Privacy Policy
Last updated October 2, 2026
The short version. We collect what we need to run Monocle: your name and email, your team's specs and comments, and the code Monocle reads from the repositories you connect. We send parts of that to AI providers so Monocle can do its job. We do not sell your data, we do not show ads, we do not use your content to train AI models, and the only cookies we set are the ones that keep you signed in.
1. Who we are
Monocle is operated by niteshft ("niteshft", "we", "us"). This Privacy Policy explains what personal information we collect through monocle.cloud, the Monocle web application, and the Monocle GitHub App (together, the "Service"), how we use it, and the choices you have.
For account and billing information, niteshft decides how the information is used. For the content your organization puts into Monocle, we process it on your organization's behalf and follow its instructions. If you are a member of an organization, the organization's owners control its workspace.
2. What we collect
Account information
- Your email address and display name.
- If you sign in with Google or Microsoft, the basic profile that provider shares with us: your name, email address, and an account identifier. We never receive your password.
- Your organization and project memberships, roles, and the invitations you send or receive.
Content you create
- Feature specs and their versions, comments, review conversations with Monocle's AI, and the accept or flag decisions you record, along with who made them and when.
Repository data
When an organization connects a repository through the Monocle GitHub App, Monocle reads data from it to check code against specs. That data can include:
- source files and diffs;
- spec files; and
- pull request and commit metadata, such as titles, descriptions, branch names, and author usernames.
Monocle also stores derived information, such as summaries of what parts of the code do and which specs they relate to.
Billing information
Payments are processed by Stripe. We never see or store full card numbers. We store the Stripe customer and subscription identifiers, plan status, renewal dates, and the invoice history Stripe gives us.
Access requests
If you request access on our website, we collect the name, email, company, and message you submit.
Technical information
- Server logs that record requests to the Service: the time, page or endpoint, response status, and the signed-in user's email.
- IP addresses, which our hosting and network providers process and which we use briefly in memory to limit abuse (for example, how often sign-in emails are requested).
- AI usage records (which feature ran, which model was used, token counts, and cost) so we can operate and bill for the Service.
3. Cookies
We use only the cookies needed to run the Service:
| Cookie | Purpose | Lifetime |
|---|---|---|
monocle_session | Keeps you signed in | 7 days, or until you sign out |
| Sign-in state | Protects the Google or Microsoft sign-in step | 5 minutes |
We do not use analytics, advertising, or cross-site tracking cookies.
4. How we use information
- To provide the Service: signing you in, showing your organization's specs, checking code against them, sending alerts, and recording decisions.
- To send transactional email such as sign-in links and invitations. We do not send marketing email unless you ask us to.
- To process subscriptions and payments.
- To answer access requests and support questions.
- To keep the Service secure, prevent abuse, and debug problems.
- To meet legal, tax, and accounting obligations.
We do not sell personal information, we do not use it for advertising, and we do not use your content to train AI models.
5. AI processing
Monocle's main features rely on large language models from third-party providers. When you use those features, Monocle sends the relevant spec text, comments, and code excerpts to one of the providers listed below and stores the response. The provider used for a task can change as we choose the best model for it. We use these providers through their paid business APIs, and each one processes the data under its own API terms.
6. Who we share information with
We share personal information only with the service providers that help us run Monocle, only as far as they need it to provide their service, and under terms that require them to protect it:
| Provider | What they do for us | Location |
|---|---|---|
| Render | Application hosting and database | United States |
| Cloudflare | Network delivery and security | Global |
| Anthropic | AI model processing | United States |
| Google (Gemini) | AI model processing | United States |
| GitHub | Repository access for connected repositories | United States |
| Stripe | Payments and invoicing | United States |
| Mailjet | Sending transactional email | European Union |
| Google, Microsoft | Sign-in, if you choose it | United States |
| Discord | Internal notification of new access requests | United States |
Inside an organization, members can see the content of the projects they have access to, including names attached to comments and decisions. We may also disclose information when the law requires it, to protect the rights or safety of our users or the public, or as part of a merger or acquisition. In a merger or acquisition, this policy would continue to apply to your information.
7. International transfers
niteshft is based in Canada, and the providers above may process information in other countries, including the United States and the European Union. Those countries' privacy laws may differ from yours. Where the law requires it, we rely on appropriate safeguards, such as contractual protections, for these transfers.
8. How long we keep information
- Account and workspace content is kept while the account or organization is active. After an account or organization is closed, we delete it within 90 days, except as described below.
- Sign-in links expire after 15 minutes, and sessions expire after 7 days.
- Access requests are kept as long as needed to respond and set up your account.
- Billing records are kept for as long as tax and accounting law requires, which is generally six years in Canada.
- Backups and logs are kept for a limited period and then overwritten.
9. Security
We protect information with encryption in transit (HTTPS), access controls that separate each organization's data, signed webhooks, and access limited to the people who need it to run the Service. No system is perfectly secure, but we work to protect your information and will notify you as the law requires if a breach affects it.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, or delete your personal information, to get a copy of it, or to object to or limit how we use it. These rights exist under Canada's PIPEDA, and where they apply, the GDPR, the UK GDPR, and US state privacy laws. To use any of these rights, email support@monocle.cloud. We will respond within 30 days.
If your information is part of an organization's workspace, we may refer your request to the organization's owners, since they control that content. You can also remove Monocle's access to your repositories at any time by uninstalling the GitHub App.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or to your local privacy authority.
11. Children
Monocle is a workplace tool and is not intended for anyone under 16. We do not knowingly collect information from children.
12. Changes to this policy
We will update this policy when our practices change, and we will change the "Last updated" date above. If a change is material, we will tell organization owners by email or in the app before it takes effect.
13. Contact
For privacy questions or requests, email support@monocle.cloud.