Privacy Policy

1. Introduction

This Privacy Policy describes how Farpoint Technologies Inc. (“Farpoint”, “we”, “us”, “our”) collects, uses, discloses, and protects personal information in connection with the Fabric software platform (the “Service”). This Privacy Policy supplements and is consistent with our Terms of Service, Section 13.

Fabric is delivered primarily as a desktop application (Mac, Windows, Linux), and is also available as a mobile app for iPhone. On desktop, most of your data — your source code, prompts, AI outputs, and conversation history — stays on your local device and is never transmitted to Farpoint when you use a local model or your own API keys. The mobile app works differently, as described in Section 2.1. Voice features, including the mobile app’s optional Ambient Capture, are described in Section 3.5. Conversation archiving, which applies only to members of an enterprise organization that has switched it on and has notified them, is described in Section 3.8. This Privacy Policy explains the limited circumstances in which Farpoint does receive personal information, and what we do with it.

If you do not agree with this Privacy Policy, please do not use the Service.

2. What we do not collect

Because of how Fabric is architected, there are several categories of data we do not collect by default:

• Customer Code. Your source code stays on your device. Farpoint does not have copies, indexes, or backups of your codebase.
• Inputs. Prompts, instructions, file selections, and other content you submit to the AI inside Fabric stay on your device when you use a local model or your own API keys.
• Outputs. Code suggestions, refactorings, and other AI-generated content stay on your device under the same conditions.
• Chat history. Your conversations with the AI are stored locally in the Fabric app’s local storage. Farpoint does not maintain a server-side record of your chats. The one exception is conversation archiving for organization-managed accounts, described in Section 3.8.

One exception applies to everything in this list. If you are a member of an enterprise organization, that organization has switched on conversation archiving, and you have been shown its notice and have acknowledged it, copies of your conversations are stored for that organization as described in Section 3.8. Those copies can include code and other content that appears in a conversation, and they are made even when you use a local model or your own API keys. This never applies to individual accounts, free or paid.

When you choose to use a Farpoint-hosted inference endpoint, your Inputs and Outputs are transmitted to Farpoint’s servers for the sole purpose of generating a response. Those servers do not log the content of Inputs or Outputs in the normal course of operation. The only exception is the abuse-review procedure described in Section 5.4 of the Terms of Service, which is gated by written authorization from Farpoint’s Chief Security Officer.

2.1 The Fabric mobile app

The Fabric mobile app stores your conversations on your phone; Farpoint does not maintain a server-side record of your chats. However, unlike the desktop application — which can run local models or use your own API keys — the mobile app generates responses exclusively through Farpoint-hosted inference endpoints. This means that when you send a message in the mobile app, its content (and any images you attach) is transmitted to Farpoint’s servers to generate the response, under the same no-logging and no-training commitments described in this Section and Section 8. If you enable web search, your search queries are also sent to Farpoint’s search service to retrieve results. Usage metadata required for billing (token counts, model, timestamps — never message content) is retained as part of your billing records.

You can permanently delete your Fabric account, including all associated server-side data, directly in the mobile app under Settings → Delete account, or on the web at codewithfabric.com/account/delete (see Section 9).

3. What we do collect

3.1 Account information

When you create an Account to use Fabric, we collect:

• your name and email address;
• a password (stored as a salted hash);
• billing information (processed by Stripe, Inc., our payment subprocessor — see Section 5);
• subscription tier and entitlements;
• the team or organization you belong to, if any;
• security audit data (login times, IP address at sign-in, multi-factor authentication status).

3.2 Opt-in usage analytics

Fabric can collect redacted, opt-in usage telemetry to help us improve the Service. This collection is:

• off by default;
• controlled by you in Fabric → Settings;
• collected via PostHog, Inc. (PostHog Cloud, hosted in the United States), our analytics subprocessor;
• redacted at the source — we strip Customer Code, Inputs, Outputs, file paths, and any content that could identify a specific user or organization before the data leaves your device.

What we do collect through PostHog (when enabled): anonymized event counts (e.g., “code completion accepted”), feature usage breakdowns, error categories, latency measurements, and operating-system / Fabric-version metadata.

What we do not collect through PostHog: code content, prompt content, response content, file paths, project names, user names, email addresses, or any other personal identifier.

3.3 Support communications

If you contact us at any of our operational mailboxes (support, privacy, security, legal, billing @farpointhq.com), we retain your messages and any information you choose to share for the purpose of responding to your inquiry and improving our support quality.

3.4 Bug reports

If you click the in-app “Bug Report” button, Fabric uploads diagnostic logs and the specific chat that is open at that moment, with your explicit consent, so that we can investigate the issue. Bug reports are reviewed only by Farpoint engineering personnel and are deleted within 90 days of resolution.

3.5 Ambient Capture and voice features

Ambient Capture is a feature of the Fabric mobile app that turns conversations you choose to capture into a transcript you can ask Fabric about later. It is off by default. The app records nothing until you switch Ambient Capture on and accept the consent screen, and it stops recording when you switch it off. While it is on, the app records ambient audio through your phone’s microphone and produces a transcript that labels who is speaking (up to 15 speakers).

• Where the audio goes. The app uploads the audio in short segments over an encrypted (HTTPS) connection to Farpoint’s speech-to-text gateway at stt.codewithfabric.com. The gateway passes each segment to Soniox, our speech-to-text subprocessor (see Section 5), and returns the transcript to your phone.
• What we keep. Nothing. For every segment, the gateway deletes the uploaded audio and the transcription held by Soniox once the request is finished, including when the request fails. If a deletion request to Soniox itself fails, Soniox deletes the data automatically after 30 days. Farpoint does not store your audio or your transcripts on its servers.
• What stays on your phone. Transcripts are stored on your phone. By default, the audio recorded on your phone is deleted as soon as it has been transcribed. You can choose in the app’s settings to keep it on your phone for up to 7 days, after which it is deleted.
• When a transcript reaches an AI model. Only when you include it in a question you send in chat. It is then handled like any other chat message, as described in Section 2.1.
• Your control. You can switch Ambient Capture off at any time. Because transcripts and audio are stored only on your phone, deleting the Fabric app removes them.

Recording other people. In many places the law requires the consent of everyone in a conversation before it is recorded. You are responsible for getting any consent the law requires before you capture a conversation with Ambient Capture. The app reminds you of this when you switch the feature on.

Dictation. When you dictate a message in the Fabric desktop app, audio from your microphone is streamed over an encrypted connection to the same speech-to-text gateway, only while dictation is active, and passed to Soniox for transcription. The resulting text is inserted into your message on your device. Neither Farpoint nor Soniox stores dictation audio: Soniox processes it as it arrives and does not keep it.

Voice mode. When you talk to Fabric by voice in the desktop app, your speech is transcribed the same way as dictation, and the transcript is sent to a Farpoint-hosted AI model like any other chat message (see Section 2). To speak the reply, Fabric sends the text of the reply to Farpoint’s text-to-speech gateway at tts.codewithfabric.com, which passes it to Soniox to generate the spoken audio and streams that audio back to your device. Only text is sent for speech generation. Neither Farpoint nor Soniox stores the reply text or the generated audio.

3.6 Remote-access relay

When you use the Fabric mobile app or a browser to work with Fabric on your computer, messages between your devices pass through our relay at relay.codewithfabric.com. The relay forwards messages between your devices and never stores their contents. It records only minimal connection information (account and device identifiers and timestamps, no IP addresses) to keep the service working, and the time each device was last seen so we can show whether it is online. Relay traffic is encrypted in transit, but it is not yet end-to-end encrypted.

3.7 Mobile notifications

If you allow notifications in the Fabric mobile app, we store your phone’s push token against that phone’s entry in your device list, so we can tell you when a reply is ready, when an agent on your computer needs your approval or has a question, or when your computer goes offline mid-task. Apple (for iPhone) and Google (for Android) deliver these notifications. A notification contains only the kind of event and opaque identifiers for the chat and the computer. It never contains your chat titles, messages, commands or files; the app fills in names from data already on your phone. We never send marketing notifications. You can turn notifications off in the app’s settings or your phone’s settings; signing out removes the push token.

3.8 Organization-managed accounts (conversation archiving)

This Section applies to you only if all three of the following are true:

• you are a member of an enterprise organization on Fabric (a team on an Enterprise agreement with Farpoint);
• that organization has switched on conversation archiving. It is off unless the organization’s owner turns it on; and
• Fabric has shown you a notice that names the organization, says what is copied, who can read it, how long it is kept and whom to ask, and you have acknowledged it.

This Section never applies to individual accounts, free or paid. If you use Fabric on your own account, if your team is not an enterprise organization, or if your organization has not switched archiving on, nothing is archived and Section 2 applies to you in full.

What is stored. When all three conditions are met, the Fabric desktop application sends copies of your Fabric conversations to an archive that Farpoint operates on the organization’s behalf. A copy contains the text you write, the AI’s visible replies, the tools the AI used together with what was sent to them and what they returned (which can include code and file contents that appear in the conversation), the chat title, the model used, and the names and sizes of attachments. It does not contain the contents of attached images or files. Copies are made whichever model you use, including a local model or your own API keys. Only messages sent after you acknowledge the notice are copied; earlier history is never uploaded, even if you continue an older chat. Conversations that exist only in the Fabric mobile app are not archived.

Who can read it. Only people in your organization whom its owner has authorized to review archived conversations. They must give a reason for every search and for every conversation they open, and each one is recorded in the organization’s audit log. Farpoint personnel do not review archived conversations. Farpoint operates the systems that hold them, so that limit rests on our contract with the organization and on the access controls in Section 11; it is not a technical impossibility.

How long it is kept. The organization sets the retention period, and the notice you acknowledge states it. Copies are deleted when that period ends, or sooner if the organization erases its archive. If the organization changes the retention period or its contact, you are shown the notice again. Deleting a chat in the app, or deleting your Fabric account, does not delete copies already archived for the organization.

Legal requests. An archive is a stored record. Farpoint or the organization can be required to produce archived conversations under applicable law. This differs from the rest of Fabric, where Farpoint holds no copy of your conversations to produce.

Your choices. While archiving is on, Fabric shows an indicator where you type your messages. You cannot use Fabric on that organization’s account until you acknowledge the notice; if you do not agree, do not acknowledge it, and raise it with your organization. The organization decides why archived conversations are kept and how they are used, so requests to access, correct or delete them should go to the contact named in the notice. You can also write to [email protected] and we will work with the organization to respond.

4. Google user data (Google Workspace connector)

Fabric offers an optional Google Workspace connector that lets the AI assistant act on your Gmail and Google Calendar when you ask it to. This section describes how we handle Google user data — information received from Google APIs — in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

4.1 What we access

The connector is off by default. No Google user data is accessed at sign-in; signing in to Fabric with Google requests only your basic profile (name, email address, profile picture). Only if you explicitly enable the connector does Fabric request, through a separate incremental consent screen:

• Gmail (gmail.modify): the ability to read, draft, send, label, and archive email messages in your mailbox. This scope does not permit permanent deletion of messages.
• Google Calendar (calendar.events): the ability to read, create, and update events on your calendars.

4.2 How we use it

Google user data is used only to provide the user-facing features you invoke — for example, summarizing or triaging email threads you ask about, drafting or sending a reply you request, labeling or archiving messages at your direction, and reading or scheduling calendar events you ask for. Message and event content is processed on your device and submitted to the AI model you have selected solely to generate the response you requested. We do not use Google user data for advertising, profiling, market research, or any purpose unrelated to the feature you invoked.

4.3 Transfer and sharing

We do not sell Google user data, and we do not transfer it to third parties, except: (a) to the AI model provider you have selected, solely to generate the response you requested, under the no-training prohibition described in Section 8; (b) as necessary to comply with applicable law; or (c) as part of a merger or acquisition, in which case this Privacy Policy will continue to apply. We never transfer Google user data to data brokers, advertisers, or information resellers.

4.4 AI/ML limited use

Fabric’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data — raw, aggregated, or anonymized — to develop, improve, or train generalized artificial intelligence or machine-learning models. We do not transfer Google user data to third-party AI tools that train on it: every model provider available in Fabric is contractually prohibited from training on content submitted through the Service, as described in Section 8.

4.5 Protection, retention, and deletion

OAuth tokens for your Google account are stored encrypted, and all communication with Google APIs uses TLS. Farpoint does not maintain server-side copies of your Gmail messages or Calendar events; content retrieved by the connector is processed ephemerally to fulfill your request and stored, if at all, only in the Fabric app’s local storage on your device. When you disconnect the connector in Fabric, or revoke Fabric’s access from your Google Account security settings, the associated tokens are deleted and access ends immediately. You may also request deletion of any associated data at [email protected].

5. Subprocessors

Farpoint uses the following third-party subprocessors. Each subprocessor is contractually bound to handle personal information consistently with this Privacy Policy and is subject to the same restrictions on training, retention, and disclosure that bind Farpoint.

We will update this list as our subprocessor arrangements change. Material changes will be communicated through the Service or by email at least 30 days before they take effect.

6. Legal basis and applicable law

Farpoint is a Canadian federal corporation headquartered in British Columbia. Our processing of personal information is governed by, and we are committed to compliance with, the following laws:

• the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”);
• Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25;
• the European Union General Data Protection Regulation (“GDPR”);
• the United Kingdom General Data Protection Regulation (“UK GDPR”);
• applicable United States state privacy laws, including the California Consumer Privacy Act / CPRA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, and similar statutes;
• Japan’s Act on the Protection of Personal Information (個人情報の保護に関する法律, “APPI”), including Article 28 (cross-border transfer of personal information).

Where the GDPR or UK GDPR applies, our legal bases for processing are: (a) performance of a contract (operating your Account and providing the Service), (b) legitimate interests (security, fraud prevention, abuse review), (c) consent (opt-in usage analytics, bug reports, Ambient Capture), and (d) legal obligation (responding to lawful government requests).

7. Data residency and international transfers

Account data and operational logs are stored on infrastructure located in Canada and the United States. Farpoint-hosted inference endpoints, when used, may process Inputs and Outputs at facilities in Canada and the United States.

For users subject to APPI (Japan), GDPR (EU), or UK GDPR, this represents a cross-border transfer of personal information. Farpoint relies on the following safeguards for such transfers:

• Adequacy decisions where applicable (Canada has been recognized as having adequate protection by the European Commission and by the Personal Information Protection Commission of Japan);
• Standard Contractual Clauses for transfers to or from the United States;
• Customer-specific commitments under signed Side Letters or Enterprise Agreements (e.g., commitments to make a Japan-resident deployment available on request).

Enterprise customers who require strict in-country data residency can contract for the Customer-Controlled Cloud Tier or the On-Premises Tier under a separate Order Form, as described in Section 9 of the Terms of Service.

8. How we use personal information

Farpoint uses personal information only for the following purposes:

• to operate, maintain, and improve the Service;
• to authenticate you and protect your Account;
• to provide customer support;
• to process payments and send billing communications;
• to investigate suspected violations of the Terms of Service or applicable law;
• to comply with legal obligations and respond to lawful government requests;
• to communicate with you about Service updates, security advisories, and important changes;
• (with your consent) to send product announcements and marketing communications, which you may unsubscribe from at any time.

We do not use Customer Code, Inputs, or Outputs to train, fine-tune, develop, improve, or evaluate any machine-learning model. This is a contractual prohibition, not a privacy preference, and applies to all deployment tiers by default. It is also flowed down to every model provider and subprocessor we use.

We do not sell personal information. We have not sold personal information in the preceding twelve (12) months and we have no plans to do so.

9. Data retention

We retain personal information only as long as we need it for the purposes set out in Section 8, or as required by law. Specifically:

• Account data: retained for the lifetime of your Account. When you request deletion through support, a 90-day grace period applies to allow recovery of accidental deletions. When you delete your account yourself in the Fabric mobile app (Settings → Delete account), your account record, API access, and associated personal information are deleted immediately and irreversibly, except for billing records retained under the bullet below.
• Billing records: retained for the period required by Canadian tax law (currently six (6) years).
• Bug reports: retained for a maximum of 90 days after the issue is resolved.
• Security and audit logs: retained for twelve (12) months; abuse-review logs (where any review under Section 5.4 of the Terms of Service occurred) retained for the same period.
• Inputs and Outputs transiting hosted inference: not retained as content — only ephemeral processing during the request lifecycle.
• Archived conversations (organization-managed accounts only): kept for the retention period set by the enterprise organization that switched archiving on, then deleted (see Section 3.8). Nothing is archived for individual accounts, free or paid.
• Ambient Capture and dictation audio: not stored by Farpoint. Dictation audio is not stored by Soniox either. For Ambient Capture, each audio segment and its transcription are deleted from our gateway and from Soniox once the request is finished (see Section 3.5).
• Marketing communications: retained until you unsubscribe or request deletion, whichever is sooner.

10. Your rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Access: to obtain a copy of the personal information we hold about you.
• Correction: to correct inaccuracies in your personal information.
• Deletion: to request that we delete your personal information, subject to our legal retention obligations. You can also delete your account yourself, at any time, in the Fabric mobile app under Settings → Delete account, or on the web at codewithfabric.com/account/delete.
• Portability: to receive a machine-readable copy of personal information you have provided to us.
• Objection: to object to certain processing activities, including direct marketing.
• Withdrawal of consent: to withdraw any consent you have given (e.g., for opt-in usage analytics or marketing communications).
• Restriction: to request that we limit the processing of your personal information.
• Complaint: to lodge a complaint with the Office of the Privacy Commissioner of Canada, the Information Commissioner’s Office (UK), the data protection authority in your EU member state, the Personal Information Protection Commission of Japan, or any other supervisory authority with jurisdiction.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days, or sooner if required by applicable law. We may need to verify your identity before fulfilling certain requests.

11. Security

Farpoint maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These include:

• encryption of data in transit (TLS 1.3) and at rest (AES-256);
• multi-factor authentication for Farpoint personnel accessing production systems;
• role-based access control with the principle of least privilege;
• regular security training for personnel;
• incident response procedures.

We are pursuing third-party security assessments.

No security program is perfect. If you believe your Account has been compromised, contact us immediately at [email protected].

12. Children’s privacy

Fabric is not directed to children under the age of majority in their jurisdiction (which is 19 years in British Columbia). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact [email protected] and we will delete it promptly.

13. Cookies and similar technologies

The Fabric desktop application does not use cookies. The Fabric website at codewithfabric.com uses essential cookies for authentication and session management, and (with your consent) analytics cookies. You can manage cookie preferences through your browser settings.

14. Changes to this Privacy Policy

Farpoint may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email at least thirty (30) days before they take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

15. Contact

For any questions or requests regarding this Privacy Policy, contact:

Privacy Officer
Farpoint Technologies Inc.
1649 Adanac St, Vancouver, BC V5L 2C7, Canada
Email: [email protected]

For data protection inquiries from EU residents, you may also contact our EU Representative (when designated) — contact details available on request from the address above.

This Privacy Policy is published under the Farpoint Terms of Service v1.0, effective 14 April 2026.