Privacy, without the fine-print fog.

Scopeleaf is provided by REL8 PIOTR SŁABOSZ (short name REL8), a sole proprietorship in Poland, at ul. Kampinoska 28/1, 05-082 Stare Babice, Poland (NIP 1181571869, REGON 142297754). We work from Poland, in the European Union, so the GDPR, the EU AI Act and Polish law apply to us. Write to us at kontakt@rel8.pl.

REL8 is the controller of your account, billing, analytics, error-report and support data. For what you and your guests write into a session, a prototype, a template, a project, a final document or a board, the host decides what goes in, and REL8 processes it on the host's instructions, as the host's processor. The processing agreement is in the Terms of Service, under Personal data in your content.

• To create your account, sign you in and run the service you asked for: your account details, your session content and your points. The legal basis is the contract with you (Article 6(1)(b) GDPR).
• To take payment and keep invoices. The legal basis is the contract (Article 6(1)(b)) and, for the tax and accounting records Polish law makes us keep, a legal obligation (Article 6(1)(c)).
• To run an AI feature when you ask for it. The legal basis is the contract (Article 6(1)(b)).
• To send an invitation when a host asks us to, and to answer the messages you send us. The legal basis is the contract, or our interest in answering people who write to us (Article 6(1)(f)).
• To answer a demo request you leave on the site and arrange the demo. The legal basis is the steps you ask us to take before a contract (Article 6(1)(b)) and our interest in answering people who write to us (Article 6(1)(f)).
• To keep the service secure, prevent abuse (for example, a second pilot for one account) and find and fix errors. The legal basis is our interest in a safe and reliable service (Article 6(1)(f)).
• To see how the product is used, so we can improve it. The legal basis is our interest in improving the product (Article 6(1)(f)). Analytics stores something on your device only if you accept it in the cookie notice (Article 399 of the Polish Electronic Communications Law), and if you reject it, nothing is sent to PostHog. See Analytics, errors and storage on your device.

Where we rely on our own interest, you can object at any time (see Your rights).

Drafts, suggestions, GrillMe questions and answers, refined documents, decisions, session activity, the snippets, links and files you keep in a document's Scrapbook, the files you attach in its Files window (the wide workspace) and the document's board, with its estimates, are stored in Convex to run the shared workspace; Convex runs this database and file storage for Scopeleaf in Ireland (AWS eu-west-1). A session is kept until its host deletes it or deletes their account; nothing is deleted because nobody used it. When the host closes a session, access ends for everyone else and the AI stops, but the content stays and the host can reopen it. When the host deletes a session, it is deleted straight away; an encrypted backup copy may hold it for at most ten weeks more (see How long we keep it).

Account records, billing records, and usage and cost records (see Accounts, plans, and billing) are separate from session content and remain after a session is deleted. Files you export and data already sent to a connected provider are also outside the session-deletion process.

Prototypes. When you build a prototype, Scopeleaf keeps the generated page, a copy of the ticket it was built from, the notes left on it and the first names link viewers give to leave a note, in your profile, until you delete the prototype or your account. Deleting the session does not delete the prototype. Password links stop working 30 days after your plan ends and work again when you resubscribe. Scopeleaf does not store who opened a link.

Templates, projects and analyses. A template you save from a document keeps a copy of its text, or only its headings if you choose, including what guests typed in it; closing or deleting the session does not delete the template, which stays until you delete it or your account. An import template you save while importing a Jira export keeps its name, which of the export's fields to import and a fingerprint of its column names, never what the fields hold, until you delete it or your account. A project keeps its name, the context you write for it, its colour and its glossary (each term, what it means and the words to avoid) until you delete the project or your account; a document filed in it leaves the project when the document is deleted. A dependency analysis stays until you delete it or your account, and is deleted as soon as any document it read is deleted.

Final documents. A final document you accept stays in your account until you delete it or your account. Closing the session does not delete it. It keeps the ticket's text as it was accepted, including what guests wrote in it, its title and which project you filed it in; only you, its owner, can open it. A conflict analysis of final documents is deleted when you delete any of the final documents it read.

Boards. A document's board is part of its session: it is closed, reopened and deleted with it. A project's board, a final version's board and a board you make from Home have a list of people of their own: the owner and everyone who joined by the board's link. Such a board keeps what those people put on it (notes, text, pictures and link cards), and a frame for each of the owner's documents on it: each document the owner filed in the project, on a project's board, and each the owner adds, on any of these boards. The frame keeps the document's title and its sections on notes, updated from the document each time the board is opened; what people change on the board never reaches the document. Everyone on the list reads those notes, and each document's estimate rounds and votes on the board. Being on the list opens no document. A document's host can add their other documents to its board the same way: the document's people read those copies, and a deleted document takes its frame and copy off that board too. A note someone copies from it is their own, like text they paste, and stays. The people on the list see each other's names and pictures, and a person without a name shows as “Someone”. Only the owner sees e-mail addresses, in the board's Share window, to manage the list. A project's or a final version's board stays until the owner deletes the project or the final version, or their account. A board made from Home stays until its owner deletes it or their account; deleting it ends everyone's access and its link at once. A document that is deleted takes its frame, with the copy of its sections and what was written inside it, off every board; one taken out of the project takes it off the project's board the same way. A picture taken off a board stays in storage until the board is deleted. A person who leaves or is removed comes off the list, and what they wrote stays; deleting your account takes you off every list. A dot vote on a board keeps who put a dot on which note only until the lead closes the vote or starts the next one: then the vote and its dots are deleted. A vote nobody closes is deleted with the board, and a deleted account's dots go with the account. Every board also keeps the comments its people write, with each author's name, until the board is deleted, and an author can remove their own comment before then. When you delete your account, your own boards go with their comments, and your comments on other people's boards stay, signed “Someone”. Comments are not sent to the AI. For a link card with an https address, Scopeleaf's server reads the page once for its title (at most 120 characters), and the card keeps the address and the title.

Second Brain. After each grooming, Scopeleaf keeps an AI summary in the host's Second Brain: what was agreed, what stayed open and the terms the team confirmed, with the document's title and the grooming's date, without the participants' names. It is made from accepted answers, open questions and confirmed terms, by the same AI providers as the rest of the product. It stays until the host deletes the item, all memory, or the account; closing the session does not delete it. The host sees and corrects every item in Profile → Second Brain, and the host's later groomings use it as background; guests never see the list. The AI may draw on it in sessions the host hosts.

These features send a prompt to an AI provider when someone asks for them: AI review and suggestions in the Draft, the check for missing sections, a developer's reading of the ticket (“Read as a developer”), the tidy-up after an import, GrillMe interviews and discussion, the proposed final version, a prototype build (when AI building is on), dependency and conflict analyses, the Second Brain summary, an answer about a Scrapbook item (“Prompt for” in the wide workspace), and cards from a document board's AI.

Scopeleaf sends the prompt to OpenRouter, a US company that routes it to a model provider, which also receives the prompt and processes the response. Depending on the action, the prompt can include the current document, session title, selected text, your instruction, template structure, GrillMe context, questions, and answers, and the Scrapbook item you asked about: its text, a link's address (the page itself is not fetched), or a text file's contents. For the board AI, the prompt includes the document's title and text and the board cards you selected, as text. Except for Summarise, it also includes the board's other notes, text and link-card titles (never a link's address), up to 50 of them and up to 100 characters of each, so the AI does not propose what is already there; cards the AI proposed that still wait to be added are left out. Summarise with nothing selected sends the board's notes, text and link-card titles instead, up to 50.

From the production service, every request asks OpenRouter to use only endpoints that keep no prompts or answers (zero data retention). OpenRouter's documentation says a provider that keeps nothing also cannot train on it. Two limits remain. OpenRouter chooses the endpoint, and it can be outside the EU, so we treat every AI request as a transfer outside the EU. And we rely on OpenRouter for which endpoints qualify: its agreement says this routing is not a guarantee that the model provider complies. We do not extend Scopeleaf's session deletion to copies a provider processes, and we do not train models on your content. Do not enter personal, confidential, or regulated information unless you are allowed to send it to those providers.

You are told when you deal with AI. A suggestion card is signed “Scopeleaf AI” with the name of the person who asked, the GrillMe interviewer is the AI, and the board AI's cards arrive in a frame labelled AI proposal that a person adds or discards. In the editor, text the AI writes carries a mark in the saved document: written by AI, reviewed or not, and endorsed or not by a person. The document's provenance bar counts the split. A Word download shows text nobody has reviewed as changes by “Scopeleaf AI”. A Markdown download made with review notes lists AI, unreviewed and human text. An HTML or plain Markdown download carries no mark, and neither does a board card once a person has added it. If you publish AI-written text to the public, you must say so where the law asks you to (Article 50(4) of the EU AI Act).

If the host invites their own agent (Share → Your agent), that agent can read the draft and propose changes. Where it runs, and who receives what it reads, is the host's choice and agreement with that agent's provider, not ours.

Clerk handles sign-in. Scopeleaf keeps the account identifiers and profile details needed to recognize you, apply the once-per-account pilot, prevent abuse, and operate the service.

With your account Scopeleaf also keeps a few settings that hold no content: the app's look you picked, which tours you finished, and which one-time tips about inviting your team you have already been shown, so a tip does not come back on another computer. They are deleted with your account.

When a host buys a plan or a top-up, Stripe receives the payment and billing details entered at checkout, including the billing address and any VAT ID, which Stripe uses to work out VAT. Scopeleaf stores Stripe identifiers, the plan, subscription status, and relevant dates, but does not store the full payment-card number.

Usage and cost records. For every AI step, Scopeleaf records the account that paid for it, the kind of step, the session it ran in, the points it spent, what the AI provider charged for it, and when; never its content. Your point balances and any points owed are recorded the same way. These are billing records: they stay with our subscription records, and deleting a session or your account does not delete them. A balance that has expired is removed within the hour.

Pilot links. When we invite someone to try Scopeleaf, we keep for each link a fingerprint of its code (never the code), a label for where we sent it, such as LinkedIn, and when it was made and when it ends. A link nobody used is deleted seven days after it was made. When you accept one, the link also records your account and when, and it is deleted with your account.

Votes on announced features. If you vote for an announced feature, we keep your score from 1 to 5, the reason you wrote, if any, and when, with your account. A new vote replaces the old one. We read votes with the voter's e-mail address to decide what to build next. Your vote is deleted with your account.

Requests when your points run out. If, in the window that opens when your points run out, you ask us for more points or tell us you are done for today, we keep the kind of request, the page of the app you sent it from and when you sent it, with your account, and we record when we e-mailed it to ourselves and when we closed it. We see it with your name, if you set one, and your e-mail address. The e-mail goes to our own address through Resend, with the same name and e-mail address, the request, the page and the time. A closed request is kept, and every request is deleted with your account.

Guests join free through a private session link. Anyone with a working link may be able to reach the join flow, so hosts should share it only with the intended team.

If a host sends an e-mail invitation, Resend receives the recipient's e-mail address, the session title, and the private join link to deliver that message. The session activity records a masked version of the recipient address and is deleted with the rest of the session.

If you ask for a demo on the site, we keep your work e-mail address, the name, company and message you chose to add, the page of the site you sent it from and when you sent it. You do not need an account. We e-mail the request to our own address through Resend, with your address as the one to reply to, and someone from our team writes back to you; we also see the request in our admin panel, where we mark it answered. To stop the form being misused we count requests per e-mail address and per visit, with a random identifier the page holds in its memory and does not store on your device. The request is deleted from our database 30 days after you sent it, and with your last request the count kept for your address goes too; the e-mail we received stays in our mailbox as long as we need it to answer you and arrange the demo.

Google Drive export is currently deferred and is not offered in the MVP. The Drive integration uses the Google OAuthdrive.file scope and sends the exported HTML ticket and its filename to Google Drive. That scope is limited to the specific Drive files you use with this app; it does not provide general access to every file in your Drive.

The exported file remains in your Google Drive after its Scopeleaf session is deleted. You control that copy through your Google account and can revoke the connection in your Google account settings.

If you connect Jira in Settings → Integrations, you sign in on Atlassian's own page and Atlassian gives Scopeleaf read-only access (the read:jira-work scope). Scopeleaf keeps the access and refresh tokens Atlassian issues, encrypted, with the names and addresses of the Jira sites the connection reaches and the one you picked. It does not ask for or store your Atlassian e-mail address, name, or avatar, and it never writes to Jira. It uses the connection only to read the list of your Jira sites when you connect, and the Jira tickets you choose to import.

The connection belongs to your account, not to a session. Disconnecting it in Settings → Integrations, or deleting your account, deletes the tokens straight away. You can also remove Scopeleaf from the connected apps in your Atlassian account.

If you connect your company's own Jira (Jira Server or Data Center), as well as or instead of Jira Cloud, you paste its address and a personal access token you create in that Jira. Scopeleaf checks the token once with Jira, then keeps it encrypted, with the address and the name Jira shows for you; it does not keep your Jira user name, e-mail address or avatar. The token works with your own Jira permissions, and Scopeleaf uses it only to read the tickets you choose to import. It never writes to Jira. Disconnecting it, or deleting your account, deletes the token straight away, and if Jira stops accepting it, Scopeleaf deletes it and asks for a new one. The token itself stays valid in your Jira until it expires or you revoke it there.

We replace people's names from Jira with Person 1, Person 2… before the text is saved, whether a ticket comes through a connection or from an export file you upload: every name Jira marks as a person (such as the reporter, the assignee, a comment's author or an @mention), wherever it appears in full and spelled as Jira spells it. A name Jira does not mark as a person, such as one written only in a ticket's free text, cannot be found reliably without AI and may stay, as may a first name on its own, a name written in different capitals, or a name in a CSV export's custom user field, which the CSV does not mark as a person.

On the home page you can try Scopeleaf without an account: you paste a link to a feature, such as a Jira issue, a GitHub issue or a public page, or the ticket's text. Our servers read that page once, only if it is public: they sign in nowhere and refuse addresses inside private networks. A Jira issue is read through Jira's own public answer for it, with people's names replaced as in the Jira import above. The text is sent to OpenRouter, with the same request for providers that keep nothing as every AI call, to make the ticket, suggestions for it, three questions, the final version, a prototype where that is switched on, and a summary.

We keep the demo under a random code that is in its page address; we store only the code's SHA-256 hash. With it we keep the host name of the page you gave (such as github.com), never its full address once it has been read, the ticket and everything the demo made from it, and your answers. When the import of pasted text failed, we keep that text until its one retry fails or the demo is deleted. We ask for no account, name or e-mail address, and the import is told to leave people's names out of the ticket; a page you paste can still name people. To allow each visitor two demos a day, we count them under a keyed hash of your IP address, never the address itself, and delete that count when the day ends (UTC).

A demo is deleted seven days after you start it, or at once when you choose Delete this demo. If you sign up and choose Keep this, it becomes a document and, where they are available, a prototype and a board on your new account, kept as described in Session content and retention, and the demo itself is deleted.

Unless you reject analytics, PostHog receives page views, browser and device information, your IP address, a random identifier (kept on your device only if you accept analytics), an opaque account identifier after sign-in, and explicit product events such as starting a plan or requesting an AI review. We use PostHog's US cloud. Autocapture and session recording are disabled. Analytics events do not include document content, feature titles, GrillMe answers, recipient e-mail addresses, or private invite codes, which are removed from page addresses before they leave your browser. After you reject analytics, your browser sends nothing to PostHog until you change your answer: from that moment no event leaves the page, and a page opened later does not load PostHog at all.

Sentry receives error reports and request metadata so we can keep the service reliable, and stores them in Germany. We scrub request bodies and document content from them and do not intentionally include document content in analytics or error logs.

The site's code can also load Google Analytics and Umami. Both are switched off today. If we switch either on, we will update this page first and ask for your consent where the law requires it.

What Scopeleaf stores on your device. On your first visit a cookie notice asks about analytics; Reject and Accept are equally easy, nothing is stored for analytics until you accept, and after a Reject nothing is sent to PostHog either.

• Always, because the service needs them: Clerk's cookies that keep you signed in; your answer to the cookie notice, in a cookie named scopeleaf_consent, for a year; the app's look you picked on your first visit or on Appearance, in a cookie named scopeleaf-app-theme, for a year; your panel layout, document skin and last workspace, whether your exported files end with the Scopeleaf line, and the board canvas's display settings with a random identifier of its own, in local storage; an unsent GrillMe answer, the identifier of a GrillMe request on its way, a dismissed notice and which out-of-points window the tab has already shown, in session storage until you sign out or close the tab; and, for a viewer of a password-protected prototype, a cookie for 7 days. None of these is used for analytics.
• Only after you accept analytics: PostHog's cookie, local-storage and session-storage entries that hold its random identifier, so your browser is recognised on your next visit, for up to a year; and, in local storage, the plan, billing period and time of a plan checkout you open, and after a purchase or a pilot a note that it was counted, with your account's identifier in the note's name, so analytics counts it once. Until you accept, PostHog keeps its identifier only in the page's memory.

You can change your answer at any time in Cookie settings, also at the bottom of every page of the site. If you reject analytics after accepting it, we remove what analytics stored on your device and stop sending to PostHog at once. We set no advertising cookies. You can also delete or block all of these in your browser's settings; blocking the sign-in cookies stops you signing in.

We use these providers. Each one gets only what its job needs, and processes it under its own agreement with us and its own privacy policy.

• Convex (Convex, Inc., United States) runs the realtime application and stores session content, account records and files. Our database and file storage are in Ireland. Transfers to Convex rest on the European Commission's standard contractual clauses in its data processing agreement.
• Clerk (Clerk, Inc., United States) handles sign-in and receives your e-mail address, name, avatar and sign-in details. It hosts mainly on Google Cloud and Cloudflare, in places it does not name. It is self-certified under the EU–US Data Privacy Framework, with the standard contractual clauses as the fallback.
• Vercel (Vercel Inc., United States) hosts the website and the app and sees the address and device details of each request. Its main facilities are in the United States. It is certified under the Data Privacy Framework, and its agreement holds the standard contractual clauses.
• Stripe (Stripe Payments Europe, Ltd in Ireland, with Stripe, LLC in the United States) takes payments and receives your name, e-mail address, billing address, VAT ID and card details. Stripe, LLC is certified under the Data Privacy Framework, and the agreement holds the standard contractual clauses.
• OpenRouter (OpenRouter, Inc., United States) and the model provider it routes to receive AI prompts (see AI and your content). OpenRouter's agreement holds the standard contractual clauses.
• PostHog (PostHog Inc., United States) receives analytics events. We use its US cloud, which runs in Virginia. The transfer rests on the standard contractual clauses.
• Sentry (Functional Software, Inc., United States) receives error reports. They are stored in Frankfurt, Germany; Sentry's account and support records are in the United States. It is certified under the Data Privacy Framework, with the standard contractual clauses as the fallback.
• Resend (United States) delivers invitation e-mails and receives the recipient address, the session title and the join link. It also delivers to us a request from the window that opens when your points run out, with your name, if you set one, your e-mail address, the request, the page and the time. It keeps its account data and logs in the United States. It also delivers to us a demo request you leave on the site, with what you wrote in the form and the page you sent it from. It is certified under the Data Privacy Framework.
• Cloudflare (Cloudflare, Inc., United States) carries the live view on a board: it passes what a person moves or types, with their account id, name and colour, to the others on that board while it happens, and stores none of it. It runs in Cloudflare's default placement, which is not limited to the EU. Transfers rest on the Data Privacy Framework, with the standard contractual clauses as the fallback.
• tldraw makes the canvas library of the board. While the canvas runs without a full licence, it sends tldraw the address of the page with the board open and your IP address. tldraw keeps them under its own terms.
• Atlassian, if you connect Jira, and Google, if you use Drive export, act under your own agreement with them. They are not our processors.

We do not promise that your data stays in the EU. We work from Poland and EU law applies to what we do, and our database runs in Ireland. But the providers above are mostly US companies, and some run in the United States. For a transfer to the United States we rely on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses where it is not, or if the Framework stops applying.

To get a copy of the safeguard for a provider, write to kontakt@rel8.pl.

Session content, prototypes, templates, projects, final documents, boards and the Second Brain: as set out in Session content and retention above. Your account record: until you delete your account. Billing records (payments and invoices): with Stripe, for as long as accounting law requires, which is five years in Poland. Usage and cost records and subscription dates: as set out in Accounts, plans, and billing. Messages you send us: as long as we need them to answer you and to show what we agreed. A demo request: 30 days in our database, as set out in Demo requests. A demo started from a link: seven days, as set out in The demo from a link.

Analytics events and error reports: for the retention period set in our PostHog and Sentry projects, which we choose so we keep them no longer than we need to measure use and to fix errors.

Backup copies: to recover from a failure, we may keep encrypted copies of the database, each for at most ten weeks, after which it is overwritten. Nobody uses them in the meantime. If one is ever restored, we delete again, before anyone uses Scopeleaf, every account and every session deleted since that copy was made, as far as our live records still show them; if they do not, we tell every host so they can delete those sessions again. For this we keep the id of a deleted session and the date it was deleted, nothing else, for 70 days. Other things deleted since that copy, such as a prototype, a template or a Jira connection, could come back with it; we would tell the people concerned, so they can delete them again.

You can ask us for access to your data and a copy of it, for correction of data that is wrong, for deletion, for a restriction on how we use it, and to receive the data you gave us in a structured form (for what you typed, the export is the way). You can object at any time to processing that rests on our own interest. Where processing rests on your consent, you can withdraw it at any time; what we did before is not affected.

To use a right, write to kontakt@rel8.pl. We answer within one month, and we may ask you to confirm who you are. For what you wrote in someone else's session, we help the host answer you, because the host decides what goes into it.

You can complain about how we handle your data to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the data protection authority of the country where you live or work. The Polish office takes complaints on paper or through e-Doręczenia, not by ordinary e-mail.

Giving us account details is required to use Scopeleaf: without them we cannot offer an account. What you put into a session is your choice. Analytics is not needed to use the product.

We take no decision about you that rests only on automated processing and has legal or similar effects. The AI proposes; the host or the operator decides.

Scopeleaf is a tool for professional work and is not meant for people under 16. Connections to Scopeleaf use HTTPS, and Jira tokens are stored encrypted.

When you delete your account, Scopeleaf deletes your prototypes, templates, Second Brain, final documents, projects and dependency analyses, the boards you made from Home and the boards of your projects and final documents, your Jira connections, the sessions you host (for everyone in them), your place in other sessions and on other people's boards, and your account record. What you wrote in other people's sessions stays until those sessions are deleted, or for as long as a template their host saved from that document keeps it, or a final document their host accepted from it keeps it (until that host deletes the final document or their account); an AI summary of what was agreed, without your name, stays in that host's Second Brain until they delete it or their account. What you put on someone else's board stays until its owner deletes the board they made from Home, the project or the final document it belongs to, or their account. Your notes on other people's prototypes stay, signed “Former member”. Your comments on other people's boards stay, signed “Someone”, until those boards are deleted. Scopeleaf keeps the subscription ids, status and dates it already stores and the usage and cost records (see Accounts, plans, and billing). We ask Stripe to end any subscription with the paid period; if you are still charged, write to kontakt@rel8.pl. Billing records (payments and invoices) stay with our payment operator, Stripe, for as long as accounting law requires. An encrypted backup copy may hold what was deleted for at most ten weeks more (see How long we keep it).

You can also request access to, correction of, or deletion of eligible account data, and ask questions about data handling, by emailing kontakt@rel8.pl.

If this policy changes materially, including when we add or replace a provider, we will update this page and the date above. We will provide additional notice when required by law.