Legal

Privacy Policy

Last updated: November 4, 2026

Writ (“we”) provides the Service. This policy describes what data we collect when you use Writ — the scanner/CLI, the MCP server, the gate API, and the portal — and what we do with it. Questions about privacy: hello@withwrit.com.

What we collect

• Account information. Your email address, provided when you request an API key or sign in to the portal. We use it to identify your tenant and to contact you about your account.
• Service data. The metadata Writ needs to do its job: your API keys, your policy configuration, and the receipts in your audit log — who asked, what action was requested, which policy applied, and what Writ decided. This is the product working as intended.
• Billing data. Receipt counts used for metered billing. Payments are processed by Stripe; we never see or store your card number.
• Technical data. Basic request logs we keep for security, reliability, and debugging.

What we don’t do

• We don’t sell your data.
• We don’t use tracking or advertising cookies. The portal uses a session cookie to keep you signed in — that’s it.

How we use data

To operate and secure the service, to meter and bill usage, and to prevent abuse. One more use, for free and self-serve users only: scan findings, extracted features, and de-identified snippets may be used to improve the product, under the product-improvement license in our Terms. Raw code is never used this way, and an enterprise data processing agreement can carve this use out entirely.

Retention

Receipts stay in your tenant’s audit log until you delete your tenant or ask us to remove them. Account data is deleted when you close your account or ask us to.

Your rights

You can ask us to show, correct, or delete your data at any time — email hello@withwrit.com and we’ll handle it.

Changes

If this policy changes, we’ll update this page and the date above.