Privacy Policy

// who we are

Clause ("we", "us") is a collaborative LaTeX editor available at clause.studio. It is an independent project run by its developer, not a large company. For that reason, this policy describes what the product actually does today, rather than every hypothetical. Questions or requests: admin@clause.studio.

// what we collect

• Account data: your name, email address, and password (stored only as a cryptographic hash, which we cannot read). If you sign in with Google, we receive your Google profile name, email, and avatar instead of a password.
• Your content: the documents, files, and images you create or upload, and the PDFs compiled from them. Files an AI agent adds on your behalf are part of your content too. Collaborators you invite to a project can see that project's content. That is the point of inviting them.
• Operational data: server logs (requests, errors, timestamps), kept for 30 days, used to keep the service running and debug problems. They record which requests were made, never what your documents contain. We do not run advertising or third-party analytics trackers; the only cookies we set are the ones that keep you signed in.

// google sign-in

If you sign in with Google, Clause asks Google only for your profile name, email address, and avatar, to create or match your account. The sign-in token Google issues is stored in our database, which is encrypted at rest, and is used only to confirm who you are. Clause does not request access to Google Classroom, Google Drive, or any other Google data today; if an integration with them launches, this policy will describe it before it does.

Clause's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

// where your data lives

Clause runs on Amazon Web Services. Documents and files are stored in Amazon S3 and metadata in Amazon DynamoDB, both encrypted at rest; all traffic uses TLS in transit. Real-time collaboration relays your document edits through Clause's own sync server. Transactional email (verification codes, invitations) is sent through Resend. The optional built-in writing assistant processes your document text on Clause-operated servers; it is not sent to third-party AI providers and is not used to train models. AI agents you connect yourself are different, and the next section is about them.

// connected ai agents

You can connect an AI client (such as Claude or ChatGPT) to Clause through the Model Context Protocol (MCP). The connection starts with a sign-in to Clause and a consent screen that lists what the agent will be able to do; nothing is connected until you approve it.

• What reaches the AI client: when the agent uses Clause's tools, it receives what it asks for: the names and contents of documents in projects you can open, file lists, compile results and excerpts of compile logs, links to compiled PDFs and image files, and the names of your groups and of their members (never their email addresses). From that point the AI provider's own terms and privacy policy govern that data; Clause does not control what the provider keeps.
• What the AI client sends to Clause: the edits and new files the agent makes on your behalf. An image you attach in the chat and ask the agent to add is downloaded by Clause from the AI provider's temporary link and stored in your project like any other upload.
• The editor beside the chat: in AI clients that support it, the agent can open the Clause editor next to the conversation. It runs on a credential valid for ten minutes at a time, which the client renews while the editor is open, and it shares with the client's model only the project name, the name of the file you have open, and the text you currently have selected (up to 400 characters), never the rest of the document. What you type there is yours, not the agent's.
• What Clause stores for a connection: the AI client's registration, your consent, and the tokens that keep the connection alive. An access token lasts one hour; the refresh token that renews it lasts 30 days after its last use, so an agent you stop using disconnects by itself within 30 days.
• Attribution: edits an agent makes appear live to your collaborators under your name, marked "(via AI Agent)".
• Disconnecting: remove the connector in your AI client; its access ends within an hour. Clause has no button to revoke an agent yet, and changing your password or signing out of the website does not disconnect one. Deleting your account ends every connection and removes its records.

// retention & deletion

• Your content stays until you delete it. Deleting a file or a project removes it from Clause immediately; the copies we keep for recovery are gone within 90 days.
• Compiled PDFs, compile records, and compile logs are deleted automatically 30 days after compilation.
• Server logs are kept for 30 days.
• Account deletion is self-service: open the account menu on the projects page, choose "delete account", and confirm through the link we email you. Before the account record is removed, we purge your projects and files (including compiled PDFs), your settings, and the consents and tokens of any AI agent you connected. A linked Google account is disconnected and its grant revoked on Google's side. If you prefer, emailing admin@clause.studio works too.

// your rights

Under the Brazilian LGPD (and similar laws elsewhere), you can ask us to access, correct, export, or delete your personal data. Write to admin@clause.studio for any of these. The same address receives security reports, and reaches the person who actually operates the service.

// children

Clause is not directed to children under 13.

// changes

If this policy changes materially, we will update this page and its date. Continued use after a change means you accept the updated policy.