Privacy at Tapestry PRM

The short version

• The Tapestry PRM application stores the messages, contacts, calendars and notes you connect, and everything it builds from them, on your device. Unless you turn on Always-on, our servers store none of this information and can’t read it. You need a Tapestry account to use the application. It holds your email address, sign-in records and, if you use remote access, an entry for your main computer and, if you invite people, the invites you send, but not what you connect.
• It doesn’t use cloud AI providers for its own features. We never use your information to train AI models.
• A few features contact outside services with narrow information, such as map images, city names, organisation websites and, when you press Refresh on an organisation or a person, a name to Google News, and the application checks our website for updates. Optional assistant access lets AI assistants you choose read context, and a cloud assistant’s provider receives what it reads. With optional remote access, assistants you approve reach your main computer from anywhere through our relay, which passes each connection on encrypted and can’t read it. With optional Always-on, our hosted service keeps a copy of what your approved assistants may read, without your Gmail data, and reads it to answer them. Each case is described below.
• The application and its browser extension send diagnostics (usage, performance and errors) with random IDs and never relationship content. While you’re signed in, the application’s diagnostics also include your Tapestry account’s ID, a random code that isn’t your email address. The extension’s diagnostics include your IP address and approximate location. You can turn them off.
• We don’t sell your relationship data or use it for advertising, and nothing from the application reaches advertising partners. Our website uses analytics and advertising cookies and tags from Google, Meta, LinkedIn, Microsoft, X and TikTok to measure and target our ads. In the EEA, the UK and Switzerland they load only if you accept them; elsewhere you can opt out in Your privacy choices.

Who we are

Tapestry PRM is operated by AMS Global Ventures, LLC, based in New York, United States (“we”, “us”). We are responsible for the information we collect through the website, the waitlist, the Tapestry account and its invites, remote access, Always-on, correspondence and diagnostics. Contact privacy@tapestryprm.com for privacy requests.

The Tapestry PRM application

This section covers the Tapestry PRM desktop application and its companion browser extension, Tapestry Capture (together, “the application”). The application is in private testing.

What stays on your device

Everything you connect or create in the application stays in your Tapestry folder on your device. That includes source messages and events, contacts, organisations, photos, notes, lists and the connections it finds (“local data”). By default the folder is .tapestry in your home folder, or it is the folder you chose when you opened an existing Tapestry. If you keep the folder in iCloud Drive, Dropbox or another synced folder, that service receives a copy of local data. Our servers don’t store local data, and no one at AMS Global Ventures, LLC can read it. If you turn on Always-on, our hosted service keeps a copy, as Always-on describes.

Because we don’t hold local data, we are not able to see, export, correct or delete it for you. You control it on your device, as described below. Turning Always-on off deletes its copy.

Sources you connect

You choose each source. The application reads it; it never sends messages, changes your accounts or writes back to a source.

• Gmail, Google Calendar and Google Contacts: read-only, through Google’s consent screen. See Google user data below.
• Outlook mail, calendar and contacts (Microsoft 365): delegated, read-only, stored on your device, and in your Always-on copy if you turn Always-on on. You sign in to each personal, work or school Microsoft account on Microsoft’s own page. The application reads the headers and body text of Outlook mail from the last 90 days in every folder except Deleted Items, Junk Email, Drafts and Outbox, and new mail after that; events on your main calendar from 90 days back to 90 days ahead; and your Outlook contacts. It reads only your own mailbox and can’t send, change or delete anything in your Microsoft account. Microsoft’s sign-in for each account is kept in the macOS Keychain on your device. A work or school account may need your organisation’s approval first; For IT admins explains what your IT team sees. You can remove Tapestry PRM’s access at any time, at account.live.com/consent/Manage for a personal account, or at myapps.microsoft.com or through your IT team for a work or school account. Disconnecting the account in the application, or deleting all Tapestry data, removes its sign-in from your device, but Microsoft keeps Tapestry PRM on that account’s list of apps until it is removed there.
• Apple Contacts: with the macOS Contacts permission, names, email addresses, phone numbers and postal addresses from your address book.
• iMessage: with macOS Full Disk Access, the message history the Messages app keeps on your computer.
• WhatsApp: the message history the WhatsApp desktop app keeps on your computer.
• Signal: the message history the Signal Desktop app keeps on your computer, for people already in Tapestry. Signal locks it with a key kept in your Mac’s keychain, so macOS asks whether the application may use that key. The application uses it only to read Signal’s history on your device, never saves it and never changes anything in Signal. A disappearing message is kept only until its timer ends; after that, only its date and who wrote it remain. View-once photos and videos are noted, never opened.
• Android texts (Google Messages): an Experimental source, off until you connect it and not offered when you set up the application. Before you connect, the application tells you that Google may challenge or restrict an account that uses an unofficial Messages client. The application reads the texts in Google Messages for web, the conversations your Android phone shares with it: those already there when you connect, and new ones while the application is open. For each message it keeps the text, who sent it, when, which direction and the conversation it belongs to, and for a photo or other attachment only that there was one. To pair with your phone it needs the Google cookies Google Messages uses, which are in effect a sign-in to your Google account. Tapestry Capture reads them from Chrome only when you start Connect Android texts in the application and click Allow in the extension, which is when Chrome asks you for the extension’s optional permission to read Google cookies; or you paste them in yourself, as a “Copy as cURL” from your browser. Capture reads only the cookie names Google Messages needs, only when one Google account is signed in to that Chrome profile, and seals them so that only the application on your device can open them. The application passes them to a separate helper on your device, tapestry-gmessages-helper, which keeps them with the pairing in its own item in your macOS Keychain, not synced to iCloud Keychain; the application itself never stores them. They are never logged, synced, sent to our servers or included in diagnostics, and go only to Google’s Messages servers. Tapestry never shows, hosts or drives a Google sign-in. Disconnecting Android texts asks Google to end the pairing and deletes the helper’s Keychain item; texts already read stay on your device.
• FaceTime and phone calls: with macOS Full Disk Access, the call history your Mac keeps, including calls from your iPhone when Calls on Other Devices is turned on, for people already in Tapestry: who, when, how long and which direction. The application never places calls or changes your call history, and calls from numbers that aren’t in your Contacts aren’t added.
• LinkedIn: the data export you download from LinkedIn and choose to import; and, if you install Tapestry Capture in Chrome, details from the LinkedIn profile and people-list pages you open, such as names, headlines, photos and mutual connections, and from version 0.3.0 the messages LinkedIn has loaded in conversations you open, with the people in them. The extension reads the LinkedIn pages you open. It scrolls a profile after you click Fill in or Save profile and mutuals, and pages through a mutual-connections list after you click Save all. With its Save mutuals setting on, it can also open one person’s mutual-connections list in a background tab, read it and close it: after you click Save profile and mutuals, or, if you choose Automatically, by itself for the 1st- and 2nd-degree profiles you open, at most 30 pages a day. You can change that setting at any time, and it turns itself off if LinkedIn shows a check page. It does not load older messages or read your inbox, and it passes what it captures only to the application on your device. For each message it saves the text as shown, who sent it (LinkedIn’s ID for them, or their public profile link), when, its reactions, whether it was edited or deleted and the message it replies to, and keeps an attachment as its name and size with a link to the conversation, never the file. Saving messages is on by default, but the extension reads none until the application has shown you a notice and you have chosen Save messages. You can turn it off, or remove what it saved, at any time under Integrations → Browser extension.
• Instagram: the data download you request from Instagram and choose to import: your direct messages, the names in them, and who took part and when. The application reads it on your device.
• Granola: with a Granola API key you provide (available on Granola’s Business and Enterprise plans), your meeting notes from Granola. The key is kept in your macOS Keychain. New and updated notes sync while the application is open.
• Fathom: with a Fathom API key you provide, your meetings from Fathom, with their summaries, action items and transcripts. The key is kept in your macOS Keychain. New meetings sync while the application is open.
• Fireflies: with a Fireflies API key you provide, your meetings from Fireflies, with their summaries, action items and transcripts. The key is kept in your macOS Keychain. New meetings sync while the application is open.
• Avoma: you sign in with Avoma in your browser. Tapestry registers with Avoma as its own app, asks for read access only, and keeps the sign-in in the macOS Keychain. The application reads the meetings you organized or attended: attendees’ email addresses, Avoma’s notes, key points and action items, and the transcript with speaker names and email addresses. Meetings Avoma marks private stay on your device and reach no assistant. The application never writes to Avoma.
• Plaud: you sign in with Plaud in your browser, and each sign-in is its own connection. Tapestry registers with Plaud as its own app, “Tapestry PRM”, each time you sign in, and keeps each sign-in in the macOS Keychain. The application reads your recordings: the details Plaud lists for each one, such as its title, start time, length and the recorder it came from; the notes Plaud keeps for each one, including its summary and action items; and the transcript, with speaker names and times. It also reads your Plaud display name, to tell which lines are yours, and your email address, to name the connection on your device. The application links a recording to people only through a calendar event at the same time. When you connect, the application reads every recording Plaud lists; after that, it checks for new recordings every 30 minutes while the application is open, and reads the past week’s recordings again to pick up changes. A recording, note or transcript you delete in Plaud stays on your device until you delete it in Tapestry. The application never downloads a recording’s audio or follows a link Plaud sends, drops Plaud’s links to audio and notes before keeping a recording, and apart from registering when you sign in, never writes to Plaud. Disconnecting a connection removes its sign-in from your Keychain, and what was already read stays on your device. Plaud may keep Tapestry’s access until you remove it in your Plaud account.
• Slack: you sign in to each Slack workspace on Slack’s own page, and the application reads the one-to-one direct messages you wrote in, and their threads: each message’s text, who wrote it, when, its reactions and, for a file, only its name and type, never the file. It also reads the profile Slack shows for the person on the other side, such as their name, job title, email address, phone number and time zone, and the names of the people a message mentions. It reads the last 90 days when you add a workspace, then checks for new messages about every hour while the application is open. To find your direct messages it searches the messages you wrote in your workspace; results from group direct messages and channels are discarded, not kept, and those conversations are not read in this version. It skips messages from apps and bots. Slack’s own consent screen lists more read permissions than the application uses today, including channel history. Slack gives the application a sign-in for your own Slack account, kept in your macOS Keychain, one item for each workspace, and not synced to iCloud Keychain. Disconnecting a workspace asks Slack to end that sign-in and removes it from your Keychain; what was already imported stays on your device.
• HubSpot: with a read-only HubSpot token you paste in, from a private app or a Service Key in your HubSpot account, your HubSpot contacts, companies and deals and the activity logged on them (notes, emails, calls, meetings, tasks and logged messages) and conversations in your HubSpot inbox, for everything or for the segments you choose. The application accepts only a token that can read: it refuses one that can change HubSpot or read its Sensitive Data properties, and it never writes to HubSpot. The token is kept in your macOS Keychain, one item for each HubSpot portal, and not synced to iCloud Keychain. New and edited records sync while the application is open. Disconnecting a portal removes the token from your Keychain, and what was already imported stays on your device. To end the token in HubSpot too, delete its private app or Service Key there.
• Attio: with a read-only Attio access token you paste in, which an admin of your Attio workspace makes in Attio, your Attio people and companies and the notes on them, for the whole workspace or for the people and company lists you choose; a chosen person’s company comes with them. The token can read the whole workspace, not only what you can see in Attio. The application also reads the names of your workspace’s people and company lists, so you can choose. It keeps each record’s details, custom attributes included, but not the email and calendar activity Attio logs on it. It reads no deals, meetings, emails, call recordings, comments, tasks or files. It asks Attio only for the notes on the people and companies it reads, and discards any other note Attio returns. If the token can read your workspace’s members, the application uses their names to show who wrote each note. The application accepts only a token that can read: it refuses one that can change Attio, and it never writes to Attio. The token is kept in your macOS Keychain, one item for each Attio workspace, and not synced to iCloud Keychain. New and edited records sync while the application is open. Disconnecting a workspace removes the token from your Keychain, and what was already imported stays on your device. To end the token in Attio too, delete it in Attio.
• A transcript or summary you import: a transcript or summary you paste or choose, to add to a meeting’s note. The application reads the text on your device and doesn’t keep the file.
• Google Voice: the Google Takeout export you download from Google and choose to import: your Google Voice texts, call history and voicemail transcripts, for conversations with people already in Tapestry. Spam conversations are skipped unread, and the application never reads recordings or attachments.
• Your own notes and lists, written in the application.

Your sources contain information about other people. Please use it lawfully and respectfully. Our terms of service explain your responsibilities.

How the application uses local data

The application uses local data only to provide its features to you: organising the people and organisations you know, showing your history with each of them, placing people on the Map, answering your searches and making suggestions. The application does not need an AI model. If you run a local model server, such as Ollama, on your device, the application may use it in the background to organise local data. It looks for a model server only on your own device. The application does not use cloud AI providers for its own features, and neither your data nor anything derived from it is used to train or improve any AI model.

Meeting notices

Meeting notices are on unless you turn them off in Settings → Meeting notices. The first time Start shows a meeting with people you know, the application asks macOS for permission. If you allow it, macOS shows a notice a few minutes before such a meeting. The notice shows the meeting’s name, when it starts and how many people you know there; while App Lock has Tapestry locked, it shows only how many and when. macOS may show notices on your device’s lock screen: to keep their text off it, set Show Previews to When Unlocked in macOS’s Notifications settings. So that each meeting is announced once, the application keeps a list of the meetings it has told you about as scrambled codes, with no names or titles, and removes each one when the meeting ends, along with its notice. Nothing about a notice leaves your device. If diagnostics are on, they count notices shown and opened, never what a notice says.

When the application contacts other services

The application connects to outside services only in these ways:

• The sources themselves. To import from Google, Microsoft, Granola, Fathom, Fireflies, Avoma, Plaud, Slack, HubSpot or Attio, the application sends requests from your device to those services, and for Android texts its helper connects from your device to Google’s Messages servers (for Microsoft, to login.microsoftonline.com and graph.microsoft.com; for Avoma, to mcp.avoma.com for meetings and prod-api.avoma.com for sign-in; for Plaud, to mcp.plaud.ai for recordings and sign-in; for Slack, to slack.com; for HubSpot, to its API at api.hubapi.com; for Attio, to its API at api.attio.com), which handle them under their own privacy policies.
• Map images. The Map loads its background images from OpenStreetMap’s tile servers, which receive your IP address and the areas of the map you view.
• Place lookups. To place people and meetings on the Map, the application sends only a place name to the OpenStreetMap Nominatim service: the city from an Apple Contacts or Google Contacts address or a calendar event’s location, or the location shown on a LinkedIn profile, with its state or country where known. It never sends names, email addresses, street addresses or other details.
• Organisation names and icons. To show an organisation’s name and icon, the application requests the public home page of that organisation’s own website (for example, the domain in a contact’s email address) and then the icon that page names, which may be hosted elsewhere, such as on a content-delivery network. These requests follow a small number of redirects. The sites contacted receive your IP address and a request for their public pages. Requests go to one site at a time, never to a lookup service that would see your whole list.
• An organisation’s About and news. Only when you press Refresh in an organisation’s About section, the application reads that organisation’s own website for its description and any news feed the site names on its own address, and asks Google News for recent headlines that name the organisation. Google receives the organisation’s name, or for a name that is just a web address, the name part of it, and your IP address, and nothing else: no people, email addresses, notes or other organisations. Each press asks about one organisation, nothing is requested in the background, and what is found is kept on your device.
• News about a person. Only when you press Refresh in the News section of one of your contacts, the application reads the website saved on that contact for any news feed it names on its own address, and, if you have saved where they work, asks Google News for recent headlines that name both the person and that organisation. Google receives the person’s name, the organisation’s name, or the name part of it as above, and your IP address, and nothing else: no email addresses, phone numbers, notes or other people. Without a saved organisation, Google is not asked. Websites on shared services, such as social networks, are not read. Each press asks about one person, nothing is requested in the background, what is found is kept on your device, and assistants you connect can’t read it.
• Profile photos. Photos captured from LinkedIn are downloaded from LinkedIn’s image servers. Google Contacts photos are downloaded from Google using your Google authorisation.
• AI assistants you connect. The Ask page lets AI assistants you choose, such as Claude or a local model in LM Studio, read relationship context through Tapestry’s read-only MCP server. That context can include people, organisations, message and meeting excerpts, meeting summaries and transcripts, participants and topics, as the Ask page lists under what is shared. Notes you write in Tapestry are included while assistant access is on. If your access was already on when Tapestry began including notes, you’re asked once before any note is shared. Assistant access is off until you turn it on, and you can turn it off at any time. An assistant you approve through remote access reads the same context as one on your device. A cloud-based assistant sends what it reads to its provider under that provider’s terms, which may allow model training unless you turn it off in that assistant’s settings. A local assistant can keep it on your device.
• Links you open. When you open a link, such as a LinkedIn profile or a Granola note, your browser opens it.
• Update checks. The application asks our website, which Vercel hosts, whether a newer version is available: about a minute after it opens, then every 12 hours and when your device wakes, whenever you choose Check now, and once more just before installing an update. Each check sends the application’s version, your operating system and processor type, an update key that is the same in every copy of a version, and the updater’s name and version. An update downloads from Vercel’s storage through a link that expires after ten minutes. Vercel receives your IP address as part of each connection. Neither request includes an installation ID, your download code, an account, your Google identity, or any contact, message or relationship content, and neither is a diagnostics report. You can turn automatic checks off under Settings → Updates (Check for updates automatically); Check now still works when you choose it.
• Your Tapestry account. Only if you create one. When you use the Account section, the application sends your email address, the codes you enter and its sign-in to Supabase. When you send an invite, it also sends the address you typed, your name and your note. When you open the Ask page while signed in, it sends its sign-in, to check whether you have remote access. Supabase receives your IP address and the application’s version. See Your Tapestry account.
• Remote access. Only if you turn it on. Your main computer keeps a connection open to our relay, gets its certificate from Let’s Encrypt, and once a day looks up its own address in a public certificate-transparency search. When an assistant asks to connect, it fetches that assistant’s public sign-in details from the assistant’s own website, claude.ai or chatgpt.com. Once a day, it also asks our account service whether your remote access continues. See Remote access.
• Always-on. Only if you turn it on. Your main computer uploads an encrypted copy of what the assistants you approved may read to our hosted service, on Amazon Web Services, and the service reads it to answer them, as Always-on describes. While you’re signed in to your account, the application also asks the service whether Always-on is on, with your account sign-in and no relationship data.
• Diagnostics, described next.

Diagnostics

The application and Tapestry Capture send diagnostics to help us keep them working and improve them. Diagnostics are on by default. They include which screens and steps ran, timings and outcomes, error types and the locations in our code where errors happened, the application version, your operating system and processor type, and random installation and session IDs. While you’re signed in to your Tapestry account, the application’s diagnostics also include your account’s ID, a random code our account service gave your account, so we can count people rather than installations and find your reports when you ask us for help. It is never your email address. Signing out stops it being included; reports already received keep it. Tapestry Capture’s also include your browser and its version, your operating system’s version, your time zone and language, how many processor cores and how much memory your computer has, whether it was installed from the Chrome Web Store, and which parts of a LinkedIn page it could read, such as whether a profile showed a headline, never what they say. They never include relationship content, names, email addresses, phone numbers, message or note text, page addresses, source identifiers, file paths, credentials, or AI prompts and outputs.

Usage and performance reports go to PostHog, and error reports go to Sentry, both in the United States. Both services receive your IP address as part of the connection. With Tapestry Capture’s reports, they store it and use it to look up your approximate location: your city, region and country, and in PostHog also your postal code and that area’s rough coordinates. The desktop application sets the IP-address field in its PostHog reports to zero and turns off location lookup. You can turn diagnostics off in the application under Settings → Privacy & security, and in Tapestry Capture from its toolbar popup. Turning them off stops future reports and clears unsent ones; it does not remove reports already received. The application works fully offline and with diagnostics off. If you would like us to delete diagnostics already received, contact us.

Security of local data

The application does not encrypt local data itself. Disk encryption, such as FileVault on a Mac, keeps it encrypted while your device is turned off. A Tapestry folder on another drive is protected only if that drive is encrypted, and the application tells you if the drive holding local data is not encrypted. On your device’s own disk, only your user account has permission to open the Tapestry folder, but other applications you run can read it. App Lock is off until you turn it on in Settings. It then asks for Touch ID or your device’s password before the application shows anything: when it opens, after a period without use, and when your device sleeps or its screen locks. App Lock covers the application’s window only; it doesn’t encrypt your data or stop assistants you have given access. Without it, anyone using your device while it is unlocked can open the application. Google authorisations, the Granola, Fathom and Fireflies keys, the Avoma sign-in, the Plaud sign-ins, your Tapestry account sign-in and the keys remote access uses are kept encrypted in the macOS Keychain on your device, and are not synced to iCloud Keychain. The Android texts helper keeps its pairing in its own macOS Keychain item, also not synced to iCloud Keychain. Copies of local data, such as backups, are only as protected as the place they are kept. We recommend turning on disk encryption and keeping your device up to date. Please report security problems through our vulnerability disclosure policy.

Keeping and deleting local data

Local data stays on your device until you delete it. The application keeps a copy of each item it imports so it can show you the original evidence. Disconnecting a source stops new imports; data already imported stays. Uninstalling the application does not delete local data.

To delete all local data, open Settings → Data in the application, choose Delete all Tapestry data on this device and type “delete” to confirm. The application restarts and deletes your Tapestry folder with everything in it; the Google authorisations stored on your device, after asking Google to revoke them; the Granola, Fathom and Fireflies keys and the Avoma and Plaud sign-ins it keeps in the macOS Keychain; assistant access; unsent diagnostics; its own settings and caches; and Chrome’s registration of the Tapestry Capture helper. If this device has remote access, it removes that first, deleting the device’s entry on your account; if it can’t, it deletes nothing. It also signs this device out of your Tapestry account, which stays until you delete it. If you opened a Tapestry in a folder you chose, it deletes the files it created there, except the Slack, HubSpot and Attio connection lists, and leaves everything else in that folder. If diagnostics are off, they stay off. Disconnect each Slack workspace, HubSpot portal and Attio workspace first: disconnecting asks Slack to end its sign-in and removes each sign-in or token from your Keychain. Disconnect Android texts first too: that asks Google to end the pairing and deletes the helper’s Keychain item. If Always-on is on, it first turns it off, which deletes the copy; if it can’t reach our service, it asks whether to go ahead and leave the copy until it is deleted as Always-on describes. Deletion cannot be undone.

Revoking a Google authorisation removes Tapestry PRM’s access to that Google account on every device where you use Tapestry with it. If Google cannot be reached, the application still deletes the authorisation from your device and tells you, and you can remove the access yourself at myaccount.google.com/connections.

Some things are outside the application’s reach. Backups you keep, such as Time Machine, may still contain an unencrypted copy of your Tapestry folder unless the backup disk is encrypted. Tapestry Capture captures nothing until it has connected to the application on your device. It keeps captures waiting to be sent in Chrome’s extension storage for at most 30 days, and deletes any that are still unsent after that. Messages wait there sealed, so only the application on your device can open them; Chrome deletes the rest when you remove the extension. Your data at its sources, such as Gmail or Granola, is not affected, and export files you downloaded, such as a LinkedIn or Google Takeout export, stay where you saved them. After deleting, you can also remove Tapestry from any AI assistant you set up, revoke your Granola, Fathom and Fireflies API keys in each service, remove Tapestry’s access in Avoma, remove it in your Plaud account if Plaud lists it, withdraw macOS permissions in System Settings and remove the Tapestry Capture extension from Chrome. The application lists these steps when it finishes.

You can also delete local data without the application: quit it and delete your Tapestry folder (by default .tapestry in your home folder). The folder is hidden by default; in Finder, press Command-Shift-. to show hidden folders. Doing it this way leaves the Granola, Fathom and Fireflies keys, the Avoma sign-in, your Plaud and Slack sign-ins, your HubSpot and Attio tokens and your Google authorisations in the Keychain, and Google’s and Slack’s access in place, so revoke the key and remove Google’s access yourself as described above, and disconnect each Plaud connection, Slack workspace, HubSpot portal and Attio workspace in the application first.

Your Tapestry account

You need a Tapestry account to use the application. You sign in once, when you create a Tapestry or the first time you open one after updating. After that, the application opens without a connection, and signing out or deleting the account doesn’t stop it opening. Supabase, our account provider, keeps the account in the United States. You sign in with a 6-digit code we email to you; there is no password. An account doesn’t change how the application handles your data on your device, and it doesn’t hold what you connect.

What the account holds

• Your email address, when the account was created and confirmed, and when you last signed in.
• For each device signed in to it: when that sign-in began and was last renewed, how it signed in, the IP address it came from and the application’s version.
• Which versions of our terms and this notice you agreed to, and when.
• While a code we sent you is still valid, a one-way hash of it.
• If you set up the optional second factor: each authenticator app’s type and status, a generic name the application gives it, when it was added and last used, and the secret it shares with your authenticator app, which Supabase can read so it can check your codes; the time and IP address of each authenticator code check, deleted after 24 hours; a count of recent checks, with no IP address, kept for about 2 days; and your backup codes, only as one-way hashes, with when each was used. Failed backup-code attempts are kept for a day.
• Security notices waiting to be emailed, deleted once sent, and a record of any request to delete the account by email (below).
• If you use remote access, the entry for your main computer and your place in the preview, described under Remote access.
• Your invite code’s fingerprint and the invites you’ve asked us to email, as Invites describes.

Apart from the invites described under Invites, it doesn’t hold names, contacts, messages, notes or anything else you connect, your device’s name, diagnostics IDs, or any key that can open your data.

When the application contacts it

When you use the Account section: to create the account or sign in, to check that it and your agreement are current, to set up or remove the second factor, and to sign out or delete it. When you open the Ask page while signed in, to check whether you have remote access, and when you turn remote access on or remove it. While remote access is on, its helper also checks once a day, in the background, that your remote access continues, as Remote access describes. When you use Invites, in the invite sheet or Settings → Sharing: to check your invites, to create your invite code, and to send or cancel an invite. Otherwise the application doesn’t contact the account service when it opens or in the background. It keeps your sign-in encrypted in the macOS Keychain on your device, not synced to iCloud Keychain.

Emails about your account

Resend, our email provider, sends your sign-in codes and security notices: when an authenticator app is added or removed, when backup codes are created, replaced, deleted or used, when too many authenticator codes have been tried, when deleting the account is requested or cancelled, and, for remote access, when it moves to another computer, when it pauses because your access has ended, and 14 days before a paused entry is removed. Resend receives your email address and each message. Our account emails never contain links; the emails we send for invites do, as Invites describes. We use your account’s address for these emails, for product email unless you turn it off, and, when someone uses your invite, to show us who invited them.

Product email

We email your account’s address about Tapestry PRM: product news, feature updates, a weekly update and occasional offers. Product email is on when you create an account, and the sign-in step says so. You can turn it off in Settings → Account, or with the unsubscribe link in any of these emails. If you unsubscribe from our waitlist emails or our account emails, you get neither. Resend receives your address and each message every time we send. Turning product email off doesn’t stop your sign-in codes, security notices or notices of changes to our terms and this notice.

How long it is kept

• If you request a code but never enter it, your address is deleted 24 hours after the last code was sent.
• If you confirm your address but don’t finish agreeing to our terms and this notice, the account is deleted once none of its sign-ins has been used for 7 days.
• A sign-in that goes unused for 90 days ends, and signing out ends it straight away.
• Otherwise the account stays until you delete it. Deleting it removes the account, its sign-ins, its second-factor records, its remote access records, your invite code and your invites at once, and the DNS records for any remote access address within minutes. Requests made with your code stay, with the inviter cleared.
• Supabase’s daily backups keep a copy for up to 7 days. Supabase keeps its service logs, which include IP addresses, for 7 days, and Resend keeps its email logs for 30 days, and its backups for up to 7 more.

Deleting your account

Delete it in Settings → Account. Unless you entered a code in the last 10 minutes, the application first asks for a new one, and for your authenticator app or a backup code if you set one up. You can also delete it there while signed out, with a new code. Deleting your account first removes remote access from this device, if it has it, and otherwise changes nothing on your device. Deleting the account also deletes your Always-on copy. Delete all Tapestry data on this device signs this device out without deleting the account.

If you have lost every authenticator app and backup code, email privacy@tapestryprm.com from the account’s address. We confirm the request with that address and delete the account after 7 days, unless it is signed in to with its second factor before then. We can delete an account, but we never restore access to one.

Remote access

Remote access lets AI assistants you approve, such as Claude and ChatGPT, read your Tapestry from anywhere, not only on the computer it runs on. It is off until you turn it on, on the Ask page. It needs a Tapestry account, and while the preview lasts every account includes it (see Remote access preview). The computer you turn it on for is your main computer. Your Tapestry stays on it, and assistants can reach it only while it is on, awake and online.

How a connection works

Turning remote access on gives your main computer its own address on the internet: a random 26-character name under tapestryprm.app, with a certificate from Let’s Encrypt. Your main computer keeps a connection open to our relay. When an assistant connects to that address, the relay passes the connection to your main computer end-to-end encrypted: the encryption ends on your main computer, and the relay holds no key that could read it. An assistant can connect only after you approve it on your main computer, by typing the code its browser shows you and confirming with Touch ID or your password. You can sign an assistant out on the Ask page, and an assistant that goes unused for 30 days is signed out.

A small helper, listed in macOS under Login Items, keeps remote access working while the Tapestry window is closed. The keys it uses, for the relay, for your main computer’s Let’s Encrypt account and for its certificate, are kept in the macOS Keychain on that computer and are not synced to iCloud Keychain.

What assistants read

An assistant you approve through remote access reads the same context as an assistant on your main computer itself, through the same read-only lookups, and the Ask page lists each read under Recent assistant access. That context can include text and details from Gmail, such as subjects, short previews and who took part, and Google Calendar event details. Notes you write in Tapestry are included while assistant access is on. If your access was already on when Tapestry began including notes, you’re asked once before any note is shared. The assistant’s provider, such as Anthropic for Claude or OpenAI for ChatGPT, receives what the assistant reads and keeps it under its own terms. The relay can’t read any of it. Unless you turn on Always-on, our servers store none of it.

What your account holds for remote access

Turning remote access on adds one entry for your main computer to your Tapestry account:

• its random address name;
• a random identifier your main computer made for itself, and its platform (macOS);
• the public key that proves your main computer to our relay;
• the web address of your main computer’s own Let’s Encrypt account;
• when the entry was made;
• the day, in UTC, the relay last saw your main computer, and the Tapestry version it ran then;
• if your remote access has ended, when it ended.

The entry holds no device name and no network address. Your account also records whether you have the remote access preview, and when it starts and ends, and, for 2 days, each time remote access was set up, to limit repeated attempts.

What is public

Your main computer’s address name is published in public DNS, in records that point it to our relay and name your main computer’s Let’s Encrypt account as the only account allowed to get a certificate for it. Like every HTTPS address, its certificates appear in public certificate-transparency logs. The name is random, not made from your email address, your device or anything else about you. We keep a list of every address name we have issued, so that none is issued twice. It records when each name was issued and retired, and why, with no link to any account, and for 90 days after a name is retired, the public key that went with it.

What the relay sees and keeps

For each connection, including your main computer’s own, the relay sees which address name it is for, the IP address it comes from, and its timing and size. It keeps IP addresses in memory only, for the live connection and its limits. Every 10 minutes, its logs record totals for each address name: how many connections it passed and how many bytes, and the codes for any connections it refused. Fly.io hosts the relay in the United States and keeps these logs for 7 days.

Other services remote access uses

• Let’s Encrypt issues your main computer’s certificates. It receives the certificate requests and your IP address, and no contact details.
• Certificate checks. Once a day, your main computer looks up its own address in Cert Spotter, a public certificate-transparency search run by SSLMate, or in crt.sh if Cert Spotter can’t answer, to check that no one else holds a certificate for it. The service receives the address name and your IP address. If your main computer finds a certificate it didn’t ask for, it stops remote access, signs every assistant out and tells you.
• Assistant sign-in details. When an assistant asks to connect, your main computer fetches that assistant’s public sign-in details from its own website, claude.ai or chatgpt.com.
• Our account service. Once a day while remote access is on, and every hour while it is paused, the helper asks whether your remote access continues. The request is signed with your main computer’s key and carries its address name and random identifier, not your email address or account sign-in. Supabase receives your IP address.
• DNS. Amazon Web Services keeps the DNS records for your main computer’s address.

How long it is kept

• An entry the relay hasn’t seen for 90 days is deleted, with its DNS records.
• If your remote access ends, the entry is kept, paused, for up to 90 days, then deleted. We email you when it pauses and 14 days before it is deleted.
• Removing remote access on the Ask page, signing out of your account on your main computer, deleting all Tapestry data on it, or deleting your account deletes the entry, and its DNS records within minutes. If you remove remote access or sign out while your main computer is offline, it deletes the entry the next time it is online.
• Moving remote access to another computer deletes the old entry, and we email you.
• The record of your preview is kept until you delete your account.
• The list of issued address names is kept, with no link to any account.
• The backup and log periods under Your Tapestry account also apply.

Always-on

Always-on lets AI assistants you approve read your Tapestry while your main computer is asleep or off. It is off until you turn it on, in Settings → Account, under Remote access. It needs remote access and a Tapestry account with an authenticator app, and while the preview lasts it is open to accounts in the remote access preview. Unlike the rest of Tapestry, Always-on keeps a copy of your data on our hosted service, and the service reads that copy to answer your assistants.

What the copy holds

Before anything is uploaded, Tapestry shows you what will go into the copy, counted by source, and what stays out. Your main computer builds the copy from what the assistants you approved may read, under the read limits you set for them. Depending on what you connect, it can hold:

• the people and organisations in your Tapestry, and the connections it finds between them;
• messages and calls from iMessage, WhatsApp, Signal, Android texts, SMS and Google Voice, and your call history: who took part, when and in which direction, and the text of messages in conversations an approved assistant may read;
• Apple Contacts;
• Google Calendar events and their details, such as titles, times, attendees and locations, and Google Contacts. If your copy started without them, Tapestry asks before adding them;
• Outlook mail, calendar and contacts, from personal, work and school Microsoft accounts: the text and details of email, without the text of attachments, calendar events and contact details;
• recorded meetings from Granola, Fathom, Fireflies and Plaud: titles, times, attendees and short snippets;
• LinkedIn: details Tapestry Capture saved from profiles, people lists and conversations you opened or asked it to save, and the LinkedIn data export you imported;
• Instagram and Messenger: messages from the downloads you imported;
• your own changes, such as names you corrected and people you merged;
• notes you write in Tapestry, only while assistant access is on.

The copy leaves out:

• Gmail, and anything Tapestry builds from it, such as email signatures;
• people you hid, and messages someone you hid may have written;
• the text of deleted messages, and of messages a disappearing-message timer has hidden;
• conversations no approved assistant may read;
• any source not listed above, such as Avoma, Slack, HubSpot and Attio.

Who can read it

Our hosted service reads the copy, in memory, to answer the assistants you approved. Each assistant reads only what its read limit allows, and one with no read limit set reads everything assistant access shares. An assistant you approved since the last upload reads nothing until the next.

Your main computer encrypts each upload so that only a key made for your copy alone, held in Amazon Web Services’ key service, can open it. The copy is stored encrypted and is decrypted only in the memory of the process answering an assistant. No one at Tapestry can read it through any human read path: no staff role can use its key.

This is not end-to-end encryption. Code we deploy to the service can read the copy, whether deployed by mistake or because the law requires it, and a legal demand served on us can require us to produce it. Data that stays only on your main computer isn’t in our hands to produce. As with remote access, an assistant’s provider receives what the assistant reads and keeps it under its own terms.

Where it is held, and how fresh it is

Amazon Web Services holds the copy in the United States. While Tapestry runs, your main computer sends changes within about a minute. Every answer carries how old the copy is, and an answer from a copy more than an hour old adds a notice saying so. If you hide someone while your main computer is offline, Tapestry shows “Not yet removed from your Always-on copy” until it can send the removal, and until then your assistants can still find that record.

What the service sees and keeps

• The IP address each request comes from, used in memory only to limit sign-in attempts. The service’s logs record events and ids, with no IP addresses and no content, and are kept for 14 days.
• An access record of each assistant request: when, which assistant, which lookup and whether it answered, with no people, questions or answers. It is kept for 90 days, you can see it from any computer signed in to your account, and turning Always-on off doesn’t delete it; deleting your account does.
• A receipt for each answer, sealed so only your main computer can open it, deleted once your main computer collects it or after 30 days.
• Each assistant’s sign-in: access that lasts an hour and is renewed with a token stored only as a hash, which ends 30 days after it last renewed its access.

How long it is kept

• Turning Always-on off deletes the copy. Answers stop at once; the stored copy, your assistants’ approvals and uncollected receipts are deleted; and the copy’s key is scheduled for deletion, after which no copy or backup can be opened. Amazon Web Services destroys the key 7 days later.
• The same happens when your place in the preview ends, when you delete your account, when you remove remote access from your main computer or sign out there, and when your main computer hasn’t uploaded for 30 days. If you remove your authenticator app, answers pause at once, and the copy is deleted unless you add one within 30 days.
• You can turn Always-on off, or sign an assistant out, from any computer signed in to your account.
• When you hide someone, delete or disconnect a source, delete a note or turn assistant access off, which takes notes out, the removal reaches the copy within about a minute while your main computer is online, and answers stop showing it. The stored copy still holds the removed data until a fresh copy replaces it, within 24 hours while your main computer runs. If your main computer goes off first, it stays stored until your main computer returns, or until the 30-day deletion.
• You can remove Tapestry PRM’s access to a Microsoft account at any time, at account.live.com/consent/Manage for a personal account, or at myapps.microsoft.com or through your IT team for a work or school account. The application then reads nothing new from it. For a personal account, what it already read stays on your device, and in the copy while Always-on is on. For a work or school account, whether you or your organisation removed the access, that account’s data leaves the copy, as a removal does, once the application next tries to read the account; it stays on your device.
• An older copy is deleted within an hour of its replacement loading. The copy has no backup or replica.
• A record of turn-offs, deletions and sign-outs, with no content, is kept for 8 days, so that restoring our systems can’t bring anything back.

Invites

With a Tapestry account you can invite people to the beta with your personal invite code, which up to five people can use. You can copy the code or a link and share it yourself, open an invite in your own email, or type someone’s email address and have us email the invite.

Your code. We keep a one-way fingerprint of your code, not the code itself, with how many people it can still admit and how many have joined with it.

Invites we email for you. We keep the address you typed, the name you gave for yourself, your optional note, and when the invite was created, sent and expires. Resend sends it, with at most one reminder, four to seven days after you asked, and keeps its own copy of each email for 30 days, and in its backups for up to 7 more. We delete the address, your name and your note when the person uses the invite, when you cancel it, or 14 days after you asked us to send it, whichever comes first. Cancelling stops the reminder but can’t recall an email already sent. A record of whether it was used, without the address, stays for 30 days so your application can show what happened. We don’t use the address for anything else or add it to any list. We don’t tell you whether the person already has an account or asked not to be emailed, and we don’t track whether invite emails are opened or their links clicked.

If you don’t want invitations. Every invite email has a link that stops further invite emails to your address. To honour it, we keep a keyed one-way fingerprint of your address until you ask us to remove it.

If you’re invited. The invite page asks for your name, your email address and your agreement to our terms and this notice, and records which code you used, so we know who vouched for you. We use them to decide on your access and to email you about it. To limit how many tries one network can make, we keep a keyed one-way hash of your network address for a day, and Supabase and Vercel, which passes the request on, receive the address itself. When you create your Tapestry account with the same address, we delete the request and keep only a count of people who joined with that code. A request that doesn’t lead to an account within 60 days is deleted. A request that is declined is deleted at once; only its address stays, until our reply is sent, for up to 7 days.

What the person who invited you sees. That their code or invite was used and, if they typed your address, which invite. Not whether you were given access or created an account, and nothing else about you.

Google user data in the Tapestry PRM app

This section applies when you connect a Google account to the application. The application talks to Google directly from your device. Servers operated by AMS Global Ventures, LLC store no Google authorisation codes, access or refresh tokens, and no Gmail data. They store Google Calendar and Google Contacts data only in an Always-on copy you turn on, as When it leaves your device describes. If you use remote access, an assistant’s connection to your main computer passes through our relay end-to-end encrypted, and the relay can’t read it.

What the application can access

Each Google connection asks for its own permission on Google’s consent screen, and every permission is read-only:

• Gmail (Google’s read-only Gmail permission): your email messages, including their headers, body text, attachments and labels, from a recent period of up to 90 days and new messages after that. The application cannot send, delete, label or change your email.
• Google Calendar, if you connect it: your calendar events and their details, such as titles, times, attendees and locations.
• Google Contacts, if you connect it: your contacts’ names and nicknames, email addresses, phone numbers, postal addresses, organisations and job titles, birthdays and other dates, relationships, contact groups, photos, website links and notes, and other details saved on a contact, such as chat handles, interests or custom fields.

The application also reads the email address of each Google account you connect, so it can label that connection.

How it is used

Google data is used only to provide the relationship features you see in the application: finding the people and organisations you correspond or meet with, showing when you were last in touch, building each person’s activity timeline, placing people and meetings on the Map, searching and opening the original evidence, and, if you turn them on, suggesting people you might invite to Tapestry PRM, and, when you ask for one, making a year-in-review card of the counts you choose. Suggestions are worked out on your device, and our servers don’t receive them. If you run a local model server on your device, the application may also use it to organise Google data. Such a model reads your data only to produce results for you; it is not trained or fine-tuned on it.

We do not use Google data for advertising, to decide creditworthiness or lending, or to create, train or improve any AI or machine-learning model. We do not sell Google data or transfer it to advertising platforms, data brokers or other information resellers.

Where it is stored

Imported Google data stays in your Tapestry folder on your device. Copies you make of that folder, such as backups or a synced folder, include it. The authorisation Google issues for each connected account is kept encrypted in the macOS Keychain on your device, and is not synced to iCloud Keychain.

Unless you turn on Always-on, no one at AMS Global Ventures, LLC can read your Google data: our servers don’t store it, and our relay can’t read the remote access connections it passes on. With Always-on, the copy on our hosted service holds your Google Calendar and Google Contacts data. No one at Tapestry can read it through any human read path, but code we deploy to the service can, and a legal demand served on us can require us to produce it. If you choose to share part of it with us, for example in a support request, we use it only to respond to you.

When it leaves your device

The application sends Google data off your device only in these cases:

• Always-on, if you turn it on. Your main computer sends an encrypted copy of what your approved assistants may read, including Google Calendar event details and Google Contacts, to our hosted service on Amazon Web Services in the United States, which reads it to answer them while your main computer is off. Assistants you approve for Always-on read it there whether or not assistant access is on. Gmail data isn’t in the copy. See Always-on above.
• AI assistants you connect. Apart from Always-on, only if you turn on assistant access, an AI assistant you set up can read relationship context to answer your request, and that context can include Gmail subjects, excerpts and participants and Google Calendar event details. This is the same whether the assistant runs on your device or reaches your main computer through remote access, whose connections pass through our relay end-to-end encrypted, so the relay can’t read them. Assistant access is off until you turn it on on the Ask page, and you can turn it off at any time. A cloud-based assistant sends what it reads to its provider under that provider’s own terms; a local assistant can keep it on your device.
• Invites you send yourself. If you open an invite to someone the application suggested, it opens a draft in your own email app with that person’s email address, and you decide whether to send it. Our servers don’t receive the address.
• A year-in-review card you save or copy. It holds only what its preview shows: counts, months, channels and any names you pick. It leaves your device only when you post or send it yourself, and our servers don’t receive it.
• Map places. To place calendar events and your Google contacts on the Map, the application sends only the city from an event’s location or a contact’s address, with its state or country where known, to OpenStreetMap Nominatim. It never sends names, email addresses, street addresses or other event or contact details.

The application’s diagnostics never include Google data, message content, contact details or Google tokens.

Keeping and deleting it

Imported Google data stays on your device until you delete it. Turning Always-on off deletes its copy, Google data included, as Always-on describes. Disconnecting a Google account in the application stops new imports and removes that account’s stored authorisation from your device; data it already imported stays until you delete it. Delete all Tapestry data on this device, in the application’s Settings, deletes it along with every Google authorisation on your device, after asking Google to revoke Tapestry PRM’s access. See Keeping and deleting local data above.

You can remove Tapestry PRM’s access at any time from your Google Account at myaccount.google.com/connections. The application then receives no new Google data.

Google’s policies

Tapestry PRM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy.

Joining the beta waitlist

Our signup form asks for your email address, your first and last name and a link to your LinkedIn profile. We use your name to address you, and your profile to help choose who to invite to the beta. The current form invites you to subscribe to Tapestry PRM emails from AMS Global Ventures, LLC about beta access, product updates and occasional offers. By choosing “Join the waitlist” under that notice, you request those emails, and since 3 October 2026 you also confirm that you are 18 or over and agree to our terms and this notice. You can unsubscribe at any time. The submission records your request, your agreement and its time against the version of the form you saw. No confirmation email is sent by the current form. Joining alone does not give permission for research calls or marketing for other ventures.

The form also asks:

• your role at your current or main company;
• what you want help with;
• which devices you would use Tapestry on, and how you would want it on your other devices;
• which AI assistants you use and, if you use one, how you would want it to answer when you ask from your phone;
• whether you have a computer that stays on, and whether privacy or always-available answers matter more to you;
• whether you would pay monthly for the setup you chose and, if you would or might, what monthly price would feel too expensive;
• whether you would join a short onboarding and discovery call.

Answering yes to the call question lets us contact you about the call. We use your answers to improve Tapestry, to plan testing and new features, and to help choose who to invite. The form does not connect accounts or grant access to messages or contacts.

With your request, the form also records how you reached us: the campaign named in the link that brought you to our website, if it names one (its source, medium and campaign name); if advertising is allowed, the click ID of an ad you followed; and if analytics is allowed, a random visit ID that links your request to that visit’s website diagnostics, such as the pages you read before joining. We use them to see which campaigns bring signups and, later, to report signups and other conversions to the ad platforms whose ads brought them. They are kept with your request and removed with it.

The current form is hosted by Tally. Requests from earlier forms that promised one access email keep that original purpose; this notice does not enrol those people in ongoing marketing. Earlier email-confirmation records remain in Resend, and earlier Tally records stay separate from the new subscription form. An old confirmation link cannot change your preferences. Joining does not guarantee an invitation, a release date or a particular testing group.

Joining the beta

If we invite you to the private beta, the agreement you gave when joining the waitlist covers the beta terms. If you joined before 3 October 2026, installing the application is your agreement, as our terms say. Your invitation also includes a personal download code. We keep only a one-way fingerprint of it, with your tester number, to check the code when you download and to switch it off if needed. We don’t record when you use it. During setup we note which Mac you use and which accounts you connect, so we can help you and fix problems. We keep those notes while you take part in the beta and delete them when you leave.

You book setup calls through Calendly, which holds the name, email address and answers you give when booking. Setup and feedback calls take place on Google Meet. With your permission, which we ask for before recording starts and which you can refuse or withdraw at any time, we record the call. Google Meet records the video, audio and anything you share on screen, and Granola, an AI note-taking service, transcribes the audio and writes notes. Recording is never a condition of joining the beta. Before you share your screen, close anything you don’t want recorded. We ask you to share only the Tapestry window, and you can pause sharing whenever messages or contacts are showing. Your screen may still show details of people you know, so we treat recordings as confidential: only our team can open them, we use them only to help you set up, fix problems and improve Tapestry, and we never use them to train AI models. Granola processes the audio under its own privacy terms. We delete recordings and transcripts within 90 days of the call and our call notes when you leave the beta, or sooner if you ask.

Website operation and correspondence

Vercel hosts the website and processes technical request information, such as IP addresses, browser information and request times, to deliver and protect it. If you write to us, our business email provider handles your address and message so we can respond.

We use PostHog and Sentry in the US to measure website usage, performance and errors. Reports use a random identifier and exclude form answers, email addresses and relationship content. If you join the waitlist while analytics is allowed, the signup form records that identifier as your visit ID, so we can link your request to that visit’s reports; the reports themselves still never include your email address or answers. Reports also include your IP address and the approximate location that PostHog and Sentry look up from it: your city, region and country, and in PostHog also your postal code and that area’s rough coordinates. In the EEA, the UK and Switzerland, and wherever we can’t tell your region, these reports wait for your analytics choice: nothing is sent and no identifier is stored unless you accept analytics. Turning analytics off in Your privacy choices stops them too, even if the Website diagnostics switch below shows On. The website also uses analytics and advertising tags from Google, Meta, LinkedIn, Microsoft, X and TikTok, loaded through Google Tag Manager under your choices, as Advertising and cookies describes. We do not use session replay. Fonts are served from this website. Tally loads only when you open the signup page or follow its form link. Tally’s own service has its own technical processing and privacy policy. We do not intentionally include email addresses or answers in website URLs or application logs.

Website diagnostics: On
Applies to this browser. Off clears unsent reports, not reports already received.

Advertising and cookies

Our website uses analytics and advertising tags to measure visits, to see which of our ads bring people to the waitlist, and to show our ads to people who have visited and to people like them. This section is about the website only: data from the Tapestry PRM application and the accounts you connect to it, including Google user data, never reaches advertising partners. This section and Your privacy choices apply to our website starting 20 October 2026, ahead of the rest of this notice.

Google Tag Manager loads the tags, and only under your choices. In the European Economic Area, the United Kingdom and Switzerland, and wherever we can’t tell your region, nothing loads until you accept. Elsewhere the tags run unless you opt out, and advertising stays off while your browser sends Global Privacy Control. While advertising is off, the Meta, LinkedIn, Microsoft, X and TikTok tags don’t run, the website removes ad click IDs from the page address and sends no hashed email, and Google’s tags set and read no advertising cookies. Google’s tags follow each of your choices through Google’s consent mode, so while you allow one category and not the other, they still run and can send Google signals without that category’s cookies, such as a page view or a waitlist signup. We work out your region from your country, which our host, Vercel, looks up from your IP address, and keep only whether it asks for consent first and whether your browser sent Global Privacy Control. The beta download pages and the remote access preview page never load the tags.

What the tags collect

• identifiers in the cookies the tags set or read, such as Google’s and Meta’s browser IDs, listed below;
• your IP address, and information about your browser and device, such as their type, version, language and screen size;
• the pages you visit on our website, their addresses, the page you came from, and which of our main links you follow;
• the click ID in the link of an ad you followed: Google’s gclid, gbraid or wbraid, Meta’s fbclid, LinkedIn’s li_fat_id, TikTok’s ttclid, X’s twclid or Microsoft’s msclkid;
• waitlist events: when you open the signup form and when you submit it, each with a random event ID;
• when you join the waitlist while advertising is allowed, a SHA-256 hash of the email address you entered, made in your browser, so that a partner can match your signup to an account you already have with it. The website never passes the tags the address itself, your name, your LinkedIn link or your answers, and neither the address nor its hash goes to PostHog or Sentry.

Who receives it

• Google: Tag Manager loads the other tags, Google Analytics measures visits and how pages are used, and Google Ads measures and targets our ads.
• Meta, LinkedIn, Microsoft, X and TikTok measure and target our ads on their platforms; Microsoft’s include Bing.

Each partner receives what its tag collects straight from your browser, and uses and keeps it under its own terms, which can include combining it with what it already knows about you, such as your account with it. See how Google uses information from sites that use its services, and the privacy policies of Meta, LinkedIn, Microsoft, X and TikTok.

Why, and our legal basis

We use this information for measurement (counting visits and how pages are used), attribution (counting the waitlist signups each ad brings), retargeting (showing our ads to people who have visited) and lookalike audiences (letting a partner find people similar to our visitors and to those who joined). In the EEA, the UK and Switzerland, we rely on your consent, which you give or refuse in the banner and can withdraw at any time. Elsewhere the tags run by default, and you can opt out at any time, as Your privacy choices explains.

Cookies and similar storage

These are the cookies the website and its partners typically use, and the website’s own storage. Partners change their cookies from time to time, and which ones are set depends on the tags and your choices, so this list can change. Each lifetime is the longest it lasts: your browser may end it sooner, and you can delete cookies in your browser at any time.

Your privacy choices

You decide which analytics and advertising cookies and tags the website may use in your browser. Use Your Privacy Choices at the bottom of any page to see or change your choice at any time.

Cookie settings

• Opting out. Outside the EEA, the UK and Switzerland, analytics and advertising are on until you turn them off. Turning advertising off opts this browser out of the sale and sharing of your personal information and of targeted advertising. Turning analytics off stops our own website diagnostics, and Google Analytics then sets and reads no cookies; with advertising off too, no tags load at all.
• Global Privacy Control. We honour a Global Privacy Control signal from your browser as a request to opt out of sale and sharing. While your browser sends it, advertising stays off, and Your Privacy Choices shows “Opt-out preference signal honored” with its advertising switch turned off.
• Consent in the EEA, the UK and Switzerland. There, and wherever we can’t tell your region, nothing loads until you choose. The banner offers Accept all, Reject all and Choose, and Choose lets you allow analytics and advertising separately. You can change or withdraw your consent at any time in Your Privacy Choices, as easily as you gave it. When you turn a category off, the page stops sending events to those tags at once and reloads under your new choice. Withdrawing doesn’t affect what was collected before.
• Where your choice is kept. Your choice is stored in this browser, in the tapestryConsent cookie, for 12 months. Because the website’s advertising data is tied to your browser rather than to an account, a choice applies to the browser you make it in: after clearing cookies, or in another browser or on another device, you choose again.
• Your relationship data is never part of this. The Tapestry PRM application, its diagnostics and the accounts you connect to it send nothing to advertising partners, and the website’s tags can’t see anything you keep in the application.

You can also limit the ads you see in each partner’s own ad settings, and block or delete cookies in your browser. To ask about these choices, email privacy@tapestryprm.com.

Providers and sharing

Vercel provides website hosting, holds the download-code fingerprints and delivers application updates. Supabase keeps the Tapestry account in the United States, and Resend sends its codes, security notices, invite emails and product email. Fly.io hosts the remote access relay in the United States, and Amazon Web Services keeps the DNS records for remote access addresses, and hosts Always-on and its copies in the United States, with each copy’s key in its key service. Tally stores new subscriptions, with your name, profile link, answers and how you reached us, and the record of your agreement. Resend holds earlier waitlist contacts and is our intended provider for access and marketing emails; the current Tally form does not automatically send information to Resend. PostHog and Sentry receive website and application diagnostics. Google, Meta, LinkedIn, Microsoft, X and TikTok receive website analytics and advertising data through their tags, as Advertising and cookies describes. Calendly schedules beta setup calls and holds the booking details you give it. Google Meet hosts the calls and stores the recordings of calls you agree to record, and Granola transcribes them and writes notes. Our business email provider handles correspondence. Our authorised team reviews requests and transfers only the information needed to send the emails you requested and respect your choices.

Our website’s analytics and advertising tags share cookie and device identifiers, your IP address, browser and device information, the pages you visit, ad click IDs, waitlist events and, when you join the waitlist, a hashed copy of your email address (identifiers and internet activity, in the terms of US state privacy laws) with Google, Meta, LinkedIn, Microsoft, X and TikTok, which use them to measure and target ads. Under the laws of California and some other US states, this may count as a “sale” of personal information or “sharing” for cross-context behavioural advertising. You can opt out at any time in Your privacy choices, and we treat a Global Privacy Control signal as an opt-out. We do not knowingly sell or share the personal information of anyone under 16. We do not sell or share your relationship data, your waitlist answers or anything from the application. We do not use submitted answers to train general-purpose AI models or send them to a generative AI service for analysis. We may disclose information we hold where legally required, to protect rights or security, or in a business transfer subject to continuing data-protection obligations and the commitments in this notice.

Tally states that responses are stored in Europe. Our team operates in the United States, and our other providers may process information in the United States or elsewhere. European storage does not restrict all access to Europe. Where information we hold is transferred from the European Economic Area, the United Kingdom or Switzerland to the United States, we rely on the safeguards in our providers’ data-processing terms, such as Standard Contractual Clauses or certification under the EU–US Data Privacy Framework and its UK and Swiss extensions. Contact us for a copy of the relevant safeguards.

Why we use information

Where a legal basis is required, we rely on your consent for the emails you requested. We rely on legitimate interests for your name, profile link and answers on the signup form, which help us choose who to invite and plan the beta, and for proportionate website security, pseudonymous website and application diagnostics that you can turn off, responding to enquiries and keeping limited records to respect withdrawals. We also process information where necessary to comply with legal obligations. For the Tapestry account, we rely on providing the account the application needs, on legitimate interests in the sign-in records, limits and notices that keep it secure, and on legitimate interests in telling you about Tapestry PRM by product email, which you can turn off at any time. For remote access, we rely on providing the feature you turned on, and on legitimate interests in the relay’s counts and limits, the list of issued address names and the notices that keep it secure. For invites, we rely on legitimate interests, yours in inviting people you know and ours in growing the beta, to email someone whose address you gave us, once plus one reminder; and on the steps needed to consider a request you make on the invite page. For the beta, we rely on the steps needed to provide the beta you asked to join, on legitimate interests in keeping a record of what you agreed to, and on your consent for an optional feedback conversation and for recording a call. For the website’s analytics and advertising cookies and tags, we rely on your consent in the EEA, the UK and Switzerland, as Advertising and cookies explains. You may withdraw consent without affecting earlier lawful processing.

A person plans invitations based on compatibility, relevant needs and testing capacity. We do not make solely automated invitation decisions.

How long we keep it

For the current subscription form, we retain your active email subscription, with your name and profile link, until you withdraw or twelve months after signup, whichever comes first, unless you actively renew your subscription. Discovery answers are removed within twelve months of submission or on withdrawal. Earlier one-email requests are removed after that access email, withdrawal or twelve months after signup, whichever comes first. Beta setup notes and download-code fingerprints are removed when you leave the beta. Call recordings and transcripts are deleted within 90 days of the call. We review and remove records manually; merely sending you an email does not restart the retention period. Invite addresses are deleted when the invite is used or cancelled, or 14 days after it was created; invite requests when they’re declined, when the account is created, or after 60 days. Your Tapestry account is kept until you delete it, with the shorter periods for codes, sign-ins and security records given in Your Tapestry account, and for remote access in Remote access.

We may retain a limited suppression record to avoid contacting you again, and the minimum consent evidence needed for a legal obligation or dispute. Those records are restricted to those purposes.

We keep correspondence for as long as needed to resolve the request and handle related obligations. We keep diagnostics only as long as needed to operate and improve the website and application, within our providers’ retention periods. Provider security logs and backups may expire on different schedules from active records. Contact us for details or to request deletion. Local data is kept on your device for as long as you keep it.

Your choices and rights

Email privacy@tapestryprm.com to unsubscribe, leave the waitlist, request access, correction or deletion, or ask about how your information is used. To have the fingerprint of your address removed from the list that stops invite emails, email our privacy address from that address and say so. Every marketing email will also include an unsubscribe option. You can delete your Tapestry account yourself in the application at any time. We do not require an account or participation in research to withdraw. Unsubscribing does not prevent you from using Tapestry when it becomes available.

Depending on where you live, you may also have rights to portability, restriction or objection, to opt out of sale, sharing or targeted advertising, and to complain to a competent data-protection authority. To opt out of sale, sharing and targeted advertising on our website, use Your Privacy Choices at the bottom of any page or turn on Global Privacy Control in your browser. In the EEA, the UK and Switzerland, you can also withdraw consent in Your Privacy Choices. Email us about any of these rights. We will not treat you differently for exercising your rights. We may need proportionate information to verify a request and respond within the period required by law. For local data, you exercise these choices yourself on your device, because we don’t hold it and can’t read it.

Children

Tapestry PRM is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 13 or seek children’s information through the waitlist. If you believe a child has given us information, contact us and we will delete it.

Changes to this notice

We update this notice when our practices change and show the effective date. For material changes, we give notice before they take effect, for example in the application or by email, and seek any renewed choice required before using information for a materially different purpose. If you have a Tapestry account, the application shows you each new version of this notice and our terms, with a summary of what changed, and asks you to agree to it. See our terms of service for the rules that apply to the application, the website and the waitlist.