Privacy

In short

No accounts

There is no ScopeBlind account, sign-in or password, and we set no cookies. Your browser creates a signing key. Its public half is how the service knows you.

What we keep

The names you type, the work you share, the decisions you sign and the public keys behind them. Contact details only when you send us a form, email us or set up a paid plan.

No training

ScopeBlind does not train models on your content or on anything else you give it.

What stays with you

Private signing keys stay in your browser. Files you open in Verify are checked in your browser and are not uploaded.

Who else receives data

Cloudflare hosts the service. A model provider receives text only when someone in the task uses a model feature. GitHub is involved when a repository is connected, and in the button demo and the coding trial, which run in a repository ScopeBlind owns.

What we cannot undo

Expiry ends access. It does not delete stored records. Records and links you have shared cannot be recalled. Deletion is by request.

Who we are

ScopeBlind is run by ScopeBlind Pty Ltd (ACN 693 027 440, ABN 41 693 027 440), an Australian company based in Sydney, New South Wales. In this policy, “we” and “us” mean that company. “The service” means scopeblind.com, the preview site at preview.scopeblind.com, and the hosted endpoints behind them.

For privacy questions, requests about your data, or security reports, email support@scopeblind.com.

This policy covers the hosted service. The open source gateway and verifier run on your own machines. What they read and write there stays with you, unless you turn on reporting to a hosted page, which is covered below. The Terms cover how the service may be used.

What we collect, and why

We collect what the service needs to run shared work between people, and what you choose to send us. We do not sell personal information and we do not use it for advertising. ScopeBlind does not train models on your content or on anything else you give it.

Shared work: tasks, projects, reviews and trials

When you start or join shared work, the service stores:

• The names you type: your display name, a client or project name, and labels for agents and devices. Names are guest labels. We do not verify them.
• The public keys of the browsers, devices and agents that take part, and the signed requests they send.
• The work itself: titles, briefs, success criteria, limits, preferences and assumptions, proposals, feedback, requested changes, approvals and their notes, withdrawals, acceptance decisions, and the event history.
• For invoice trials: the sample invoices and the sandbox ledger with its simulated payments.
• For repository reviews: the repository name, pull request number, base branch, allowed paths, required checks, commit identifiers, the list of changed files (up to 50, each with an optional excerpt of at most 400 characters), check results, and the preview that was observed.
• For coding jobs: the agreed limits, the request, the plan, the results, and the model’s replies, which include the contents of files it wrote.
• For model features: the model name, step and token counts, and the model’s proposed actions and outputs. We do not keep a separate copy of the prompt. For coding steps we keep a digest of the context.

Why: to run the task, show each person the same record, enforce the limits that were agreed, and produce a record that can be checked later.

One browser profile uses one signing key for every task it joins. That public key therefore links your activity across the service. It is a pseudonym, not anonymity.

Trials use fictional invoices, simulated funds and a disposable repository that ScopeBlind owns. Please use fictional information there. A real client review carries real repository names, file paths, excerpts, briefs and feedback, and this policy covers that too.

Private briefs

In a two-person agreement, each person can write a private brief. It is available to its author, their authorized agent, ScopeBlind, and the hosted model provider when a hosted assistant is used. It is stored on our servers as readable text. Shared exports leave private briefs out.

Enquiry form

When you ask about team setup, the form sends your work email and any setup context you choose to add. We use it to reply and agree the scope with you. The record is kept for up to 120 days. When email delivery is configured, the same details are sent to our inbox through Resend so that we can reply. The copy in our mailbox follows that mailbox’s retention and can outlast the 120 days.

Paid plans

For a paid plan we keep the billing contact, the organisation name and any tax number you give us, the invoices, and records of payments. We use them to invoice you, to send the reminder before Team’s free days end, and to meet company and tax law, which means keeping them for seven years.

Feedback form

The feedback form sends your note, the kind of note, an email address if you give one, the page and area you sent it from, and the first 200 characters of your browser’s user agent string. It is kept for up to 120 days and, when email delivery is configured, sent to our inbox through Resend. The emailed copy leaves out the user agent.

Network addresses

Cloudflare, as our host, processes the IP address and request details of every request. Our own code does not store your IP address as it arrives. To limit request rates and cap trials per network, it stores a SHA-256 hash of the address, in almost every place together with a fixed label. Repository setup records made before 20 September 2026 hold a hash without a label. Treat that hash as a pseudonymous identifier, not as anonymous data: anyone holding it could test candidate addresses against it.

Rate limit entries in the KV store expire with their window, one hour by default. Rate rows in the database, and the hourly counters for model features, are cleared in batches once they are about a day old. The hash recorded when a button demo request, a repository setup or a managed trial starts is removed after 30 days. Operational data is removed by a cleanup that runs every fifteen minutes, so each period ends shortly after it is due.

Secrets

Invitation secrets, pairing codes, access tokens and page write tokens are stored only as SHA-256 hashes. We keep the hash, not the raw value.

Where it is kept, and for how long

Retention differs by store, so there is no single figure. Tasks, invitations and permissions also expire: an invoice room and a repository task last at most seven days, a linked device at most seven days, and a project at most 365 days. Expiry ends access. It does not delete the stored record.

Where the table says there is no automatic deletion, the record stays until we remove it by hand. See Your choices.

What stays in your browser

• Your signing key. The key for shared work is created in your browser and kept in its IndexedDB storage as a non-extractable key. The page cannot export it and it is never sent to ScopeBlind. Only the public key and your signatures are sent.
• Authoring keys. The Write and Request pages also create their signing keys in your browser and keep them there. If you download a backup of one, that file is on your device and is yours to protect. We do not receive it.
• Local storage. Drafts on the Write and Request pages, practice trial state, shortcuts to your recent work, a saved invitation with its expiry, device permissions, setup drafts, your chosen agent client, and unsigned drafts of your own limits.
• Session storage. In-progress state for the current tab, such as the name you entered, an invitation secret, a pending setup, and one-step handoffs between the local tools. It is cleared when the tab closes.
• A service worker for reminders. Only if you turn reminders on. It shows the notification and opens your decisions. It keeps no cache.

Clearing site data removes all of this, including your signing key. We cannot restore it: there is no recovery backdoor. For repository projects, an encrypted recovery file that you saved can restore project membership under a new key. Its passphrase never leaves your browser. More on key custody.

What we do not collect

• No ScopeBlind account, password or sign-in. The one optional exception is connecting a repository through GitHub, which uses GitHub’s own sign-in. No email address or phone number is stored with shared work.
• No cookies set by ScopeBlind.
• No analytics, tag managers, tracking pixels, session replay or advertising.
• No third-party scripts, fonts, frames or forms on these pages. The site’s content security policy blocks them, and fonts are served from scopeblind.com.
• No payment card details. There is no checkout on the site.
• No camera, microphone or location access. The site’s permissions policy turns them off.
• No upload of files you open in Verify, Compare, Request, Control or Reliance. They are read in your browser.
• No request contents written to our application logs. The code logs error codes and, when a model provider returns an error, that error message.

Older changelog entries mention analytics and a checkout. Those belonged to a retired console and are not part of this site.

Other companies that handle data for us

We send data to these companies only for the purpose shown. Each handles what it receives under its own terms and privacy policy.

Email sent to support@scopeblind.com, and the enquiry and feedback notifications we receive, are held by our mailbox provider, Google Workspace.

Other people can also receive your data because of what you do: the other participants in a task, anyone you give a viewing link, share link, page link or preview address to, and any agent you connect, together with that agent’s own model provider.

Model providers

Text goes to a model provider only when someone in the task uses a model feature. Either person in a review can start Resolve this, and a live agent or coding job started by one person includes the other person’s feedback and notes. The ready-made paths work without a model: the guided walkthrough uses scripted requests, the button demo is deterministic, ready-made rehearsal cases need no model, and you can test another plan within both people’s limits without a hosted model call. When no model is configured, the Write page reads your sentences offline.

The hosted features use OpenAI. Write assistance uses OpenAI or Anthropic, whichever is configured, and the Write page names the provider and model in use. What is sent:

• Live invoice agent. The agreement (title, brief, preferences, assumptions and limits), the sample invoices, the operations so far, revision notes and recent tool results.
• Brief readback. The brief text.
• Rehearsal readback. Your text and the sample invoice context.
• Negotiation assistant. That person’s own private brief and preferences, both people’s shared limits, and the shared proposals.
• Resolve this. The task title, repository name, allowed paths, check names, the brief and success criteria, the commit identifier, changed file paths and excerpts, recent feedback and requested changes, agent recommendations, and approval and acceptance notes.
• Coding worker. The agreed coding limits, the review brief, the feedback, and the contents of the repository source files it works on.
• Write assistance. The recent conversation, the current readback and the names of your tools. We store none of it on our servers.

If your brief, criteria, feedback or source files contain personal or confidential information, the provider receives it. For a client review, that can include your client’s code.

ScopeBlind itself trains no models on what you send. For the hosted features, each request asks OpenAI not to store the response. That setting does not control the provider’s own retention, for example for abuse monitoring, and it is not set for Write assistance. We do not promise that a provider keeps nothing. Each provider handles what it receives under its own terms and privacy policy.

An agent you connect yourself uses its own model provider. That path is outside our control. See the data paths by mode.

Repositories, GitHub and previews

A reviewer needs no GitHub account. An organizer who connects a repository through GitHub signs in with GitHub once. We use that sign-in only for current reads and never store it. We do store a signed connection record: your GitHub login and numeric user id, the app installation id, the repository id and name, its default branch, whether you have admin or push permission, and when we observed it. We also keep a hash of the sign-in code and a proof that the installed workflow answered (repository id, run id, workflow reference and commit, and a digest of the workflow’s identity token). No GitHub token is retained.

The receiver is a workflow in your own repository. It keeps the repository’s write credential and its own signing key. Never paste a GitHub token or a private key into ScopeBlind. The receiver sends ScopeBlind its inspection of the pull request: the changed files, short excerpts, check results, the preview choice and commit identifiers. To start that workflow, ScopeBlind creates short-lived GitHub tokens limited to the one repository.

The button demo and the AI coding trial run in a repository on GitHub that ScopeBlind owns. Each trial creates a real pull request there. The pull request body carries a digest of the feedback, not its text. Treat anything you put into a trial as public.

A coding result is published as a static preview at preview.scopeblind.com. It is public to anyone who has its address and unlisted: search engines are told not to index it. Previews have no expiry today, and browsers and caches may keep a copy for up to a year. Do not put anything in a preview that should not be public.

Reminders

Reminders are off until you turn them on for a device. When you do, we store the push address your browser gives us, that device’s public key, when the subscription was made and when it expires, hashes of your inbox items (not their contents), and delivery attempts. A subscription lasts 30 days and is deleted 7 days after it expires or is revoked. If the push service reports the address as gone, the subscription is revoked automatically.

The push itself is a signed request with an empty body. It carries no task content and no credentials. Your device shows a generic notice, and opening it loads your current decisions. It approves nothing. Turn reminders off in the product or in your browser or system settings. More on devices and reminders.

Records you export and share

Nothing here is shared unless you choose to share it. Once you do, whoever receives the file or link can read and keep everything in it, and we cannot recall it.

• Signed evidence and the review package. The review package is one HTML file that carries the signed evidence, the verified preview bytes and an offline viewer. It opens without a network and sends nothing anywhere. It contains the display names, public keys, decisions and notes recorded in that review.
• View-only snapshot. An exact copy of a result or comparison, kept for 30 days. Anyone with its link can verify and download it. It includes display names, public keys and decisions. It leaves out private agent instructions, their salts, raw invitation secrets and agent credentials.
• Hosted share from Verify. The record files you select, with an optional sender line and note, kept for 180 days under an unguessable address.
• Published standard page. The signed standard (with the signer’s name, organisation and public key), the runs your gateway reports to it, held actions (tool, readback summary, a hash of the payload, amount, currency and reason) and signed approval decisions (approver name, public key and note). Each part is kept for 365 days from when it was written. Anyone with the link can read it. Reporting from a gateway is opt-in.
• Share cards under /v. The encoded evidence pack you submit and a few display fields taken from it. These are permanent.
• Invoice trial rooms. Anyone with a room’s viewing link can read its records and display names. A viewing link gives no decision rights.

Hosted connector for cloud agents

A cloud agent can reach ScopeBlind’s agent tools at https://scopeblind.com/mcp. The project tools, limits and human steps are the same as for an agent that runs on your own computer. The hosted connector also has two read-only tools. One summarizes a review, including its open Resolve this options, so the agent’s platform receives that text within the limits both people agreed. The other checks a record the person was sent: the record travels to ScopeBlind with the tool call, is checked in memory and is not stored.

The project’s organizer creates a connector on the project page. Its token starts with sbc_ and is shown once. Of the credential, ScopeBlind stores only a SHA-256 hash of the token and the connector’s public key. The connector’s signing key is derived from the token on each request and is never stored, so ScopeBlind cannot sign as the connector when the token is not presented. The organizer can revoke a connector at any time. A revoked token stops working immediately, and the service and its database refuse the connector’s key from then on.

A platform that supports signing in to an MCP server can connect without anyone copying a token. The platform sends you to scopeblind.com, you pick one of the projects your browser organizes, and your browser signs your approval with your own project key. ScopeBlind then gives the platform a one-time code, and the platform exchanges it once for the token. For that, ScopeBlind keeps the connection request described in the table above. When a platform identifies itself with a client ID metadata document, ScopeBlind fetches that document from the platform’s own address, which tells the platform that a connection was started. A platform that registers instead gets an identifier that carries its own registration, so registering stores nothing.

Someone with no project can connect a platform to start a trial on ScopeBlind’s demo repository instead. That connector is tied to the public key of the browser that approved it and to no project. When the agent starts a trial, ScopeBlind stores the name the agent suggests for the reviewer and a short note of what the person asked for, both as the agent wrote them, and shows them only to that browser. Both are cleared once the trial has ended, or about a day after the start expires unused. That browser then creates the trial and its project itself, so the trial’s records are the same as for a trial started on the site, and the connector joins that project.

The data path: the platform that runs your cloud agent sends the agent’s tool calls (draft briefs, criteria, findings and requested changes) to ScopeBlind over HTTPS. ScopeBlind stores the signed drafts and findings the connector authored, because they are part of the project record. It also stores the token hash, the connector’s public key, its label, the public key of the organizer who created it, when it was created, last used and revoked, and a saved copy of the project record and agreed limits the connector read, so that it can recognise the same agreement later. Its request rate limits are keyed by connector.

A connector is bound to one project and has no authority by itself. Approvals, acceptance and withdrawals stay with people on their own devices. The platform that runs your agent, and its model provider, see the tool records the agent reads. They handle that under their own terms.

Security

Hosted requests use HTTPS. People’s private signing keys stay in their browsers. A hosted connector’s signing key exists only while one of its requests is being served; it is derived from the token and never stored. Secrets are stored as hashes. The service signs what it observes with its own separate key. The site ships with a strict content security policy and sends no referrer.

We have not completed a SOC 2 report or an external security audit, and we will not claim certifications we do not hold. The detail is under Security and diligence on the How it works page.

To report a security problem, email support@scopeblind.com. The file at /.well-known/security.txt says the same.

Your choices

In the product you can revoke an invitation, pause a room, revoke an agent or a connector, revoke a linked device, cancel a repository task, stop preparation or coding permission, turn reminders off, and export your records. You can withdraw your own approval until delivery begins. The withdrawal is itself kept as part of the record. In your browser you can clear site data, which also removes your signing key.

There is no self-serve delete yet. To ask for access, correction or deletion, email support@scopeblind.com and tell us the task, project, link or public key concerned. We acknowledge a request within five business days and complete it within 30 days. There are no accounts, so before we act we need to know the records are yours: we will ask you to confirm the request from the browser that holds your signing key, using this page, or otherwise to show that the records are yours. We handle these requests by hand.

Some things we cannot delete or recall:

• Copies that other people already hold, such as exports, review packages, and snapshots or previews they downloaded.
• Records that other people signed and that name your public key or display name. Removing them would break their record, so we may need to keep them. We will tell you when that is the case.
• Digests that an earlier version of the service wrote to its public receipt log, and copies of public previews held by browsers and caches.
• Anything a model provider, GitHub or another company above already received. Their own policies apply.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. You may also have rights under the law where you live, and you can contact your local data protection authority.

Where data is processed

ScopeBlind Pty Ltd is in Australia. Cloudflare runs a global network, so data may be processed and stored in countries other than yours. The model providers, GitHub, Resend, Google and the push services are run by companies based in the United States. Using the features that rely on them sends the data described above outside Australia, and possibly outside your own country.

Age and work use

ScopeBlind is a tool for work, for people aged 18 or over. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe someone under 18 has given us personal information, email support@scopeblind.com and we will remove what we can.

Changes to this policy

When what we collect, keep or send changes, we update this page and the date at the top. If a change is significant, we say so at the top of this page.

Contact

ScopeBlind Pty Ltd (ACN 693 027 440, ABN 41 693 027 440), Sydney, New South Wales, Australia. Email support@scopeblind.com for privacy, data requests and security.