Privacy Policy

1. Who We Are

Pact ("Pact," "we," "us," or "our") is an independently operated Slack application that helps teams create and track commitments. You can reach the operator at hello@makepact.co.

2. Data We Collect

When you install and use Pact, we collect the following data:

From your Slack workspace:

• Slack workspace name and team ID
• Slack user IDs of the people involved in a pact (the person who created it and their counterpart)
• Display names of users involved in pacts (for readable notifications)
• Bot access token for your workspace (stored in our access-controlled database and used to send messages and reminders on your behalf)

From pact creation:

• The commitment text you provide (e.g., "Review the design doc by Friday")
• The due date associated with the commitment
• The Slack channel ID where the pact was created
• Timestamps: when the pact was created, when it was completed, and when reminders were last sent

From website visits:

• Page path, referrer URL, and UTM campaign parameters (for understanding how people find Pact)
• When private analytics hashing is configured, a keyed, truncated hash of your IP address (the original IP is not stored); otherwise no IP-derived identifier is retained
• User agent string

We do not collect phone numbers or payment card details. Depending on the feature you invoke, Pact processes content you send to the bot, slash commands, messages selected through the 🤝 reaction or message shortcut, and limited context used by enabled AI features. Transactional email addresses are processed only when needed to deliver an email.

3. How We Use Your Data

We use the data we collect solely to operate and improve Pact:

• To create and store pact records so both parties can see their commitments
• To send reminder notifications to the relevant Slack users before and after due dates
• To allow users to list and complete their active pacts
• To understand aggregate usage patterns and improve the product
• When AI features are enabled, to pass limited message snippets to Anthropic for commitment detection and /done context inference — Pact does not store those snippets separately after inference completes

We do not use your data for advertising. We do not sell your data to any third party.

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Neon (a managed cloud database provider). Data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.

Slack bot tokens — which grant Pact permission to post messages in your workspace — are stored in our access-controlled database, protected by the database provider's encryption at rest and TLS in transit. We restrict access and follow Slack's security best practices for token handling.

Our application runs on Vercel. Application configuration is stored in encrypted provider-managed environment variables, and production traffic is served over HTTPS.

5. Data Retention

We retain pact data (active and completed commitments) for as long as your workspace has Pact installed. If you uninstall Pact from your Slack workspace, you may request deletion of all associated data.

Website analytics data (anonymized pageviews and events) is retained for up to 90 days.

6. Third-Party Services

Pact integrates with the following third-party services (sub-processors):

• Slack API — Pact is built on Slack. Your use of Pact is also governed by Slack's Privacy Policy.
• Neon — Our managed PostgreSQL database provider. All pact data is stored in US-based (AWS us-east-1) data centers, encrypted at rest.
• Vercel — Our application hosting provider. Processes application logs and encrypted environment configuration. See Vercel's Privacy Policy.
• Anthropic (when AI features are enabled) — Powers AI commitment detection and /done context inference. Limited message snippets are sent for inference. See Anthropic's Privacy Policy.
• Resend (when transactional email is enabled) — Delivers operational email and receives the intended recipient's email address. See Resend's Privacy Policy.
• Linear, Notion, and Asana (only when a workspace connects an integration) — Receive the pact and project data necessary to perform the requested synchronization.
• Google Fonts — Used for typography on our marketing website. Google may log font requests; see Google's Privacy Policy.

We do not use advertising networks, third-party analytics platforms (such as Google Analytics), or any marketing tracking services.

7. Your Rights

You have the right to:

• Access — Request a copy of the data Pact holds about you
• Deletion — Request that we delete all data associated with your Slack user ID or workspace
• Correction — Request correction of any inaccurate data
• Portability — Request your pact data in a structured, machine-readable format
• Objection — Object to any processing of your data

To exercise any of these rights, email us at hello@makepact.co. We will respond within 30 days. For workspace-level data deletion, the workspace admin should uninstall Pact from Slack and contact us to complete the data removal.

8. Cookies and Tracking

Our marketing website (makepact.co) does not use cookies for tracking or advertising. We collect anonymized, server-side analytics to understand which pages are visited and how users arrive at our site. No persistent identifiers or tracking pixels are used.

The Pact Slack bot does not use cookies.

9. Children's Privacy

Pact is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For material changes, we'll notify workspace admins via Slack message. Continued use of Pact after changes constitutes acceptance of the updated policy.

11. Contact

Questions, requests, or concerns about this Privacy Policy? Contact us:

• Email: hello@makepact.co
• Website: makepact.co

We aim to respond to all privacy-related inquiries within 5 business days.