Privacy Policy

1. Information we collect

Account information

When you create or use a Windy account, we may collect information such as your name, email address, password, account settings, authentication method, and account status. Passwords are hashed before storage; plaintext passwords are not stored. Windy supports authentication methods such as password login, email magic link, OTP, Google login, and Apple login.

Organization, project, and membership information

Windy organizes work into organizations and projects. We collect and store information about organizations, projects, roles, memberships, invitations, permissions, and related metadata. This may include the names and email addresses of people who are members of an organization or project, along with their roles and access rights.

User content

Windy stores the content you and your authorized users create, upload, edit, or generate in the service. This may include software design documents, requirements, architecture notes, diagrams, plans, tasks, execution logs, file names, folders, versions, drafts, views, metadata, and other project materials. Windy's project model includes files, content, views, drafts, versions, plans, tasks, and executions.

MCP endpoint and agent-access information

Windy allows project-scoped MCP endpoints that coding agents can use to read and write project documentation. We may collect endpoint names, endpoint URLs, endpoint status, authentication settings, read-only settings, token previews, creation and revocation metadata, last-used timestamps, request metadata, and audit records. When MCP endpoint authentication is enabled, Windy stores a hash of the bearer token, not the cleartext token.

Billing information

If you purchase a paid plan, billing is handled through Stripe. Windy may store billing-related subscription metadata such as plan, status, seats, billing period, Stripe customer identifiers, subscription identifiers, and billing state. Windy does not directly collect or store payment card details; Stripe's hosted checkout and customer portal handle payment collection and payment-method management.

Authentication, security, and audit information

We collect information used to secure the service and diagnose misuse, including login events, password reset events, token refresh events, IP address, user agent, request context, audit logs, and authentication failure reasons. Some authentication events and access events are recorded for audit and security purposes.

Usage and analytics information

We may collect information about how users interact with Windy, including product usage events, sign-up events, feature usage, and diagnostic information. The Windy documentation references Mixpanel sign-up analytics.

Cookies and similar technologies

We may use cookies, local storage, or similar technologies to keep you signed in, remember preferences, secure sessions, measure usage, and improve the service.

2. How we use information

We use information to:

1. Provide, operate, secure, and improve Windy.
2. Create and manage user accounts, organizations, projects, files, plans, MCP endpoints, and memberships.
3. Authenticate users and protect accounts.
4. Enable coding agents to access project documentation through authorized MCP endpoints.
5. Process subscriptions, plan changes, seat limits, cancellations, and billing-related events.
6. Send transactional emails, such as login links, OTP codes, account confirmation emails, password reset emails, billing notifications, and service messages.
7. Maintain version history, drafts, audit trails, execution logs, and attribution.
8. Detect, prevent, and investigate abuse, security incidents, unauthorized access, and policy violations.
9. Analyze usage and improve product experience.
10. Comply with legal obligations and enforce our Terms of Service.

3. AI agents and project content

Windy is designed so humans and coding agents can work against the same project-scoped source of truth. Your authorized MCP endpoints may allow coding agents to read and, if configured, write your project documentation.

You control whether an MCP endpoint is authenticated and whether it is read-only. If an endpoint is created without authentication, possession of the endpoint URL may be enough to access it. Windy's documentation notes that unauthenticated read/write endpoints are not recommended because anyone with the URL may mutate project documentation.

You are responsible for configuring MCP endpoints carefully, sharing endpoint URLs and tokens only with trusted tools and people, rotating credentials when needed, and revoking endpoints that should no longer be used.

4. How we share information

We do not sell your personal information.

We may share information with:

Service providers

We use service providers to operate Windy, including infrastructure, hosting, storage, authentication support, email delivery, analytics, billing, monitoring, and customer support. The Windy documentation identifies or references providers and systems including AWS infrastructure, AWS Parameter Store, DynamoDB, S3, Stripe, Google login, Apple login, and Mixpanel analytics.

Organization and project members

Information inside an organization or project may be visible to users with access to that organization or project according to their role. Actor information such as name and email may be shown for attribution to users who share organizational or project access with the relevant actor.

Connected agents and tools

If you configure an MCP endpoint or connect an external coding agent or tool, that agent or tool may access the project content permitted by that endpoint. Windy does not control how third-party agents or tools process information after they receive it.

Legal and safety reasons

We may disclose information when we believe it is necessary to comply with law, legal process, enforce our agreements, protect the rights, property, or safety of LEKHAPP LLC, Windy, our users, or others, or investigate fraud, abuse, or security incidents.

Business transfers

If LEKHAPP LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction.

5. Data retention

We retain information for as long as necessary to provide Windy, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes.

Windy maintains version history for file content on eligible plans. File content edits may create drafts and immutable versions. Some deleted content may remain in version history, audit logs, backups, or records needed for security, billing, or legal compliance.

6. Deletion

You may request deletion of your account or certain data. Windy's self-service account deletion flow requires confirmation and may require cancellation of active subscriptions before deletion.

Deleting an organization or project may soft-delete related projects, files, folders, MCP endpoints, drafts, and versions. Some data may remain in backups, audit logs, billing records, security records, or other records we are required or permitted to retain.

To request deletion or assistance, contact info@windylogic.ai.

7. Security

We use technical and organizational measures designed to protect information. Windy uses authentication tokens, password hashing, access controls, role-based permissions, project-scoped MCP endpoints, hashed MCP bearer tokens, audit logging, and secure configuration management.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your login credentials, MCP endpoint URLs, MCP tokens, and connected agent configurations.

8. International processing

LEKHAPP LLC is a United States company. Your information may be processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws different from those in your location.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing is based on consent.

To exercise rights, contact info@windylogic.ai. We may need to verify your identity before fulfilling a request.

10. Children

Windy is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information to Windy, contact us.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by updating the “Last updated” date, posting a notice, sending email, or using another appropriate method.

12. Contact

For privacy questions or requests, contact:

LEKHAPP LLC
Email: info@windylogic.ai