Privacy

When you request an invite

We store your email address and which option you picked for who would use it. Nothing else is collected on that form. We use it to send you an invite and to size the batches we admit.

When you have an account

We store your account email and profile through Clerk, our sign-in provider. We store the wikis you create and their full edit history, in a private repository we host. The history is the product: every page keeps the record of how it got that way.

In a wiki you share, the other members can see your email address, your role, your discipline (the kind of work you do) and which changes you made. Its admins and curators also see the change requests you file.

Through the connector and the plugin

When Claude calls a CommonGround tool, we receive what that tool needs to do its work: the words to search for, the page to open, or the page being saved. We do not receive your conversation with Claude, only what Claude puts into a tool call, and we store no prompts and no conversations. What a tool sends back, the pages a question needs and in a shared wiki the email addresses of the members a tool names, goes to your Claude, which Anthropic runs under its own terms with you.

Beside the wiki itself we keep a small record of use: the first time a wiki answered you, the newest change you have been shown, which setup hint we last showed you, when each sign-in was last used, and which connected app or signed-in machine reached which wiki and when. On a team wiki, admins can see part of that last list, the Claude connectors approved for the wiki and the sign-ins made for another wiki that reached it, so they can revoke one. A change request you file is stored with your account as its author, and the history of a wiki records which account made each change. When an admin invites someone, we store the address they give and send the invitation to it.

The Claude Code plugin keeps your sign-in in a file on your own machine, outside your projects, and sends it with each request so we know it is you. On our side a sign-in is stored as a one-way hash, with its last four characters and a label so one sign-in can be told from another, for the plugin and the connector alike. When a session starts the plugin makes at most one call to us for each wiki the project reads, five at most. Where there is no wiki to read (a signed-in machine in a project not connected to one, or a connected project on a machine that is signed out) it instead asks us from time to time whether a newer plugin exists, sending only its version. Its calls carry the plugin’s version, and we store the latest one and the time beside your membership, so we can tell when a wiki is being read by an old version. If you keep a local copy, the wiki is a folder of files on your machine, which the plugin fetches from us and, when you ask, publishes back. The plugin talks to CommonGround and to no one else.

When we email you

Resend delivers our email: the invitation to a wiki, the note that your invite is ready, and notices about a trial or a payment. To deliver a message Resend handles your email address and the message itself, and keeps them under its own privacy policy.

When you pay

Stripe takes the payment. You enter your card and your billing address on Stripe’s own pages, not ours, so we never see or store a card number. Stripe is the processor for that data and keeps it under its own privacy policy.

What comes back to us and gets stored is the state of your subscription: which plan, how many seats, whether it is trialing, active, behind on payment or cancelled, when the period ends, and the country Stripe determined for tax. We keep the identifiers Stripe uses for your customer and subscription records so the two sides can be reconciled. We store no card details and no billing address.

Where it is stored

Railway runs the website and the service, and holds the wikis on a disk in the United States. Supabase holds the account database. It holds the records on this page that are not wiki pages: your email address, who belongs to which wiki, in which role and with which discipline, invitations, change requests, the waitlist and the access list, the state of a subscription, a copy of each wiki’s charter, the record of use described above and the record of what we did as operators. Clerk holds your sign-in: your email address, your password if you set one, and the link to your Google account if you sign in with Google. Clerk also runs the check that keeps bots out of sign-up. Resend and Stripe are described above.

Cloudflare answers the name lookups for our domain and forwards mail sent to hello@commongroundapp.io to our inbox. It does not sit in front of the site, apart from sending www.commongroundapp.io on to the main address. Beyond the people you share a wiki with, we share your data with no one but the providers named on this page, who handle it for us, and we do not sell it.

Analytics

None. This site sets no analytics or tracking cookies.

Cookies

The only cookies here come from sign-in. Clerk’s script loads on every page, this one included, so the site can tell whether you are signed in. On a first visit it sets a cookie that identifies your browser to Clerk and one that records that you are signed out. Both stay for up to ten years unless you clear them. Clerk runs behind Cloudflare, which adds two of its own to tell people from bots: one lasts half an hour and one until you close the browser. When you sign in, Clerk adds the session cookie that keeps you signed in. We use none of them to follow what you read, and no advertising or analytics service sets a cookie here.

How long we keep it

Your account and your wikis stay until you ask us to delete them. Nothing removes an account or a wiki for being unused. A waitlist entry, and the entry we make on the access list when we admit your address to the beta, stay until you ask us to remove them.

When we delete an account, we remove its record with us, every sign-in made with it, and every wiki only that account used, and we ask Clerk to delete the record it holds. A wiki you shared with other people stays with them, with the changes you made and the change requests you filed there, and you are removed from it.

When a wiki is deleted, its records leave the database at once. Its files are moved to a holding folder on the same disk, so a mistaken deletion can be undone, and they stay there until we empty it. That is done by hand, not yet on a schedule.

The disk that holds the wikis is backed up every day and every week. A daily backup is kept for 6 days and a weekly one for 27, so once the holding folder is emptied, a deleted wiki can remain in a backup for up to 27 days more. The account database has no automatic backups today.

We keep a record of what we did ourselves as operators: admitting an address to the beta, removing a waitlist entry, deleting a wiki or an account. That record outlives the thing it describes and has no end date. For an admission or a removal it includes the email address.

Our servers log each request: the time, the internet address it came from, the browser or app that sent it, the path it asked for and whether it worked. A search typed into the web app’s wiki viewer is part of that path. What Claude sends through the connector travels in the body of the request, which is not written to the log. Railway holds these logs and drops them after 30 days at most. Clerk, Resend and Stripe keep what they hold under their own policies.

Removal

Write to hello@commongroundapp.io, or reply to any email CommonGround sends you, and we will delete your waitlist entry, or your account and wikis.