Privacy policy

Your account, the pages you write, and basic technical data to keep Pencil running.

Account. Your email address, your name and a profile picture if you add one. Sign-in is handled by Clerk, our account provider.

Your content. Pages, templates and files you upload, plus the structure around them like folders, favorites and your Pencil AI conversations.

Access requests. If you ask the owner of a private page for access, we keep the email address you enter so they can reply.

Technical data. Device and browser type, IP address and error logs. Our providers use these to keep your sign-in secure and to help us fix bugs.

To run Pencil for you. Not for ads, and we never sell it.

We use your data to provide the service: saving and syncing your pages, keeping you signed in and keeping your account secure.

We keep a running total of each account’s AI use so that no one goes over the daily limit. We do not build advertising profiles and we never sell personal data.

AI only runs when you ask, and only sees what that request needs.

What is sent. When you use Pencil AI, Ask Pencil or Describe it, your message and the parts of your workspace it needs to answer (the open page, and pages that match what you asked) are sent through OpenRouter to the model shown under the answer, from providers such as OpenAI, Google or DeepSeek.

No training. We do not use your content to train AI models.

Voice. Voice input is sent as audio to be turned into text. We do not keep the recording, only the text you choose to send.

Pages are private by default. Public pages can be read by anyone with the link.

When you switch a page to Public, anyone with the link can read it without an account. Search engines can only find it if you also let them.

You can make a page private again at any time. Copies that search engines or other people saved may take a while to disappear, and we cannot remove those for you.

Only the services that help us run Pencil.

Clerk runs accounts and sign-in, Convex stores your pages and files, Vercel hosts the website, and OpenRouter and the AI providers above answer AI requests. They may only use your data to provide their service to us.

Some of these providers are based outside the EU/EEA. When data is transferred, we rely on the EU Standard Contractual Clauses.

We share data with authorities only when the law requires it.

As long as your account exists. Deleted pages stay in History for 30 days.

History. Deleted pages wait in History for 30 days so you can restore them, and are then permanently deleted.

Your account. Ask us to delete your account and we delete your pages, files and personal data within 30 days.

Logs. Technical logs are kept only as long as our providers need them to run and secure the service.

See, export, fix or delete your data whenever you want.

You have the right to access, correct, export and delete your personal data, and to object to or restrict how we use it. Email us and we will help.

If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.

We’ll tell you before anything important changes.

If we make significant changes to this policy, we will let you know in Pencil before they take effect. The date at the top shows when it was last updated.

For the few cookies we use, see the Cookie policy. Questions about your privacy? Email privacy@pencil.so.