Privacy Policy

Last updated: October 2, 2026

Overview

Pipeworx connects AI to live data, so the answers you act on are grounded in facts you can check. Your questions are how we learn which facts we are missing, and closing those gaps is what we use them for. We never sell what you asked or use it for advertising. Pipeworx is operated by Mojibake Inc. This policy covers pipeworx.io and the Pipeworx API gateway. Our other services publish their own.

Information We Collect

Account Information

When you sign up through a supported identity provider we receive the username, email address and avatar URL that provider gives us, and we store which provider it was along with your display name. We also mint and store a Pipeworx API key for your account, and a Stripe customer identifier once you make a purchase. We do not store your password for any provider.

OAuth Connections

When you connect third-party services (e.g., Google Sheets, Salesforce, Jira, Slack), we store encrypted OAuth tokens to access those services on your behalf. Tokens are encrypted at rest using AES-256-GCM. We do not store your passwords for any connected service.

API Usage

We log every API request for rate limiting, billing, monitoring, and to decide which data sources to build next. A request log records the time, the tool name, the response status, how long the call took, the client user-agent, and an identifier for the caller. Tool names, timings and statuses are also written to the Pipeworx usage table in Supabase; the fuller request logs go to Cloudflare Workers Analytics Engine.

For ask_pipeworx we also store the first 200 characters of your question, next to the caller identifier. We replay requests to improve the service: the questions we answer badly, or cannot answer at all, are what tell us which source or tool to build next. We never sell it or use it for advertising.

We test different models and systems to get you the best answer to your question. Those include DeepSeek through OpenRouter, Claude, ChatGPT, Kimi, Jev, and others.

The model that picks a tool sees your question and the tools available to it. The model that writes your answer also sees what the tool returned. For search_within, the excerpt and your search query go to Cloudflare Workers AI, which turns them into an embedding so we can match them. We do not use your questions to train a language model.

The caller identifier is not anonymized. If you are signed in it is your Pipeworx account ID. If you authenticate with your own API key it is your IP address together with a SHA-256 hash of that key. If you call anonymously it is your IP address: the full address for IPv4, or the first 64 bits (the /64 prefix) for IPv6.

We evaluate requests to make the experience better. Those evaluation records carry no caller identifier. The playground at pipeworx.io/try keeps the question as typed, up to 2,000 characters, next to the answer we returned. We also keep a small sample of answers from gateway traffic, to check whether an answer was really about the thing that was asked about. Both expire after 14 days. Before either is stored we redact text that looks like a credential, and that is the limit of it: a question can still identify someone through its own content, and our redaction does not remove names, addresses or other personal details you typed.

If you ask us to remember something, we store it against your caller identifier. For anonymous callers it expires after 24 hours. For signed-in callers and callers using their own API key it has no expiry, and stays until you delete it with the forget tool or ask us to remove your account. The memory tools are not available through connector surfaces like the ChatGPT app.

We cache tool results for a short period, usually five minutes, to avoid asking a source the same question twice. A cache entry is keyed on the tool and the arguments, with credentials stripped out, so it is shared: if someone else asks a tool the same question while the entry is live, they are served the same stored answer. Do not put anything in tool arguments that you would not want returned to another caller asking the identical question. Calls that carry your own API key, and calls to private services, are not cached.

We publish aggregate activity. The pipeworx_trending tool and parts of the website show which tools and sources are being called and the total number of calls over a recent window. That is counts per tool and per source only. We do not publish questions, callers, identifiers or any one caller's history.

Before those records expire, the graded ones are copied into our answer-quality corpus, which is where the grading actually happens. In that corpus the grade is kept indefinitely but your words are not: the question, the answer and the retrieved payload are stripped from every record older than 60 days, leaving the verdict and the date behind. We keep the grade, not what you typed.

To produce those grades we send the question, the answer and the retrieved payload to Anthropic's API, which returns a verdict. No caller identifier goes with it.

Feedback You Send Us

When you send feedback we store the message (up to 2,000 characters), the context your client attached, and the caller identifier that sent it. If you report anonymously we also mint a claim token, so you can prove the report was yours later. After 180 days we remove the message, the context, the identifier and the claim token. What stays is the report id, what we decided, the commit that fixed it and the date we closed it, so that closing a report is still auditable after the words are gone.

Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or payment details directly. Stripe's privacy policy applies to payment data.

How We Use Your Information

  • To authenticate you and provide access to the Pipeworx gateway
  • To decide which tool can answer your question, and to improve that decision over time
  • To connect to third-party services you authorize
  • To enforce rate limits and usage-based billing
  • To monitor service health and prevent abuse
  • To find out which data sources agents ask for and we do not yet have, so we know what to build or licence next
  • To communicate important service updates
  • To grade the quality of answers we gave, so we can tell when we answered badly
  • To publish aggregate counts of which tools and sources are being called

What We Send to the Data Sources

Pipeworx is a gateway to other people's data, so the arguments you pass to a tool go to the source that answers it. A PubMed search sends your search terms to the US National Library of Medicine; a filing lookup sends the company you named to the SEC. We send only what the tool needs, and we do not attach your account identifier to it. Anything you put in the arguments still travels with the request, including information that identifies you or someone else, and the source's own privacy terms cover what they do with it.

Some tools return information about people other than you, such as a work email address or a professional profile. We pass that through from the source that publishes it; we do not build our own file on anyone. If you are one of those people and want us to stop serving your details, email us and we will remove you. Tools of this kind are not available on connector surfaces like the ChatGPT app.

Connector Surfaces

A connector such as the ChatGPT app reaches a surface built for public-data lookups. What we receive is the arguments of the tool call the assistant chooses to make, not your conversation with the assistant. Those arguments go to the source that answers them, and to the model providers that pick the tool and write the answer. What we return is the retrieved data, its source and a citation. We strip our own routing, billing and timing fields from this surface before it leaves. Afterwards we keep the request log and, for ask_pipeworx, the first 200 characters of the question, on the schedule set out under retention. The surface serves read-only lookups and takes no credentials, and tools that save memory, manage an account, set up alerts, change anything, or return information about other people are not available on it. Because it takes no sign-in, the caller identifier we log is the address of the assistant's own infrastructure, not yours, so we cannot connect a request on it to you.

Data Sharing

We do not sell your personal information. We share data only:

  • With the infrastructure providers that host and store our systems: Cloudflare (serving, request logs, caching), Supabase (database) and Upstash (rate-limit counters)
  • With the third-party data source that answers each tool call, which receives the arguments you supplied
  • With the model providers that pick your tool and write your answer (DeepSeek through OpenRouter, Claude, ChatGPT, Kimi, Jev, and others)
  • With Cloudflare Workers AI, for the embeddings search_within uses, which receives the excerpt and your search query
  • With Anthropic, to grade answer quality: the question, answer and retrieved payload, without any caller identifier
  • With third-party services you explicitly connect (using your encrypted OAuth tokens)
  • With Stripe for payment processing
  • When required by law or to protect our rights

Data Storage and Security

Data is stored on Cloudflare Workers KV, Cloudflare Workers Analytics Engine, Supabase (PostgreSQL), and Upstash (Redis). Daily rate-limit counters are held in Cloudflare Durable Objects and discarded when the day rolls over. OAuth tokens are encrypted at rest with AES-256-GCM. All data is transmitted over HTTPS.

Data Retention

Account data is retained as long as your account is active. On request we delete your account, your Pipeworx API key and your OAuth tokens. OAuth tokens are also deleted as soon as you disconnect a service. Playground and answer-sample records expire 14 days after they are written. Question, answer and payload text in the answer-quality corpus is stripped from records older than 60 days. Usage rows in Supabase keep the tool, tier and timing; the caller identifier is removed from rows older than 12 months.

One thing cannot be removed on request. Request logs already written to Cloudflare Workers Analytics Engine are append-only for us, so they age out on Cloudflare's three-month cycle and no sooner. To delete your account, remove a question or a feedback report, or ask for a copy of your data, email us at the address at the end of this policy and we will do it by hand.

Your Rights

You can:

  • Erase anything Pipeworx remembered about you by calling the forget tool, which deletes the stored value
  • View and manage your connected services on the account page
  • Disconnect any third-party service at any time
  • Email us to delete your account, your API key and your OAuth tokens
  • Email us for a copy of your data
  • Email us to have your own details removed from a tool that returns information about people

Cookies

We use a session cookie for authentication. We do not use advertising or cross-site tracking cookies. The operational analytics described in this policy run on our own infrastructure providers rather than an advertising network.

Changes

We may update this policy from time to time. Material changes will be communicated via the website.

Contact

For privacy questions or data requests, contact us at [email protected].