Privacy Policy

Last updated: October 13, 2026

1. Who we are

Pencel ("we", "us", "our") is a desktop application that helps you build and run AI-powered workflows. Pencel is developed by Pencel.ai, Inc. This policy explains how we handle your information when you use the Pencel desktop app, our website pencel.ai, and Pencel Account (account.pencel.ai).

2. Local-first architecture

Pencel is built on a local-first architecture. Your data lives on your machine in a SQLite database. We do not operate cloud servers that store your content. Pencel sends data over the network only for these purposes:

  • Requests to AI model providers, sent directly with your own API key or through Pencel's model service when you use Pencel credits (see section 4)
  • Connections to third-party services you enable (Google Workspace, GitHub, Slack, etc.)
  • Sign-in, plan and credit checks with Pencel's account service
  • Checks for app updates
  • Anonymous usage data, only if you choose to share it

3. What stays on your machine

The following data is stored on your computer and is never stored on Pencel servers:

  • Run history and step logs
  • Artifacts and their contents
  • Memory store (episodic and long-term)
  • Settings and preferences
  • Chat session history
  • Workspace context files
  • Content read from your connected accounts, such as email and calendar events

4. What gets sent to AI providers

When an agent runs a task or you use the chat panel, Pencel sends a request to the AI provider that runs the model you chose. That request may include your instructions, active guidelines, context files, relevant memories, conversation history, and content Pencel read to do the work, such as an email you asked it to answer.

  • With your own API key, the request goes directly from your computer to that provider.
  • With Pencel credits, the request passes through Pencel's model service to the provider (Anthropic, OpenAI, Google or Fireworks AI). The model service does not log or store the content of your requests.

Your API keys are sent only as authentication headers, never in the request content. Each AI provider has its own data handling policies. We recommend reviewing the privacy policies of any provider you use.

5. How we protect your data

We treat the content of your connected accounts (such as your email and calendar), your sign-ins and your API keys as sensitive data. We protect it in these ways:

  • Encryption in transit. Pencel connects to Google, to AI providers and to Pencel's servers only over encrypted HTTPS (TLS) connections.
  • Encrypted credentials. Access tokens for your connected accounts, your API keys and your Pencel sign-in are encrypted before they are saved on your computer, using a key protected by your operating system (the Keychain on macOS, the Data Protection API on Windows, or the system secret store on Linux). If your computer can't provide this protection, Pencel refuses to save them. They are never saved in plain text.
  • Secure sign-in to your accounts. You connect an account in your own web browser, directly with the provider, so Pencel never sees your password for that account. The provider returns access only to your own computer. Your Google access tokens are sent only to Google and never to Pencel's servers.
  • Kept on your computer. Data Pencel reads from your connected accounts, and the work it produces from that data, is stored in a database on your computer inside your own user account. It is not copied to Pencel's servers. To encrypt this data at rest, turn on your computer's disk encryption (FileVault on macOS, BitLocker on Windows), which we recommend.
  • Least privilege. Pencel requests only the permissions its features need, and reads your data only when you use a feature that needs it.
  • You approve changes. Before Pencel sends an email or changes your calendar, it shows you the exact action and waits for your approval, unless you have chosen to allow that specific action automatically.
  • No content kept on our servers. When you use Pencel credits, AI requests pass through Pencel's model service on their way to the AI provider. The service does not log or store their content. It keeps only what billing needs, such as which model was used and the credits spent.
  • Protected servers. Pencel's servers hold only your account, plan and billing records, plus anonymous usage data if you share it. They run on Amazon Web Services, with databases encrypted at rest, service secrets kept in AWS Secrets Manager, access limited by AWS permissions, and activity in our AWS account logged and monitored for misuse.
  • Removing access. Removing a connection in Settings > Connections deletes its saved tokens from your computer. To also cancel Pencel's access on the provider's side, remove Pencel in that account's settings (for Google, at myaccount.google.com/permissions).

No method of storage or transmission is completely secure, but we design Pencel so that the data in your connected accounts stays on your computer and under your control.

6. Third-party integrations

Pencel can connect to third-party services such as Google Workspace (Gmail and Google Calendar), GitHub, Slack, Intuit QuickBooks Online, and others. When you enable an integration:

  • You authenticate directly with the third-party service via OAuth, in your browser
  • Access tokens are encrypted and stored on your computer (see section 5)
  • Data retrieved from these services is processed on your computer, and the relevant part is sent to your AI provider when a task needs it (see section 4)
  • We do not store your third-party data on our servers

Google API Services

Pencel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • What we access. When you connect Google Workspace, Pencel asks for two permissions: Gmail (read your email, send replies you approve, and mark messages read or unread) and Google Calendar (see your events, and create, change, delete or respond to events when you approve). Pencel does not request access to Google Drive or your contacts.
  • How we use it. Only to provide the features you use in Pencel: reviewing and sorting your inbox, drafting and sending replies, answering your questions about your email, and preparing you for your meetings.
  • Where it goes. Google data is processed and stored on your computer. When a task needs it, the relevant part (for example, the email you asked Pencel to answer) is sent to the AI provider that runs your chosen model, as described in section 4. Google data is never stored on Pencel's servers.
  • No AI training. Pencel does not use Google user data to develop, improve or train generalized AI or machine learning models, and does not transfer it to anyone for that purpose.
  • No advertising or sale. We do not use Google user data for advertising, and we do not sell it.
  • No human access. Pencel staff do not read your Google data. It stays on your computer, so we can't see it unless you choose to share specific content with us, for example in a support request.
  • Sharing. We do not transfer Google user data to others except to the AI provider for your task as described above, when you direct us to, or as required by law.
  • Security. Google data and your Google access tokens are protected as described in section 5.
  • Removing access. Remove the connection in Settings > Connections to delete its saved tokens, and remove Pencel at myaccount.google.com/permissions to cancel access on Google's side. Content Pencel already saved in your workspace stays on your computer until you delete it (see section 12).

Intuit QuickBooks Online

When you connect Intuit QuickBooks Online, Pencel accesses your accounting data solely to provide the features you request:

  • You authorize access in your browser directly with Intuit, and can revoke it at any time by disconnecting the integration in Pencel or from your Intuit account settings.
  • Your QuickBooks financial data (such as invoices, bills, customers, vendors, and reports) is retrieved and processed on your device by a local server that communicates directly with Intuit. It is never stored on, or transmitted to, Pencel servers.
  • So that Intuit credentials are never embedded in the desktop application, Pencel's servers broker only the OAuth token exchange and periodic token refresh. No accounting or financial data passes through this step — only the short-lived authorization tokens.
  • Pencel reads your QuickBooks data and, as its only write action, can log an expense — which always requires your explicit approval of each individual transaction before it is sent to Intuit. Pencel does not otherwise create, modify, or delete records in your QuickBooks account.
  • We do not use your QuickBooks data for advertising, and we do not sell it.

7. Account and authentication

If you create a Pencel account, we collect your email address, name, and profile picture (when signing in with Google or GitHub). This information is used solely for authentication and account management. Account data is stored in our backend database hosted on AWS.

If you use Pencel Account (account.pencel.ai) to create or join an organization, we also store the organization's name, its members' names, email addresses and roles, the email addresses invited to it, a record of changes to membership, and your web sign-in session. Your workspace content is not part of this and stays on your computer.

8. Analytics (opt-in only)

During the beta period, you can choose to share anonymous usage data to help us improve the product. You make this choice when you first sign in, and you can change it at any time in Settings > Privacy.

When opted in, we collect:

  • Session duration and frequency
  • Navigation patterns (which views you visit, not their content)
  • Feature usage counts
  • Counts of errors (error details stay on your computer)

We never collect conversation content, API keys, prompts, memory items, email or calendar content, or any personal data — even when analytics are enabled. Usage data sent to us is deleted automatically after 90 days.

9. Payments

Paid plans and credits are handled by Stripe. You enter your card or other payment details on a Stripe page, so they go directly to Stripe and never reach Pencel. We keep your Stripe customer ID, your plan and its status, and a record of your purchases and credits, so we can provide what you paid for. Stripe's use of your information is covered by theStripe Privacy Policy.

10. Our website and Pencel Account

  • Visit logs. When you visit pencel.ai, our hosting service (Amazon CloudFront) records a standard log of each request: your IP address, browser type, the page requested, the referring page and the time. When the Pencel app checks updates.pencel.ai for a new version, the same kind of log is recorded. We use these logs to count visits and installs and to keep the service secure, and delete them after 13 months.
  • Cookies. pencel.ai does not use advertising or tracking cookies. Pencel Account (account.pencel.ai) uses one essential cookie to keep you signed in. It ends after 24 hours without use and after 7 days at most. A second cookie lasts 10 minutes while you sign in.
  • Contact form. When you use the contact form, we receive your name, email address, message and any file you attach, such as a resume, by email. We use them only to reply to you and, for job applications, to consider your application.
  • Security records. Our servers use your IP address and email address to limit repeated sign-in and sign-up attempts. These records are deleted automatically within a day.
  • Emails from us. We send account emails, such as email verification and password reset, through Amazon Simple Email Service.

11. Who we share information with

We do not sell your personal information and do not share it for advertising. We share it only with these service providers, and only as needed to run Pencel:

  • Amazon Web Services: hosting for our servers and website, and sending account emails
  • Stripe: payments
  • Google and GitHub: only if you choose to sign in with them
  • Anthropic, OpenAI, Google and Fireworks AI: the AI requests you make with Pencel credits (see section 4)

We may also disclose information if the law requires it, or to protect the rights and safety of our users or Pencel. If Pencel.ai, Inc. is involved in a merger or acquisition, we will tell you before your information becomes subject to a different privacy policy.

12. Data retention

Local data is retained on your machine until you delete it. To delete it, follow the steps in our Data handling guide. Account data is retained as long as your account is active. Payment records are kept as long as tax and accounting law requires. Analytics events older than 90 days are automatically pruned from local storage. You can request deletion of your account and associated data by contacting us.

13. Your rights

You can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. Emailsupport@pencel.ai from the email address on your account. We reply within 30 days. Depending on where you live, you may have other rights under local law, and we will honor them. We will not treat you differently for using these rights.

14. Security incidents

If a security incident affects your personal information, we will tell you without undue delay, along with any authorities the law requires us to notify. To report a security problem in Pencel, see ourSecurity page.

15. Children's privacy

Pencel is not directed at children under 13. We do not knowingly collect personal information from children under 13.

16. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by updating the date at the top of this page and, where appropriate, through the application.

17. Contact

Pencel.ai, Inc. is responsible for your information under this policy. If you have questions about this privacy policy or your data, contact us at support@pencel.ai. To report a security problem, email security@pencel.ai.