Your Par is yours.

Who we are

Par is the service at par.works. Gustavo Scanferla builds it, and his company in Brazil runs it: GUSTAVO SCANFERLA ARAUJO TECNOLOGIA DA INFORMACAO, CNPJ 24.465.863/0001-00. When this policy says "Par", "we" or "us", it means that company.

Questions about your privacy go to us through the contact form, and a person answers by email.

What Par keeps

Your account. Your name, your email address and your password. We store the password only as a one-way hash, so nobody at Par can read it. If you sign in with Google, Google sends Par your name, your email address and an ID for your account, and Par keeps them. Par never sees your Google password, and signing in this way gives it no access to anything else in your Google account. We also keep your sign-in sessions and the workspaces you belong to.

Your plan. If you pay for a plan, Par keeps which plan your workspace is on, its status, when it renews and Stripe's reference for it. If you buy AI credits, Par keeps each purchase's amount and Stripe's reference for it. Your card and billing details stay with Stripe.

Your workspace. Everything you, the people you invite and the AIs you connect save in Par: records, notes, memories, chats with Par, apps, routines, and the links between them. If you save things about other people, like a contact or notes from a meeting, those are in your workspace too.

Files. The files you upload, their names and sizes, and the text Par reads from them so it can find things later. For audio, that includes a transcript.

Voice and Sonar. When you talk to Par by voice, Par can save a transcript of the conversation. When Sonar listens to a meeting for you, Par saves the transcript with the meeting. Everyone's voice in that meeting ends up in it, so tell the others Par is listening.

Services you connect. If you connect Slack, Notion, Linear or GitHub, Par keeps the access key for that service, encrypted, and what it brings in from it. Every time Par's AI runs, Par sends the keys for the services you have connected along with the request, so Anthropic's model can call those services itself.

Google Calendar. If you connect it, Par gets read-only access to your main calendar and never changes it. Par keeps the access key, encrypted. Par reads the events from the last 30 days and the next 30: their title, description, place, time, organizer, guests, whether each guest accepted, and a link back to the event. Events you marked private come too. It keeps them in your workspace so Par and your AI can use them for you. When Par's AI works with your events, they go to Anthropic for that task. Google data is never sold, used for ads or used to train AI models, and nobody at Par reads it unless you ask us to, for security, or where the law requires it. Par's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting stops Par from reading more; to delete what it already brought in, write to us.

Where you are, roughly. If you tell Par your city, region, country or time zone, Par keeps it in your workspace and uses it to make answers and searches fit where you are.

Notifications and WhatsApp. If you turn on notifications in the Par app, we keep your device's notification token. If you talk to Par on WhatsApp, we keep your number and the messages.

How Par is used. Our servers log requests, including IP addresses. Every change in a workspace is recorded with who or what made it. On this website and in the Par app we also measure which pages and buttons get used, including the words on the thing you click, and which errors happen. Cookies and analytics has the details.

Messages you send us. When you write to us through the form on the Support page, we keep your message and the email and name you give, so we can answer you.

What we use it for

• To run Par for you: keep your things, find them, show them, and let the AIs and people you choose work with them.
• To do what you ask: answer in chat, build and run apps, run your routines, transcribe, read aloud.
• To send the emails Par needs: sign-up codes and password resets.
• To answer you when you write to us.
• To charge for the plans and credits you buy.
• To keep Par safe and working: stop abuse, fix bugs, and see which features people use.

Nothing else. We don't sell your data, rent it out or use it for ads.

AI, both ways

The AI you connect. When you add Par to Claude, ChatGPT, Gemini, Grok, Cursor or another AI, you approve it in a Par window and pick a workspace. From then on, that AI can read, create, change and delete things in that workspace. What it reads goes to the company behind that AI and follows their privacy policy, not this one.

Par never reads your conversations with that AI, its memory or the files you give it there. Par only gets what your AI sends to Par: what it saves and what it asks Par for.

You can take that access back anytime in Par, under Settings, then Connected apps. That stops any new access. It doesn't pull back what the AI already read.

Par's own AI. When you chat with Par, or an app or a routine uses AI, Par sends the parts of your workspace the task needs to Anthropic, which runs the Claude models behind Par. Talking to Par by voice, Sonar, reading text aloud and making pictures use OpenAI. They process it to give Par its answer.

Searching the web. To answer something it doesn't know, Par's AI can search the web and fetch pages it finds, through Anthropic. What goes out is the words it searches for and, when your workspace has a location saved, the rough place it points to: your country, region, city and time zone.

Par Box. If you use Par Box to work on code, your instructions, the repository you connect and the session run in Anthropic's agent environment.

Training. We don't use your content to train AI models. Anthropic and OpenAI receive it through their business APIs, and under those terms they don't train their models on it.

Sharing inside Par

Your workspace. Everyone who belongs to a workspace can see what's in it.

Sharing an app. You can share an app with someone who has a Par account, as a viewer or an editor. They get the records in the collections that app uses, all of them, not only the rows on the screen. They don't get the rest of your workspace.

Sharing by link. You can also ask your AI for a link to an app. Anyone who has the link can open it without a Par account and see the same records a viewer would, but can't change them. Turn the link off, and it stops working right away.

Opening someone else's app. An app someone shares with you in Par runs inside your own signed-in Par session. Its code can reach what you can reach in your own workspace, and the sharing settings don't wall it off. An app you open from a link runs apart from your Par and can't reach it. Open apps only from people you trust.

File links. A link to a file works for anyone who has it, and it doesn't expire. Share a file link the way you'd share the file.

Once someone has seen something, they can keep a copy. Taking away their access stops them from seeing more.

Who else handles it

Par runs on a few companies' services. Each one handles your data only to do its job for Par.

Hetzner

Runs Par's server and databases in Hillsboro, Oregon, USA, and keeps our backups.

Cloudflare

Delivers par.works and the apps opened from a link, counts visits to the site's pages, stores the files you upload, relays calls in Par apps when two devices can't connect directly, and passes messages from the contact form on to our inbox.

Anthropic

Runs Par's AI, the Claude models. USA.

OpenAI

Voice, transcription, reading aloud and pictures. USA.

Mailgun

Sends Par's emails, from the EU.

PostHog

Analytics and error reports for this website and the Par app, in the EU.

Google

Lets you sign in with Google, if you choose to. Serves the fonts in the Par app and helps two devices find each other for a call. Hosts the email inbox where messages from the contact form arrive. Google Calendar too, if you connect it.

Apple and Google

Deliver notifications to your phone, if you turn them on.

Twilio and Meta

Carry WhatsApp messages, if you talk to Par there.

Stripe

Handles payments for paid plans and AI credits. You give your card and billing details to Stripe, and Par never sees your full card number.

Services you connect yourself, like Slack, Notion, Linear, GitHub or Google Calendar, follow their own terms.

We share data with anyone else only when the law requires it, like a valid court order. If Par ever changes hands, this policy keeps covering your data, and we'll tell you before anything changes.

Cookies and analytics

This website. PostHog measures how the pages of par.works are used: the pages you open, how far you scroll, what you click, the site and the campaign link that brought you, errors and loading times. It also records what happens on the screen, hiding everything you type into a form. If you then sign up, what you did here joins your new account. We use this to make the site clearer. It is never used for ads, and we never sell it.

In the EU, the EEA and the UK, none of this starts before you choose. A notice asks first, and until you answer nothing is stored in your browser and nothing about your visit is sent. Accept, and PostHog keeps an identifier in a cookie. Decline, and PostHog doesn't record the screen and still counts the pages you open and what you click, without knowing it was you; its only cookie then is the one that remembers your answer. Everywhere else, PostHog starts with its cookie on your first page. Wherever you are, you can change your choice.

Cloudflare delivers the site: it counts visits and loading times without cookies, though it can set one of its own to tell people from bots.

Apps opened from a link. They set no cookies of ours. Par counts each visit and notes the kind of browser, not who opened the app.

The Par app. When you use Par, it sets cookies that keep you signed in and protect your forms from forgery.

In the app and on its sign-in pages, PostHog measures how Par is used: the pages you open, what you click, errors and loading times. Once you sign in, this is tied to your account and email. PostHog keeps an identifier in your browser and records what happens on the app's screen so we can see and fix problems. Those recordings hide everything you type and all the text on the screen, and PostHog deletes them after 30 days. It drops IP addresses. It also saves what the app writes to the browser's console. A tracker blocker stops all of this, and Par keeps working.

There are no advertising cookies anywhere in Par.

How long we keep it

While your account is open, we keep your workspace. That's the point: Par remembers.

When you or your AI delete something, it leaves your workspace. The workspace's history of changes keeps a copy, so a mistake can be undone.

When you close your account, we delete your account and the workspaces you own, with their files and their history, within 30 days. Copies in backups go away as those backups expire. What you added to a workspace someone else owns stays there, because it's part of their work.

Messages you send through the contact form stay in our email inbox until you ask us to delete them. If one can't reach the inbox right away, Par's server keeps it until it gets through or we deal with it by hand.

We keep anything the law requires us to keep for as long as it requires, like payment records.

Your choices and rights

Cookies. Change your choice about PostHog's cookie whenever you like.

See and copy everything. Ask your AI to show you or export what's in your Par: it can read every record and file in the workspace you connected. Or write to us for a full copy.

Fix it. Change anything in Par, or ask your AI to.

Delete it. Delete anything in Par, or ask your AI to. Disconnect an AI under Settings, then Connected apps. To close your account, write to us through the contact form with the email on your account.

Depending on where you live, laws like the GDPR, the UK GDPR, Brazil's LGPD or California's CCPA give you the right to access, correct, delete and move your data, to object to some uses of it, and to complain to your data protection authority. Write to us to use any of them. We answer within 15 days, and it's free. A deletion can take up to 30 days to finish.

If you don't use Par but someone's workspace has information about you, write to us too.

Security

Par uses HTTPS everywhere. Passwords are hashed. The access keys for the services you connect are encrypted. Every request is checked against what that person or AI is allowed to see.

Par is not end-to-end encrypted. Par's servers can read your workspace, because that's how Par finds things and runs your apps. Only the people who run Par can sign in to those servers, and only to keep Par running, to fix a problem you tell us about, or where the law requires it. The machines are rented from Hetzner, which runs the hardware and holds the backups, so we count on them to keep the servers physically safe.

If a breach puts your data at risk, we'll tell you promptly.

Where your data goes

Par's server is in the United States, and so are Anthropic and OpenAI. Analytics and the emails Par sends run in the EU. Cloudflare and Google work worldwide. If you use Par from another country, your data travels to these places so Par can run.

Age

Par is for people 18 and older. If you think someone younger gave us their data, write to us and we'll delete it.

Changes

When this policy changes, we'll post the new version here with a new date. If a change matters, like a new use for your data, we'll tell you by email or in Par before it applies.

Contact

Write to us through the contact form, and a person answers by email. For help with Par itself, see Support.