Privacy policy

Who we are

Pending You is run by Record Plane Inc., a Delaware corporation (“Pending You”, “we”, “us”). This policy covers pendingyou.com, the Pending You app on any device, and the way assistants connect to it. To reach us about anything here, use the contact form’s “Privacy or my data” topic or email support@pendingyou.com.

What Pending You is

A queue for the questions your AI assistants need you to answer. An assistant you connected posts a question; you answer it on your phone or computer; your answer goes back to that assistant, which acts on it. The assistants are yours (Claude Code, Codex, Grok Bot and others): Pending You only carries questions and answers between you.

What we collect and why

Our rule is to collect only what we need to do that. In practice:

Your account

Your email address, and your name if you give one, so we can sign you in and know what to call you. When you sign up from one of our ad pages or campaign links, we keep which page and which campaign brought you (for example “l-coding-agents”, “google” and “cpc”) with your account, to count which ones bring people, never what you searched for or clicked.

Signing in, and keeping your account safe

The ways you sign in. A passkey: we keep its public key and a name for it; your fingerprint or face never leaves your device. A link and a 6-digit code we email you (either one signs you in, once): we keep only scrambled digests of them, the code stops working after 5 wrong tries, and both expire after 15 minutes. Google: if you choose it, Google tells us your account’s email address, name and ID (more in Google sign-in data). GitHub: if you choose it, we ask GitHub only to read your profile and email addresses, never your repositories. GitHub tells us your account’s ID, username, name and email addresses; we use only its primary, verified address, and we don’t keep the token GitHub gives us once we’ve read them. While a GitHub account is linked to yours, we keep its ID, username and that address, and when it was linked and last used, so it can sign you in and Settings can show which one it is; unlinking it deletes them. If no Pending You account uses the address you sign in with, we hold it (with Google or GitHub, also your name and that account’s ID, and GitHub’s username) for ten minutes while you decide whether to create an account, then delete it. We also keep a record of sign-ins and security events: each sign-in, refused attempt, sign-out, new passkey, and Google or GitHub account linked or unlinked, when it happened and which way you signed in. We count attempts by email address and IP address to slow down anyone guessing, but don’t keep your IP address in these records. They’re deleted after 90 days.

What your assistants post

Each question an assistant sends you: its wording, the choices and the assistant’s recommendation, and the details it adds so you can decide (what it did and tried, code snippets, drafts it wrote for you, links). The original a question is about, when the assistant sends it, such as the one email it concerns: its sender, recipients, date, subject, text and attachment names. Files it attaches: images, PDFs and text files. The areas it files questions under. Images inside an email stay hidden until you choose to show them, and then Pending You fetches them for you, so the sender doesn’t see your address.

Your answers

Your answers, what you write in a card’s reply box and the files you attach, and each card’s short conversation with its assistant. Before storing an image we remove its location and camera details. A record of each change is kept with them, so anything can be traced.

The assistants you connect

Each assistant’s name, the app it runs in, its settings (how it hears your answers, what files it can open), and the access you gave it when you connected it. If an assistant gives us a web address to call when you answer (a “wake-up”), we keep that address encrypted, and the call carries only ids and a link to the card, never your answer.

The apps you sign in

For each app you sign in to your cards (more in Apps you sign in to your cards): which app, the computer it’s on if it has one, what you allowed it, and when it signed in and was last used. Its answers and other changes are recorded with its name, like an assistant’s.

If you build apps

If you register an app in Settings › Developers: its name, website, redirect addresses, the permissions it may ask for, the privacy policy, terms and support email you give, when you proved your domain, and the sign-in addresses of the testers you name. Our reviewers see your app, never who its testers are.

Notifications

If you turn on notifications on a device, we keep the address your browser’s push service gave it (encrypted), a label such as “iPhone · Home Screen”, and your notification settings, such as a mute.

Dictation

When you dictate an answer, your browser’s own speech service turns your voice into words in the reply box. The audio goes to that service (run by your browser’s maker, such as Apple or Google), never to us. We only receive the words, if you send them.

Times you type for Later

When you put a card off to Later and type when (“thursday arvo”), Pending You reads the words itself. If it can’t, it sends just those words, with your local date, time and time zone, to TypeSafe AI, whose model picks out the day and time. Nothing from the card goes with them. You see the time before it’s set, and we don’t keep the words.

Suggestions when you delegate

When you delegate a question, a small AI model running inside Cloudflare (Workers AI) reads that card’s title and summary and your assistants’ one-line descriptions of their roles, to suggest which of them could answer; nothing it reads is kept, and it isn’t used to train any model.

Teams

When you invite someone to a team, the email address you type, who sent the invite and when. We keep only a scrambled digest of the invite’s link. The invite email names you, with your address, and the team, so the person can tell who it’s from. Everyone on a team sees each other’s name and email address, and the invites still waiting, in Settings › Team. When you hand a question to a teammate, a copy goes to their Pending You: the question, its choices and details, its files, the email it’s about if there is one, and your note. If they pass it on to one of their assistants, what the two assistants say to each other about it shows on both sides, under the assistants’ own names. Nothing else of yours crosses: not your other cards, areas, groups or settings, not the card’s conversation with its own assistant, and not which apps or computers your assistants run on.

When you share an answer or a heads-up with a teammate, we copy it into their Pending You: its title, the question you asked, the answer, where its data came from, your assistant’s name and your note. Nothing else of yours goes with it.

When you write to us

The contact form sends your name, email address, topic and message, the page you sent it from, and a short debug code: which version of Pending You the page was running, its address without anything after it, your time zone, your browser’s name and version, and the ids and results of the page’s last few requests to our servers, so we can find what went wrong. The code holds nothing you wrote and nothing from your queue. It becomes a ticket in our support desk (Freshdesk), as does any email to support@pendingyou.com or security@pendingyou.com. We keep that correspondence so we have the history if you write again, and delete it if you ask.

Running the service

Our servers log each request (when, which page or tool, the result, any error, and a random id for the request) to keep Pending You working. Our pages also report their own errors and failed requests to our servers, and for some visits three standard measures of how quickly the page loaded and responded. No one else receives these reports. They carry the page’s address without anything after it, the version and request ids, and error messages are cleared of anything that looks like an email address, a long number or a key, before they leave your browser and again when they arrive. We also keep running totals (how many requests, how fast, how many failed) that say nothing about who. None of it contains your questions, answers or files, what you type for a Later time, your email address, or sign-in codes, and we use it only to find and fix problems.

Cookies and your browser

We set the cookies signing in needs: one that keeps you signed in, ones that last ten minutes while you sign in with Google or GitHub, or decide whether to create an account, and short-lived ones that protect the pages where you let an assistant or a device connect. Your theme, reply drafts, and whether you’ve seen a tip stay in your browser’s own storage, not on our servers. Where Google measurement runs, it has cookies too: Google’s own, and two of ours that say it may run there and what you chose (described below).

Human checks

Cloudflare Turnstile checks that a person, not a bot, is signing in by email or sending the contact form. It looks at signals from your browser and tells us only whether the check passed.

Optional Google measurement

Pending You uses Google Analytics to understand visits to the site and use of the app, and Google Ads measurement to tell whether an ad led to a new account. Google Tag Manager loads them. Outside the European Economic Area, the United Kingdom and Switzerland, both are on unless you turn them off or your browser sends Global Privacy Control. Pending You works the same either way.

Where we don’t use it

We don’t use Google measurement at all for visits from the European Economic Area, the United Kingdom or Switzerland, or when we can’t tell where a visit comes from. If your browser sends Global Privacy Control, we don’t use Google measurement in it. Either way there’s nothing to turn off, and we don’t ask.

Turning it off

Use Privacy choices, at the foot of the site’s pages and in the app’s account menu and Settings (Data & privacy), to turn Analytics, Ads measurement or both off. Your choice applies to this browser; make it separately on another browser or device. Turning one off stops new reports for it from this browser at once and removes the cookies it set on our site; it doesn’t delete reports already sent.

What’s sent

With Analytics on, we send labels for pages and actions such as signing up, connecting an assistant or sending an answer. With Ads measurement on, we measure signup. These reports never include your name, email address, account or card ids, questions, answers, messages, files or sign-in codes, and we never give Google your name or email address for ads, not even scrambled. Page labels remove card and area ids, and omit private query values and every fragment. On the first measured page, we keep only public campaign labels (where the visit came from, the campaign’s name and, in plain words, an ad’s search term or label; never an address or link) and, with Ads measurement on, ad-click identifiers, to understand where the visit came from. We don’t use your Google sign-in information for measurement.

The tags may set browser cookies and collect general browser and device information. As with any connection to Google, Google receives your IP address when a request arrives. Our Google measurement doesn’t enable personalized ads or remarketing. Google handles measurement information under its privacy policy.

What’s kept

Where measurement runs, your browser keeps your choice, a cookie that records it, a cookie that says measurement may run there, Google’s own cookies for whichever is on and, with Analytics on, a random id the app’s reports carry. Google keeps the reports according to our Google service settings and its policy. Questions or deletion requests: the contact form’s “Privacy or my data” topic.

None of this changes the reports our own servers need to keep Pending You working, described under Running the service above.

Google sign-in data

If you choose “Continue with Google”, Pending You asks Google only to confirm who you are (the “openid”, “email” and “profile” permissions). It can’t see your email, files, contacts or anything else in your Google account.

What we receive from Google

• Your Google account ID, a number that tells your Google account apart from others.
• Your email address, whether Google has verified it, and, for a Google Workspace account, the domain it belongs to.
• Your name as it appears on your Google account.
• The address of your Google profile picture, which Google includes with your name. We don’t keep or use it.

How we use it

Only to sign you in, to show your name, and to show you which Google accounts can sign in to your account. If you don’t have an account yet and choose to create one, your email address becomes your account’s address. Your name becomes what Pending You calls you, unless you’ve already given one. We keep your Google account ID and email address linked to your account, with when it was linked and last used, so you can sign in with Google again and see which Google account it is in Settings; if you unlink it there, we delete them. Google’s sign-in tokens are used once to confirm who you are and aren’t kept.

• We don’t use it for advertising.
• We don’t sell it, and don’t share or transfer it to anyone, except the companies under Who helps us run it that store it for us so Pending You can work.
• We don’t use it to train AI models, and don’t let anyone else.
• No person at Pending You reads it, except as described in this policy.

It’s deleted when you delete your account, along with everything else (Deleting your account). You can also remove Pending You’s access from your Google account at any time, in your Google account’s connections.

Pending You’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we don’t do

• We never sell your information, and never have.
• We show no ads in Pending You, and our Google measurement doesn’t enable personalized ads or remarketing.
• We don’t train AI models on your questions, answers or files, or let anyone else: the developer terms forbid it to apps you sign in.
• We don’t send you marketing email unless you ask for it.
• We don’t use your name in our marketing without your permission.

When we look at or share your information

No person at Pending You looks at your questions, answers or files except in these cases:

• To help you, with your permission. If you ask for help and we need to look, we’ll ask first.
• To fix a problem. If something breaks partway through, we fix it without looking at your content whenever we can, and look at the least we must when we can’t.
• To keep Pending You safe. We look at logs and records (not content) to protect the service, and may look at an account when investigating abuse, as a last resort.
• When the law requires it. We share data with authorities only when compelled by valid legal process, such as a warrant or court order. We’ll tell you before we do, unless the law or an emergency stops us.

Your answers go to the assistant that asked, because that’s what you connected it for. What it and its provider (such as Anthropic, OpenAI or xAI) do with them is covered by their own terms and privacy policy. You choose what to tell them, and you can disconnect any assistant from the Assistants page.

When you hand a question to a teammate, they see what’s on it, and their answer comes back to you or your assistant the way you chose. Their answer is always marked as theirs.

Apps you sign in to your cards see what you allowed them, as described next.

If Pending You is ever sold or merges with another company, we’ll tell you well before your information is transferred or falls under a different policy.

Apps you sign in to your cards

Some apps work with your cards as you: they show you your cards and act on them when you press something in them. Pending You for Herdr is our own; other people and companies build others. Before you allow one, you see its name, who publishes it, whether we’ve verified it, and what it may do. It gets only what you allow:

• Your cards: the ones your assistants on one computer ask you, or every card if you allow that, with their details, files and conversations.
• If you allow it: answering cards, writing to an assistant on its card, putting cards in Later and bringing them back, and handing a card to another of your assistants.
• If you allow it: which of your assistants are running, and in which terminal, and keeping your phone quiet while you use the app.

No app can answer or act on a high-stakes card, or see or change your account, sign-in, billing or assistants. Apps other than ours are separate companies or people, with their own privacy policies and terms: what one keeps of your cards, and what it does with them, is up to its policy, which our review checks before we verify it. They agree to our developer terms: to use your cards only to serve you, never to sell them or train AI models on them, and to delete what they kept when you remove them.

Remove an app at any time in Settings › Apps and devices: its access ends at once. Removing a computer there signs out every app on it, and deleting your account signs out every app.

Who helps us run it

These companies process information for us, only to provide their part of the service:

• Cloudflare: hosting and network for the site, the app and the way assistants connect (Workers); the files you and your assistants attach (R2); short-lived sign-in and connection records (KV); the queue that sends notifications and wake-ups (Queues); sign-in and team invite emails (Email Sending); the Turnstile human check; Workers AI, which suggests which of your assistants could answer a question you delegate; and routing mail sent to support@pendingyou.com and security@pendingyou.com.
• Neon: our database (Postgres), which runs on Amazon Web Services in the United States (Ohio, us-east-2).
• Freshworks (Freshdesk): our support desk, where contact-form messages and support email become tickets.
• Google: sign-in if you choose to sign in with Google; Analytics, Ads measurement and Tag Manager unless you turn measurement off, and never for visits from the EEA, the UK or Switzerland or in a browser that sends Global Privacy Control. Sign-in information stays separate from measurement. More in Optional Google measurement.
• GitHub: sign-in if you choose to sign in with GitHub.
• TypeSafe AI: reads a Later time you typed when Pending You’s own reader can’t. It receives only those words (at most 200 characters) and your local date, time and time zone, never anything from your cards. TypeSafe says it doesn’t train models on what it’s sent; it doesn’t say how long it keeps it, so we send it only those words.
• Sentry (Functional Software, Inc.): error reports from the site, the app and our servers, so we can fix problems as they happen. A report says what went wrong and where in our code, never what’s on your cards or in your answers, and never your name, email address or IP address.
• Push services (Apple, Google, Mozilla, Microsoft): deliver notifications to the devices you turn them on for. Each notification is encrypted for your device, so the push service can’t read it. It says who is asking and the question, or only who is asking if you hide questions on the lock screen.

Where it’s kept

Pending You is offered to people in the United States, and your account and everything in it are stored and processed there. Cloudflare serves the site from its network of data centers, so a request may pass through one near you on its way.

Optional Google measurement is separate from your app account. Google operates globally and may process its measurement information outside the United States, as described in its privacy policy.

How long we keep it

• Your account: until you delete it.
• Questions (with the emails they’re about), answers and conversations: until you or your account delete them. Files on a card, yours and your assistants’: 90 days after the card is done, then deleted, and the card says the file was removed. A card still waiting on you keeps its files.
• Teams: an invite’s link works for 7 days. Once it’s taken, declined, withdrawn or expired, we delete it, with the address it went to, after 30 days. A copy of a question you handed a teammate stays in their Pending You until they delete it, even after one of you leaves the team; its files go when yours do. Who was on a team, and the record of what was handed to whom, stay until the account is deleted. A copy of an answer or a heads-up you shared with a teammate stays in their Pending You the same way, and the record of what you shared with whom, with your note, stays until the account is deleted.
• Files attached to a reply that’s never sent: a day. Sign-in links and codes work for 15 minutes. An address no account uses yet, while you decide whether to create one: ten minutes. Connection codes: minutes.
• Sign-in and security records: 90 days, then deleted. That’s sign-ins, refused attempts, sign-outs, new passkeys, and Google or GitHub accounts linked or unlinked; the emailed sign-in links, codes and passkey checks behind them; signed-in browsers, once they’ve signed out or expired; and the record of the notifications and assistant wake-ups we sent. A job checks every hour. When you made your account, and whether you gave us a name, stay until you delete it.
• Server logs and the pages’ error and speed reports: 30 days at most.
• Error reports in Sentry, which say nothing about who: 90 days at most.
• Running totals that say nothing about who: 3 months.
• Optional Google measurement: kept according to our Google service settings and Google’s policy. Turning it off stops new reports from this browser; it does not erase earlier reports. Contact us about those through the contact form’s “Privacy or my data” topic.
• Support conversations: kept in our support desk (Freshdesk) until we delete them. Ask and we delete yours within 30 days.

When anything is deleted it leaves our database at once. Our database keeps a short history so it can be restored after a mistake, and deleted data ages out of that history within 7 days. After that we can’t bring it back.

Deleting your account

You can delete your account yourself, at any time, in Settings under Data & privacy. It happens at once and can’t be undone. We delete every question (and the email it was about), answer, conversation and file, your areas, every connected assistant and its access, every app signed in to your cards, your notification devices and settings, your passkeys, Google and GitHub links and sign-in records, and your account, and sign you out everywhere. Apps you registered as a developer are deleted too, and everyone signed in to them is signed out.

If you’re on a team, we take you out of it first. Questions you were handed come back to the teammates who handed them, and their copies of questions you handed them are deleted. So are their copies of answers and heads-ups you shared with them. Your name stays on their own cards where you answered, so their history still says who. A team you own passes to its longest-standing member. Invites you sent, and invites sent to your address, are deleted.

We keep one record that an account was deleted and when, with nothing that says whose. Backups forget the rest within 7 days. Server logs, which never hold your content, expire within 30 days, and error reports in Sentry, which say nothing about who, within 90. Support conversations live in our support desk, apart from your account: ask through the contact form’s “Privacy or my data” topic and we’ll delete those too, within 30 days.

Your rights

Everyone who uses Pending You can ask us:

• To see what we hold about you, and get a copy of it.
• To correct anything that’s wrong.
• To delete it: yourself in Settings, or ask us.

Using any of these never changes how we treat you. Use the contact form’s “Privacy or my data” topic, or email support@pendingyou.com, and we’ll answer within 30 days. We may need to check it’s really you first, usually by writing to your account’s email address. The law in your state may give you more rights; ask and we’ll help.

How we protect it

Everything is encrypted on its way to us and while it’s stored. Sign-in codes and tokens are kept only as digests, so a copy of our database couldn’t be used to sign in as you. Files are private and open only through short-lived links. More on the Security & privacy page. If you find a security problem, please write to security@pendingyou.com; we reply within one working day.

Children

Pending You isn’t for children. You need to be at least 16 to use it.

Changes and questions

When this policy changes, we’ll update this page and its date. If a change matters to how we use your information, we’ll email you before it takes effect. Questions about this policy or your data: the contact form’s “Privacy or my data” topic, or support@pendingyou.com.