Privacy policy
Last updated July 17, 2026
Checkpoint stores the state of your projects so your AI coding agents never start from zero. That job requires holding data you care about, so here is exactly what we collect and what we do — and don't do — with it.
What we collect
Account details: your email address, provided when you sign in. Authentication is handled by Supabase Auth; we never see or store passwords.
Project content: everything you or your agents write to Checkpoint — projects, features, legacy phases/tasks, build-log entries, decisions, bugs, questions, ideas, notes, and documents like PRDs.
Billing details: payments are processed by Stripe. Your card number never touches our servers; we store only your Stripe customer reference and subscription status.
Operational logs: standard request logs (timestamps, endpoints, status codes) used for debugging, abuse prevention, and rate limiting.
How we use it
To run the product: storing your project state, composing state digests, and serving them to your agents and your dashboard.
That's the whole list. We do not sell your data, we do not share it with advertisers, and we do not use your project content to train AI models — ours or anyone else's.
Auto-capture (the optional session-end hook)
If you install the session-end hook, then when a coding session ends it sends Checkpoint the tail of that session's transcript (roughly the last 30 turns, size-capped) plus lightweight git state: branch, recent commit ids and messages, and the file names of uncommitted changes.
That transcript tail is processed once by an AI model (Anthropic Claude, routed through Vercel AI Gateway) solely to distill a short build-log entry. We store only the distilled entry — the raw transcript is never written to our database — and it is not used to train models.
Auto-capture is opt-in by installation and easy to decline: skip the hook and nothing leaves your machine at session end. Your agent's own log_build / reconcile_session calls remain the primary path either way.
Where it lives
Your data is stored in a managed Postgres database (Supabase) and served through Vercel. Data is encrypted in transit and at rest by these providers.
Access to your projects is scoped to your account: your API keys and your login session are the only ways in.
Third parties we rely on
Supabase — authentication and database hosting.
Vercel — application hosting.
Stripe — payment processing for Pro subscriptions.
Anthropic (via Vercel AI Gateway) — distills auto-captured sessions into build-log entries, only if you install the session-end hook.
Each processes only what it needs to perform its role.
Retention and deletion
Your content stays until you delete it. Deleting a project permanently removes its state and history.
On the free plan, build-log entries older than 30 days are hidden, not deleted — they become visible again if you upgrade.
To delete your account and everything in it, contact us and we'll complete it promptly.
Contact
Questions about this policy or your data: sudarshan.venkateshv@gmail.com.