Privacy Policy

1. Scope and accountability

This policy covers the Knit website, authentication flow, and hosted workspaces. Knit is operated by Threadlabs Studio, the registered sole proprietorship responsible for personal information. The Threadlabs Studio Privacy Lead is accountable for compliance and privacy requests.

Contact the Privacy Lead to ask a question, exercise a privacy right, or make a complaint. The private request queue sends requests directly to the operator and is Knit's public privacy contact route.

2. Information Knit collects

• Account information: the Google account identifier, email address, and profile details returned for sign-in.
• Early-access requests: the email address and optional note you submit when asking to join the public beta, plus approval status kept separately from public pages.
• Workspace information: workspace name and URL, membership, pages, images, and other content you choose to add.
• Service information: timestamps, page and workspace identifiers, security events, request metadata, IP address, browser or device information, and coarse error outcomes needed to operate and protect Knit.
• Request protection: a keyed network-source fingerprint used to limit contact-form and early-access-request abuse. The private request queues do not store the raw network address.
• Product analytics: during the private beta, Knit uses PostHog to understand how the product is used and to improve it. This includes pages you view and navigation within Knit, interactions such as clicks, error and performance diagnostics, and technical context such as approximate location derived from your IP address, device, browser, and referring page. Session recording is a private-beta feature that replays the layout of app screens and interactions such as clicks and scrolling. Text, images, and form values are masked in recordings; page URLs, account identity, and diagnostic events are not hidden by this recording mask. Analytics also includes the two workspace activation signals (first page created and later retrieved). Knit links this analytics to your account, including your sign-in email and name, so it can understand usage per person and per workspace. Taking part in the beta includes this analytics and there is no opt-out during the beta; after the private beta it becomes optional. Knit does not sell this data or use your workspace content for advertising.
• Support and feedback: when you use the signed-in Help & feedback messenger, Knit sends Featurebase a Knit-specific pseudonymous account identifier and your account display name. Featurebase also receives the messages and feedback you choose to submit and the technical data its widget necessarily processes. Knit does not automatically send your email address, workspace identity, page content, page title, current URL, PostHog identifier, or activity history to Featurebase.
• AI-assisted features: When AI features are enabled for a workspace, Knit may send relevant workspace content to an AI provider to help people create, organize, understand, and maintain their knowledge. This can happen when someone asks for help or automatically while the feature is enabled, including after workspace content changes. Depending on the task, the content may include page text, titles, changes, workspace guidance, and related passages. Results may include suggested wording, summaries, categories, and possible issues between pages. Knit and its AI providers do not use workspace content to train AI models.
• Personalized features: Knit records account activity, such as pages you view and when, to personalize your experience, show relevant updates, and help you keep track of workspace knowledge. Activity records used for these personal features are private to you and are not shared with other workspace members.
• Device storage: authentication cookies plus local browser storage for pending Site creation, search history, display preferences, and recoverable unsaved page drafts.

3. Why Knit uses information

Knit uses this information to review early-access requests; authenticate you; create and operate workspaces; save, retrieve, and search content; provide AI assistance with creating, organizing, understanding, and maintaining workspace knowledge, including automatic suggestions, categorization, and checks when enabled; personalize your experience and show relevant workspace updates; provide security and support; diagnose failures; prevent abuse; and meet legal obligations. During the private beta, the two events help Threadlabs Studio understand whether people reach Knit's first useful loop and where the beta needs improvement. Knit does not use workspace content for advertising and does not sell personal information.

4. Service providers and transfers

Knit relies on providers that process information to deliver the service:

• Google provides account sign-in.
• Supabase provides authentication, database, file storage, and related infrastructure.
• Vercel hosts and delivers the web application.
• Resend sends transactional workspace and beta invitation email and reports delivery outcomes.
• PostHog provides product analytics, session recording, and error tracking from its United States cloud region.
• Featurebase provides the private in-product support and feedback messenger.
• DeepInfra processes relevant workspace content for AI-assisted knowledge features using open models. It does not store what Knit sends or use it to train models.
• OpenAI processes relevant workspace content for AI-assisted knowledge features. It does not use what Knit sends to train its models. Its retention of API content is described below.

These providers may process information in Canada, the United States, or other countries where they operate. Information in another country may be accessible to courts, law enforcement, and national-security authorities under that country’s laws.

5. Sharing

Knit shares information with service providers only as needed to operate the service; with workspace members you invite or otherwise direct Knit to share with; to protect rights, safety, and security; or when legally required. Knit does not currently provide public pages, advertising profiles, or data-broker sharing.

6. Retention and deletion

Workspace content and account information are kept while the workspace is active. After a verified deletion request, live workspace content is deleted within 30 days. Account-deletion requests include a 30-day recovery period before permanent deletion. Residual encrypted backup copies are isolated from ordinary use and expire within 90 days.

Content-free operational security events are retained for 30 days. Contact requests, early-access requests, and private invitation-delivery records are retained for up to one year so Threadlabs Studio can answer, review, and diagnose a request or expected transactional email. Invitation-delivery records contain the recipient address, initiating operator, provider message identifier, delivery state, and event times; they do not contain workspace or page content. A problem report may include a small diagnostic envelope containing the application revision, deployment environment, a safe error code and surface, and a coarse viewport class; it does not include workspace or page content, URLs, raw identifiers, credentials, payment data, screenshots, raw logs, or raw errors. An active early-access approval is kept while it is needed to control Site creation. Records that must be preserved for fraud prevention, dispute resolution, or a legal obligation are kept only for that purpose and then deleted or de-identified.

PostHog session recordings are retained for up to 30 days. Other PostHog product analytics and error data are retained for no more than one year. After a verified request to delete them, Threadlabs Studio requests deletion of the associated person, events, and recordings and verifies completion within 30 days. Provider deletion may finish asynchronously during that period.

Featurebase support conversations and feedback are retained for up to one year so Threadlabs Studio can respond, identify recurring problems, and improve Knit. You may request earlier deletion through the private contact form, subject to legal, fraud-prevention, or dispute-resolution needs.

AI providers: DeepInfra does not retain what Knit sends to its open models. OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, or longer where required by law or reasonably necessary to protect its services or third parties. AI results that Knit saves with workspace content follow the workspace-content retention and deletion rules above.

These personal activity records are kept within your workspace’s available history. They are removed when that history expires, you lose workspace access, or the associated content or your account is deleted.

Browser-stored drafts and preferences remain on that device until saved, discarded, cleared by the user, or removed by the browser.

7. Safeguards

Knit uses access controls, workspace isolation, encrypted transport, short-lived authentication handoffs, and restricted operational events. No system is perfectly secure; suspected misuse or a security incident should be reported through the private contact form.

8. Your choices and rights

During the private beta, product analytics is part of taking part and cannot be turned off; it never affects your beta access. After the private beta it becomes optional, and you will be able to change or withdraw your choice through Product analytics in the account menu. You may ask for earlier analytics data, session recordings, and events to be deleted through the private contact form at any time.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, withdraw consent, or challenge how it is handled. Submit these requests through the private contact form. You can also sign out, clear local browser data, or ask a workspace administrator to delete the workspace.

If Threadlabs Studio does not resolve a privacy complaint to your satisfaction, you may contact the Office of the Information and Privacy Commissioner for British Columbia.

9. Children and changes

Knit is not directed to children under 13. The policy will be updated when practices materially change, with a revised effective date and notice appropriate to the change.