Privacy Policy

Last updated: June 17, 2026

This Privacy Policy explains how Weekend Works, LLC ("Weekend Works", "we", "us", or "our"), the company behind Chatspaces, collects, uses, shares, and protects your personal information when you use the Chatspaces mobile app, website, and related services (together, the "Service"). It also describes your privacy rights and how to exercise them.

1. Who we are

Chatspaces is operated by Weekend Works, LLC, a limited liability company formed in Delaware, United States. For the purposes of the EU and UK General Data Protection Regulation (together, the "GDPR"), Weekend Works is the data controller of the personal information described in this policy. You can reach our privacy team at privacy@chatspaces.dev.

Chatspaces lets you launch and drive cloud-based coding sandboxes ("chatspaces", running on isolated cloud machines we call "sprites") from your phone. You sign in with GitHub, point a chatspace at one of your repositories, choose an AI coding agent (Anthropic's Claude or OpenAI's Codex), and the agent works on your code on a machine bound to that repository and branch.

2. Summary

3. Information we collect

We collect the following categories of personal information, almost all of it provided by you or generated as you use the Service.

3.1 Account & identity

When you sign in with GitHub, we receive your GitHub user ID, username, display name, avatar, and the email address(es) associated with your GitHub account. We store a profile record that holds your plan tier, your settings (such as default permission mode and notification preferences), and your consent choices for saving provider credentials.

3.2 Provider credentials you choose to save

To run agents on your behalf, the Service uses access credentials for the third-party services you connect:

• GitHub — an OAuth access token (and, where issued, a refresh token) used to list your repositories and to clone, read, and — when you instruct an agent to do so — commit and push to them.
• Claude / Codex — the OAuth credential blob for your Anthropic or OpenAI account, saved only with your explicit consent, so that future chatspaces can sign in to the provider without you repeating the login.

These credentials are bearer credentials for your accounts. We treat them as sensitive information: they are encrypted with application-layer envelope encryption before they are stored, access to them is logged, and you can revoke them at any time (see Your privacy rights and our Security page).

3.3 Chatspace & session data

For each chatspace you create, we store operational data needed to provision and manage it: the repository name and URL, the branch name, the cloud machine ("sprite") identity, status, the selected provider, your idle-stop and permission settings, the kickoff prompt you write to start the session, and live state reported by the on-machine agent (such as whether the agent is logged in, running, busy, or idle, the working tree's git status, and the provider account email/organization shown to confirm you are signed in to the right account).

3.4 Usage & metering

To enforce plan limits and bill compute, we record usage measurements for your sprites — CPU and memory ("GB-hours") consumption, awake time, and request counts, sampled over short windows. This is operational metering, not behavioral advertising or cross-site tracking.

3.5 Device & push notification data

If you enable notifications, we store a push notification token for your device (an Expo push token) and the platform (iOS/Android) so we can alert you when a running agent needs your input. We also process basic device and diagnostic information needed to operate the app and to investigate errors.

3.6 Environment secrets you provide

You may create named "environments" — bundles of environment variables (which may include your own API keys or secrets) that we inject into a sprite at startup. These values are encrypted at rest, access to them is logged, and we use them only to provision the sprites you ask us to.

3.7 Payment information

Paid subscriptions are processed by our payment processor, Stripe. We do not receive or store your full payment card number. We store billing-status identifiers (such as a Stripe customer/subscription ID, subscription status, and current period end) needed to apply your plan entitlements.

3.8 Communications & support

If you email us or contact support, we keep your messages and contact details to respond and to keep records of the request.

3.9 Website & cookies

Our website uses only what is necessary to function. We do not use advertising cookies or cross-site tracking. Our pages load web fonts from Google Fonts, which means your browser's IP address is shared with Google to deliver those fonts; aside from that and any storage required to operate the site, we do not set tracking cookies on the marketing site.

4. Your code, repositories & conversations

Your source code stays in your GitHub repositories and on the sprite provisioned for your chatspace. A sprite is a single-tenant machine bound to your repository and branch; it is destroyed when you delete the chatspace, and its working tree (including uncommitted changes) is destroyed with it. We do not maintain a separate mirror of your repository contents.

The actual conversation with the AI agent lives in the provider's domain — Chatspaces deep-links you into Claude (claude.ai/code) or Codex in ChatGPT rather than copying your chat. We preserve the machine, the session continuity, and the operational state described above; we do not store a mirror of your agent conversation. Prompts and outputs are processed by the AI provider under your own account (see the next section).

5. How & why we use information

We use personal information for the purposes below. For users in the EU/UK, the table also states our legal basis under the GDPR.

We do not use your code, prompts, or agent outputs to train machine-learning models, and we do not sell your personal information or use it for cross-context behavioral advertising.

6. AI providers (Claude & Codex)

This point is important to how Chatspaces works: the AI conversation and model usage run under your own Anthropic or OpenAI account, using the credentials you connected. As a result:

• Your prompts, your code context, and the agent's outputs are transmitted to and processed by Anthropic (for Claude) or OpenAI (for Codex) under your account, subject to that provider's terms and data-handling practices.
• Your use of Claude or Codex through Chatspaces is governed by those providers' own terms and usage policies, in addition to ours.
• We separately use Anthropic and OpenAI models, under our own accounts, to translate the agent's terminal output into the structured views shown in the app. That processing is limited to operating the Service.

7. Sharing & sub-processors

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share information only with the service providers ("sub-processors") that help us run Chatspaces, and only as needed to deliver the Service. Each is contractually required to protect your information consistent with this policy. We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the Service, and in connection with a merger, acquisition, or sale of assets.

We keep an up-to-date list of sub-processors on our Security page and aim to give notice of material changes.

8. International transfers

We are based in the United States and our sub-processors are primarily located in the United States. If you access the Service from the European Economic Area, the United Kingdom, Switzerland, or another region with data-transfer restrictions, your personal information will be transferred to and processed in the United States and other countries that may not provide the same level of protection as your home jurisdiction. Where required, we rely on appropriate safeguards for such transfers — principally the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss equivalent where applicable. Where a sub-processor is certified under the EU–US Data Privacy Framework, we may also rely on that certification. You may contact us at privacy@chatspaces.dev for more information about these safeguards.

9. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. After that:

• Account & profile data — deleted when you delete your account, subject to limited records we must keep for legal, tax, or fraud-prevention purposes.
• Provider credentials & environment secrets — deleted when you revoke them or delete your account.
• Chatspace records — deleted when you delete the chatspace; the underlying sprite and its working tree are destroyed at that time.
• Usage & metering records — retained as needed for billing reconciliation and then aggregated or deleted.
• Logs & diagnostics — retained for a limited period for security and reliability, then deleted or anonymized.

10. Security

We protect your information with encryption in transit (HTTPS/TLS) and at rest, application-layer envelope encryption for provider credentials and secrets, single-tenant isolation of sprites, least-privilege access, and audit logging of credential access. No method of transmission or storage is perfectly secure, but we work to protect your data and to respond quickly to incidents. For details, see our Security page.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access / know — request a copy of the personal information we hold about you and how we use it.
• Correct — ask us to fix inaccurate information.
• Delete — ask us to delete your personal information (see Deleting your account).
• Restrict / object — restrict or object to certain processing, including processing based on our legitimate interests.
• Portability — receive certain information in a portable, machine-readable format.
• Withdraw consent — withdraw consent (for example, for push notifications or saved provider credentials) at any time, without affecting processing already carried out.

EEA/UK (GDPR). You also have the right to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA). California residents have the rights to know, delete, and correct personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information, so no opt-out is needed. We use sensitive personal information (such as your saved account credentials) only to provide the Service you requested — a use that is exempt under the CPRA — so the "Limit the Use of My Sensitive Personal Information" right does not apply and no such opt-out is offered. We will not discriminate against you for exercising your rights. Over the past 12 months we collected the categories described in Section 3 — identifiers (e.g., GitHub ID and email), commercial information (subscription status), internet/network activity (usage metering and diagnostics), device identifiers (push tokens), and sensitive personal information (account log-in credentials) — for the business purposes described in Section 5, and disclosed them to the sub-processors in Section 7.

To exercise any right, email privacy@chatspaces.dev or use the in-app account controls. We will verify your request (typically via the email tied to your account) and respond within the time required by law. You may use an authorized agent where the law permits.

12. Deleting your account

You can delete your Chatspaces account at any time from within the app, or by emailing privacy@chatspaces.dev. When you delete your account we delete your profile and associated data, revoke and delete the provider credentials we hold for you, and tear down your sprites. You can also disconnect GitHub or revoke a saved Claude/Codex credential individually without deleting your whole account. Some records may be retained where the law requires (for example, financial records), and backups are purged on a rolling schedule.

13. Children

Chatspaces is not directed to children. You must be at least 18 years old to use the Service. We do not knowingly collect personal information from anyone under 18; if you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (such as in the app). Your continued use of the Service after an update means you accept the revised policy.

15. Contact us

Questions, requests, or complaints about privacy? Contact us at privacy@chatspaces.dev, or write to:

Weekend Works, LLC
Attn: Privacy
17528 228th Pl NE
Woodinville, WA 98077
United States