Privacy policy

Effective date: October 1, 2026

Who runs Sugarmaple

Stefan Rusek runs Sugarmaple as a sole proprietorship in South Carolina, USA. No other people or contractors work on it.

What data we collect

Your documents. Every document is a Markdown file in a GitHub repository your organization owns. Sugarmaple keeps its own clone of that repository and syncs it with GitHub in both directions. We keep no lasting copy of document content outside our clone of the repository and the search index, apart from what the providers below handle. The search index is stored in a database. Every save is a git commit, so a document's history lives in the repository.

Comments. We store comments in Sugarmaple itself, separately from your repository. Each comment records its document path, the commit it was made against, and sometimes a selection range.

Who made a change. Writes and comments record which person made them. They also record which agent made them, by name and version.

Account and sign-in details. You sign in through WorkOS. By default this is social sign-in. If your organization sets up SSO, it uses that. We receive your name and email. We also receive any other information your organization's SSO is configured to send.

Billing details. Payments go through Stripe. We keep only your Stripe customer ID. Stripe handles your card details.

Search data. We build a search index of your documents, by meaning and by exact text. To index by meaning, we send document text to an embedding provider. See "Who else handles your data."

Agent chat requests. Members of your organization can use the in-app agent chat. It sends their requests to Amazon Bedrock (AWS). It has the same tools as the MCP server and can read the whole repository.

Logs. We avoid logging user content. Logs carry only the minimal identity needed to link a user to their logs. That identity is not personally identifiable information, and logs carry nothing else about you.

How we use and store your data

We use your documents to sync your repository with GitHub, build the search index, and let the in-app agent chat read your repository. We use them for nothing else today. If that changes, we will update this policy before it does.

Sugarmaple stores this data on servers it operates in the United States. Other than GitHub, which hosts your repository, we do not store this data with any third-party storage service. There is one more exception. Bulk uploads pass through Cloudflare R2 for a short time, as a temporary step on the way in.

All traffic comes in through Cloudflare. At the edge, Cloudflare checks the request origin, tokens, an organization allow-list, and rate limits.

Data in transit is encrypted everywhere, including HTTPS to R2.

Each organization is isolated at its own subdomain, such as acme.sugarmaple.ai. A token for one organization is refused by another. Nothing in an organization can be read without signing in.

Agents and scripts act as the person who approved them. That person approves once in a browser, using OAuth with PKCE. Sugarmaple issues no API keys and no shared service accounts.

We connect to your repository through a GitHub App installed on your GitHub account.

Who else handles your data

• GitHub hosts your repository, which your organization owns. Our GitHub App connects to it.
• Cloudflare receives all traffic to Sugarmaple. It also holds bulk uploads briefly in R2 on the way through.
• WorkOS handles sign-in.
• Stripe handles payments.

Our accounts with the AI providers below are paid accounts. They are separate from Sugarmaple's own Free and Paid plans.

• Amazon Web Services provides Amazon Bedrock, which receives in-app agent chat requests. It also provides Titan embeddings, called through Bedrock, which index document text by meaning on Free plans. Bedrock does not store or log prompts and completions. It does not use them to train AWS models.
• Google provides Gemini Embedding 2, through Google AI Studio, which indexes document text by meaning on Paid plans. On Paid plans, images your documents reference from the repository are indexed too. Under Google's paid Gemini API terms, Google does not use prompts or responses to improve its products. It does log them for a limited period, to detect abuse and meet legal requirements.

Selling and model training

Sugarmaple never sells customer data. We do not train models on customer documents.

Cookies and analytics

There is no analytics on the site or in the app. We set no cookies beyond your sign-in session.

How long we keep it

When an organization is cancelled, or its repository is removed, every service we operate permanently deletes that organization's data within five minutes. That covers everything we hold for it, except what is listed below. A single person is a one-person organization, so cancelling it works the same way.

We keep the billing history. We also keep enough information to record that the organization existed.

We do not purge logs. We keep them with no fixed limit.

Google's limited abuse logging, described under "Who else handles your data," is Google's. It runs on Google's own schedule.

When a member leaves an organization that keeps running, their name and contributions stay with that organization. That includes the authorship on their writes and comments, and their account details, just as if they had contributed to the organization's git repositories. When the organization is cancelled or its repository is removed, this is deleted with the rest of its data.

Deleting or exporting your data

Your documents and their history are in your own GitHub repository.

To ask us to delete or export other data we hold, write to contact@sugarmaple.ai. We answer within 30 days. Log entries and billing records are not deleted; see "How long we keep it."

If you are in the EU or UK

You can ask to access, correct, delete, or export your data. Write to contact@sugarmaple.ai. We answer within 30 days. The exception is logs and billing records, which we keep, so we do not delete entries from them. If you are a former member of an organization, ask the organization to delete your data rather than writing to us. When it removes your material from its repository, that material is removed from Sugarmaple too. We do not remove a former member's material from a customer's repository ourselves. Comments and your account record live in Sugarmaple. Requests about them also go through the organization. You can also complain to your data-protection regulator.

Contact

Send privacy questions and requests to contact@sugarmaple.ai.

Stefan Rusek, Sugarmaple, South Carolina, USA.