, contact that organization about its own policies. We may refer your request to them.
  • For our own purposes, such as running accounts, billing, security and our public website, we are responsible for the personal information we collect.

2. What we collect

Account information. Your name, email address, password or sign-in method, optional profile photo, workspace memberships and roles. If you sign in with a third-party account (the sign-in options appear on our sign-in page), we receive basic profile information from that provider. If your organization uses single sign-on, we receive the details your organization's identity provider sends.

Workspace content. Everything you and your colleagues create or upload. This includes projects, boards, tasks, documents, wiki pages, chat messages, comments, files, tickets, CRM records, forms and time entries. It often includes personal information about other people, such as customers, contacts and meeting participants.

Recordings and transcripts. If you use meeting or voice features, we store the audio, transcripts, speaker labels and summaries in the workspace.

Connected services. If you connect an integration, we store the credentials it needs, and the records you import, sync or send through it, within the permissions you grant.

Billing information. Subscription details, the plan and seats you buy, invoices, payment status, and a record of the billing terms you agreed to. Card details are entered on our payment processor's secure page. They do not pass through or get stored on Pinboard's servers.

Usage and device information. How the Service is used: pages and features used, actions taken, and timestamps. Also device and connection details: IP address, browser, operating system and app version.

Error and diagnostic information. When something breaks, we log what happened. This includes errors in your browser while you are signed in. An error record can contain the error message, technical details, the page path (without query strings or access tokens), your browser details, your user ID and a partly hidden email address. Diagnostic records for AI features can include the prompts and responses involved.

Security and audit records. Sign-ins, sessions, permission changes and other security-relevant events, with IP address and browser details.

Communications. What you send us when you ask for access, contact support or reply to our emails. We also keep email delivery records, such as bounces and complaints.

Public website. If you visit pinboard.ai while signed out and choose Allow analytics, we collect analytics about page visits, where visits came from, and early-access requests (see section 7).

3. How we use it

  • To provide, maintain, secure and support the Service
  • To create and manage accounts and authenticate users
  • To bill for subscriptions and keep records of the terms customers agreed to
  • To run AI features and search (see section 5)
  • To send service emails, such as sign-in links, invitations, notifications, receipts, and renewal and cancellation notices
  • To find and fix errors and improve how the Service works
  • To detect and prevent abuse, fraud and security threats
  • To comply with law and enforce our Terms

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use workspace content for advertising.

4. Who we share it with

People you share with. Other members of the workspace, based on its permissions. Also anyone who can open content you publish or a public link you create, and the services you connect.

Service providers who help us run Pinboard. They may use personal information only to provide their services to us:

  • cloud hosting, database and file storage (in the United States);
  • content delivery, network security and bot protection;
  • email delivery (they receive the recipient, subject, message and any attachment);
  • payment processing;
  • AI model providers (see section 5);
  • map tiles and address lookup for CRM maps (they receive the map area viewed, or the account name and state being looked up, and your browser's IP address);
  • mobile push notifications, if you turn them on (they receive a device token and the notification text, which says who did what but not the contents of a message);
  • third-party sign-in providers that you choose to use.

Email support@pinboard.ai for the current list of named service providers.

Legal and safety. We may disclose information if the law requires it, or where it is necessary to protect the rights, safety or security of people, Customers or Pinboard.

Business transfer. If Pinboard is sold, merged or reorganized, information may transfer to the successor. This policy will continue to protect it.

5. AI features

Pinboard sends content to third-party AI model providers in three situations:

  • When someone uses an AI feature. This includes asking the assistant a question, generating a summary or recap, or having a bot reply. The request includes the content relevant to it, which may include workspace content, files attached to the request, conversation context and what the assistant remembers (see below).
  • Automatically, to make content searchable. When a note, wiki page, knowledge article or meeting transcript is saved, or a document is uploaded to a project or attached to a board item, sheet row, ticket or task, its text is sent to a provider to build the search index.
  • During a meeting, while the live meeting assistant is on. It sends recent transcript text to a provider to spot unfamiliar terms, questions and follow-ups, and to answer questions. When it looks something up on the web, it sends only the term or question, with at most a short phrase for context, and the AI provider runs the web search.

Chat messages are not indexed this way. They reach an AI provider only when someone invokes a bot by mentioning it or messaging it directly.

What the assistant remembers. The assistant can remember work facts about a project and your own preferences, but only after someone approves each one. People who can see the project can see its facts, and only you can see your preferences. They are included in later AI requests. People who can edit the project can remove its facts, and you can remove your preferences.

Records of AI requests. We keep a record of each AI request, including the prompt, the response and what the assistant looked up, for up to 90 days to find and fix problems. After that, we keep only usage figures, such as the model used and the amount of usage. Deleting an AI conversation, or the project a request ran in, removes this content straight away. Your conversations with the assistant stay until you delete them.

We use more than one AI provider and may route a request to any of them, including as a backup when one is unavailable. Pinboard does not use your content to train AI models. For paid workspaces, we send content only to AI providers whose terms with us do not allow them to train their models on it. Providers may keep content for a limited time under their own terms, for example for abuse monitoring.

AI output can be wrong. See section 7 of our Terms of Service.

6. Where data is stored and how we protect it

We host the Service in the United States. Some service providers may process information in other countries under their own safeguards.

We use administrative, technical and physical safeguards that are reasonable for our size and for the nature of the data. These include encryption in transit, encryption at rest for our primary database and file storage, role-based access controls, multi-factor sign-in options, and logging and monitoring. No system is perfectly secure.

If there is a breach. If we confirm that someone has accessed or acquired personal information without authorization, we will notify the affected Customer's workspace owner without undue delay. We will notify affected people, and government authorities, as required by applicable law, including New York's data breach notification law, and within the time limits those laws set.

7. Cookies and similar technology

In the app (always on, needed for it to work):

  • access_token: Authenticates your requests. Expires: 30 minutes.
  • refresh_token: Renews your session. Expires: 7 days.
  • pb_sessions: Lets you switch between signed-in accounts. Expires: 7 days, renewed when used.
  • csrf_token: Protects against forged requests. Expires: when the browser session ends.

Our network security provider may also set short-lived security cookies to tell people from bots. Some public forms run a bot-protection check that reads browser and device signals.

On our public website (only if you choose it): if you are signed out and click Allow analytics, an analytics provider sets cookies (_ga, _ga_*). These measure page visits, where visits came from, and early-access requests. We turn off advertising features. We do not send form contents, your email address or any workspace activity to analytics. We never load analytics inside the signed-in app. You can change your choice at any time with Cookie settings on the public website. Your choice, and the analytics cookies, expire after 180 days.

Local storage. The app stores preferences and interface state in your browser, such as your time zone, account switching data and dismissed notices. This stays until the app or you clear it.

Blocking cookies or clearing site data may sign you out or reset preferences. The payment and sign-in pages we send you to use their own cookies. The app does not respond to Do Not Track signals. Because analytics runs only when you opt in, the app does not track you across sites by default.

8. How long we keep information

  • Accounts: while the account is active. When you delete your account, a 30-day grace period starts. After it, we remove the details that identify you (name, email, username and photo), delete your sign-in credentials (password, passkeys, multi-factor recovery codes, sessions and API tokens) and disconnect your linked sign-in providers. We also delete what was private to you: your AI conversations, the assistant's memory of your preferences, your personal templates, your notifications and your personal integration connections.
  • Workspace content: while the workspace exists. Content you created in a shared workspace belongs to that workspace. It stays after your account is deleted, but is no longer linked to your name or email. Notes and files in your personal space also stay, unless you delete them before your account is deleted. Personal information that someone typed into the content itself is not automatically removed. When a subscription ends, we keep the workspace's content for at least 90 days, and we email the owner at least 30 days before we delete a workspace.
  • Error records: generally up to 90 days.
  • Records of AI requests: their content for up to 90 days (see section 5). Usage figures, such as the model used and the amount of usage, are kept for billing and capacity planning.
  • Security and audit records: up to 7 years, because they are the record of what happened.
  • Billing records: as long as tax and accounting law requires.
  • Backups: deleted data leaves our backups as they roll over.

We may keep information longer where the law requires it, or to resolve disputes, prevent fraud or enforce our agreements.

9. Your choices and requests

You can ask us to give you access to, correct, delete or export the personal information we hold about you, or to stop processing it in a particular way. Email support@pinboard.ai. We may need to verify your identity and authority first. If the request is about content in an organization's workspace, we may need to handle it with that organization, because it controls that content. We will not treat you differently for making a request. If you disagree with our response, reply with the subject "Privacy request review" and someone who did not handle the original request will review it.

10. Children

Pinboard is for people 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

11. Changes to this policy

If we change this policy in a material way, we will email workspace owners and show a notice in the app at least 14 days before the change takes effect. We will not use personal information we already hold in a materially different way without telling you first. The version date at the top shows the current version.

12. Contact

Pinboard LLC
30 Woodridge St, Albany, NY 12203, USA
support@pinboard.ai