Privacy Policy

Pane is built local-first — your data lives on your device, and when it's backed up to our servers, it's always end-to-end encrypted before it leaves your machine. This document explains what we collect, why, and how we protect it.

Pane is made by Three Lane Studios, based in Florida, USA. If you have questions, reach out any time at admin@paneapp.ai.

The Short Version

• Your notes, tasks, and AI conversations stay on your device. We don't collect or read them.
• Your data is automatically backed up to our servers in encrypted form — we physically cannot read it. This infrastructure supports upcoming multi-device sync.
• If you use AI features, your prompts go straight from your device to the AI provider you chose, using your own API key. We never see that traffic.
• We collect the minimum needed to run your account and process payments: your email, name, and billing details (handled by Stripe).
• We don't use tracking cookies, ad networks, or sell your data. Full stop.

What We Collect

Account information. When you create a Pane account, we collect your email address and name to set up authentication (via Supabase) and manage your subscription.

Payment information. Billing is handled entirely by Stripe. We never see or store your full card number — Stripe passes us only what's needed to manage your subscription (e.g., plan status, renewal date).

Encrypted backup data. Your notes and tasks are encrypted on your device using XChaCha20 before being automatically backed up to Supabase. This is end-to-end encryption: the data stored on our servers is unreadable to us, our infrastructure providers, or anyone without your key. This encrypted backup infrastructure is in place to support upcoming multi-device sync.

Basic website analytics. We use privacy-respecting analytics tools on paneapp.ai to understand traffic at a high level (page views, referrers). We do not use Google Analytics or any tracking-based analytics platform, and we select tools that minimize data collection. We use PostHog on this marketing site for analytics and session replay to improve the checkout experience; session replay masks all form inputs and does not capture keystrokes.

Crash reports (optional). If enabled, the desktop app can send anonymized crash reports to help us fix bugs. These contain technical details about the crash — not your notes, tasks, or personal content.

What We Don't Collect

We want to be explicit about this, because it's core to how Pane works:

• Readable note and task content — your content lives in a local SQLite database on your machine. It is automatically backed up to our servers, but always encrypted on your device first using XChaCha20 end-to-end encryption. We cannot read, access, or decrypt your content.
• AI conversation content — Pane is a bring-your-own-key app. When you use AI features, your requests go directly from your device to the provider you configured (OpenRouter, Anthropic, OpenClaw, or a local Ollama instance) using your own API key. We do not proxy, log, or store this traffic in any way.
• Browsing history, contacts, location, or device identifiers.
• Anything from third-party trackers or ad networks — because we don't use any.

How We Use Your Information

We use the information above only to:

• Authenticate your account and manage encrypted backups
• Process billing and manage your subscription
• Provide customer support when you contact us
• Understand aggregate website traffic to improve paneapp.ai
• Fix bugs and improve app stability (via optional crash reports)

We do not use your information for advertising, and we do not sell, rent, or trade it to third parties.

Data Storage & Security

• Local data stays in a SQLite database on your device, under your control at all times.
• Synced data is encrypted client-side with XChaCha20 before upload. Our Supabase infrastructure stores encrypted blobs it cannot decrypt — this is true end-to-end encryption, not "encrypted at rest on our servers with a key we hold."
• Account and billing data is stored with Supabase (auth) and Stripe (payments), both of which maintain their own industry-standard security practices (SOC 2 compliance, encryption in transit and at rest).

If we ever experience a security incident affecting your account data, we will notify affected users promptly and clearly.

Third-Party Services

We rely on a small number of vetted service providers to run Pane:

We do not share your data with data brokers, ad networks, or any party not listed above.

Cookies

paneapp.ai may use minimal, functional cookies to support site operation. We do not use tracking or advertising cookies, and we do not use cookies for analytics or user profiling. The desktop app doesn't use cookies at all — it's a native application, not a web page.

Children's Privacy

Pane is not directed at children under 13, and we do not knowingly collect information from anyone under 13. If you believe a child has provided us with personal information, contact us at admin@paneapp.ai and we'll delete it.

Data Retention

We retain account and billing information for as long as your account is active, plus a reasonable period afterward for legal, tax, and dispute-resolution purposes. If you delete your account, we delete your encrypted sync data and personal information within 30 days, except where retention is required by law.

Local data on your device is entirely yours — deleting the app or your local database removes it immediately, independent of anything on our end.

Your Rights

Depending on where you live, you may have rights under laws like the GDPR (EU/UK) or CCPA (California), including the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated data
• Export your data (your local database is already fully portable — no lock-in)
• Opt out of any non-essential data collection (like crash reports)

To exercise any of these rights, email admin@paneapp.ai. We'll respond within 30 days.

International Users

Three Lane Studios is based in the United States, and data we process (account info, billing, encrypted sync blobs) is stored with US-based infrastructure providers. By using Pane, you consent to this processing, consistent with applicable law.

Changes to This Policy

If we make material changes to this policy, we'll update the "Last updated" date above and, for significant changes, notify active users via email or an in-app notice. We encourage you to review this page periodically.

Contact Us

Questions, concerns, or requests related to your privacy? Reach out any time:

Three Lane Studios
Email: admin@paneapp.ai
Website: paneapp.ai