Privacy, in plain words

For the work in a workspace, the company that owns the workspace decides what goes in and who sees it, and we process it on that company’s behalf. That includes the tickets you import, the Slack messages Tengu Bot sees, meeting recaps and what client guests post. Questions about that data go to the workspace’s owner first, and we help them answer.

For your account, billing, the waitlist, this site and its logs, Prizmstack LLC, 30 North Gould St, Ste R, Sheridan, WY 82801, USA, is responsible. Tengu is run from the United States. The services listed below may store or process data in the United States or in other countries.

• Your account: your name, work email and, if you have one, your picture; the workspaces you belong to and your role in each; if you sign in with Google, what Google sends our sign-in each time (your Google account’s email, name, picture and Google’s id for it), which becomes your account’s name and picture; and, if you turn on two-factor sign-in, your authenticator app, whose secret Supabase keeps for our sign-in (Tengu reads only whether you have one, and since when).
• Your agreement to the Terms: when you start or join a workspace, or pay, we keep a record of which version of the Terms you agreed to and when, with your account and membership ids, as proof of the agreement. A new account also notes the version it signed up under, for as long as the account exists.
• Your workspace’s work: quests, comments, attachments, statuses, custom fields and their values, time entries (and whether each is billable), timesheets, company holidays, budgets and, if your admins enter them, pay rates, salaries and the rates each client is billed, with the day each starts. For client guests: the name they give, the email they were invited at, and their comments, requests and files.
• Days off: the days a member asks for, the note they add for whoever approves (if they add one), and who approved or declined them. The member sees their own; Operations, admins and owners see everyone’s; a project’s PMs see days off for the people on their projects. Other members don’t see anyone else’s.
• What the tools you connect send us: the tasks, comments, attachments and custom fields you import from ClickUp, Linear or Jira, including the names and emails of the people on them and each field’s value as the tool had it; ClickUp’s notices that a task changed, only for a workspace our staff have linked to ClickUp live; pull requests, their comments, checks and commit statuses, and deployments from GitHub; and messages Tengu Bot is asked about in Slack, with the threads it takes part in (every message, in a channel set to every message), only in channels where it is on, with edits and deletions followed, and the direct messages people send it (Slack (Tengu Bot) below has the rest).
• Call recaps and video tickets (Studio): the audio and transcript of calls you send Tengu Bot to, and videos you ask it to watch, to write recaps and proposed tickets. In a call, it goes by “Tengu Bot (recording)”. On Zoom, Google Meet and Teams it also tells everyone in the call’s chat that it records and transcribes, for whom, what is kept, and that removing it from the call keeps nothing.
• Meetings (Studio): the kickoff and reply videos people record in a meeting (their camera or screen, with sound), its posts, files, votes and reactions, and a transcript of each video. Also each person’s read receipts there: how far they watched the kickoff and when they last opened the meeting. A call recorded for a meeting also gives the meeting its recording (video and audio), its transcript, and who was on it: each person’s name as the call shows it, and the email address the call gives for them, if any, so Tengu can tell which of your members they are. Only the meeting’s people see any of it, and client guests are never in a meeting.
• Intercom and your own Supabase (Studio): Intercom conversations and users, and rows read from your own Supabase project, when you connect them and Tengu Bot looks something up.
• Your own PostHog, for a project’s Analytics (Studio): when a project’s lead or a PM connects the PostHog project their app sends its events to, a personal API key for it (encrypted, in Supabase Vault) and the counts its Analytics tab reads with it: people, pageviews, sessions and events by day for four weeks, the events the project watches, and the week’s most sent events and most viewed pages by path. Never a person, a property of one or a recording. Tengu keeps the latest read for the tab and replaces it with the next.
• Google Drive, for Tengu Bot’s docs (Studio): when a member connects their Google account, its email, Google’s id for it and, for a Google Workspace account, its domain; then the files they pick in Google’s picker, one by one: each file’s name, link, type, folder and version, who picked it and agreed that the team gets answers from it, and the text Tengu copies from it. Nothing else in their Drive. Google user data below says how it is used and when it goes.
• Google Calendar, for Today and meetings: when a member connects their calendar, on the same Google account, the events on their main calendar for the day they look at: each one’s title, times, description, location, call link, guests’ emails and answers, who organizes it, whether it shows them as busy, and its link in Google Calendar. Tengu reads them live and keeps none of them. Tengu never changes that calendar: it writes the member’s planned blocks on a calendar of its own, one for each workspace, named for it (“Tengu · Acme”). On plans with Meetings (Studio), Recall.ai also keeps the calendar in sync, and Tengu keeps each event with a Google Meet, Zoom, Microsoft Teams or Webex link in the next 28 days: its title, when it starts and ends, the link, Google’s id for it and the series it repeats in, the email addresses of who organizes it and the people invited, and whether they may see each other. Nothing else in their calendar. Google user data below says how it is used and when it goes.
• Slack, for Today: a message a member adds to Today or saves as a note from Slack: its words, with the names of who wrote it and who it mentions, and its link. And, if they let Tengu reply as them, their Slack account’s token for it and the replies they send. Slack (Tengu Bot) below says how they are used and when they go.
• Billing: your company’s name, the email for receipts and, if you add them, the name and address for invoices, which we give Stripe; and the billing email the owner types, which may belong to someone without a Tengu account. Card details go straight to Stripe and never reach Tengu.
• Shared client reports: when someone opens a report link, we count the view and note when it was last opened. The report doesn’t record who opened it, and PostHog doesn’t run on it, nor on a shared roadmap, recording or meeting.
• The hunter (if your team turns it on): which 25-minute stretches you had a quest in progress while Tengu was open, for your own journal. Only you see it. Teammates who see the game hear when your hunter ascends, at levels 10 and 20.
• Usage: who was assigned, finished or reviewed a ticket, or logged time, each month, for the workspace’s Usage page.
• From this site: what you type into the waitlist form: your email and, if you add them, your name, company, team size and tools.
• Usage and recordings (PostHog): on this site and in the app, from your first visit, the pages you open and what you click, and a recording of each visit to Tengu’s pages: what they showed, what you typed, your mouse movement, scrolling and clicks, the browser console’s messages and how long pages and requests took. With them, your browser and device, your IP address and the rough location PostHog works out from it. Once you sign in, they are tied to your account: your email, name and role, and the company you have open. Recordings leave out passwords, sign-in and authenticator codes, keys and secrets shown or typed in, Google Drive files’ names and links, Google Calendar’s events, every meeting’s title, prep and notes, the Slack threads waiting on a member and the replies drafted for them, and the secret part of a link (a shared report’s, roadmap’s, recording’s or meeting’s, an invite’s, an unsubscribe link’s).
• Technical logs: requests, errors and sign-ins, with IP addresses and browser type, kept to run and secure the service.

Nothing from outside Tengu: no screenshots of your screen, no keystrokes or mouse movement outside Tengu’s own pages, and not the other apps you use. No activity scores, and no online status anyone else sees. The full list is on What Tengu will never do.

• To run Tengu for your workspace: the board, the dev loop, time, days off, pay periods and Tengu Bot.
• To bill your workspace and answer your questions.
• To keep the service secure, stop abuse and fix what breaks.
• To see how Tengu is used, and find what is hard to use, from PostHog’s analytics and recordings. Only Prizmstack’s staff see them, never your workspace’s owners or admins, and nothing in them scores anyone’s work.
• To keep proof of the Terms each person and company agreed to.
• To write to you about your account and, if you joined the waitlist, to tell you when your workspace is ready.
• To email members what reached their inbox and they haven’t seen in Tengu yet (assignments, mentions, reviews, Claude runs that need them, clients’ requests and comments, and days off: a request waiting for whoever approves, with its dates and note, and the answer to a member’s own), and client guests the news on their tickets, until they turn it off.
• To send owners and admins budget alerts and a Monday brief, in their inbox and as a Slack DM where they linked their Slack account. These carry percentages, dates, counts and the names of projects and clients, and the brief names who has days off that week. They never carry a dollar amount, a rate, a cost, a margin or pay.

We don’t sell your data, rent it or use it for advertising.

Some features send the content they need to an AI model to produce a result: Tengu Bot’s answers, tickets, updates and meeting recaps, and release notes when you ship. For an answer from your team’s docs, the sections of the picked files that match the question go to the model with it. In a Slack channel set to every message, each message there goes to a model that decides whether it holds work for a ticket. A reply Tengu drafts for a member in a Slack thread waiting on them sends that thread, as Tengu Bot keeps it, to a model for that draft alone. When a member asks Tengu on Today or in the desktop app’s quick bar, the question and their own plan and open tickets go to a model for that answer alone. The evening sweep sends the notes left on its cards (and whether each is on a ticket) and the to-dos and tickets the day’s plan left, with how many days each was left and how the member answered each ticket in the pile, for its suggestions, and a reply draft sends the ticket’s name, the comment being answered and the few before it. No calendar event and no Slack thread goes, a to-do or note kept from a Slack message goes without its words, and nothing is kept. Each post in a meeting goes to a model to be read for the meeting’s outcomes (its decisions, suggested tickets, action items and questions), with the meeting’s title and agenda, its people’s names, the outcomes so far, the post it replies to and what was said in its video. The title of each call coming up on a member’s calendar that no ticket key in it or member’s pick places goes to a model, with the names of the workspace’s active projects and their clients, to suggest which project the call’s time goes to: nothing else of the event goes (not its guests, link or description), and the suggestion, kept for the call’s series or its title, shows as AI’s until a member picks. The models are Anthropic’s Claude and Google’s Gemini, reached through Vercel’s AI Gateway, which may pass a request to Anthropic or Google, or to Amazon Web Services (Bedrock) or Google Cloud (Vertex AI), which run the same models. Nothing Tengu reads from a member’s Google Calendar for Today goes to an AI model; a call’s title does, to suggest its project, and a call’s meeting space takes its event’s title, which, like every meeting’s title, the models see (see Google user data). Tengu never uses Slack data to train or fine-tune AI models (see Slack (Tengu Bot)).

A video you ask Tengu Bot to make a ticket from goes only to Google’s Gemini, through Vercel’s AI Gateway, to be watched. A larger video file is made smaller on Tengu’s server first, and its pieces are kept in Tengu’s file storage only until it has been watched. For a YouTube link, Tengu reads how long the video is from its YouTube page.

A video posted in a meeting (its kickoff, or a reply) goes only to Google’s Gemini, through Vercel’s AI Gateway, to be transcribed: what was said is kept with the meeting, for its people. A larger video is made smaller on Tengu’s server first.

Run in Claude Code and QA with Claude are different: they run on a routine in your own Claude account, under your agreement with Anthropic. When someone starts one, Tengu sends that routine the ticket: its name, link, description, subtasks and latest comments with their authors’ names (a client guest’s included) and, for QA, its pull request and preview link.

NPCs (Studio) are different again: they run on Anthropic’s Managed Agents, on Tengu’s own Anthropic account, not through Vercel’s AI Gateway. When someone puts an NPC on a ticket, Anthropic receives what its run needs: the workspace’s name, the NPC’s name and title and the instructions it was given, the ticket’s name, link and description, the note it was given, who put it on (or the NPC that handed it the ticket), the project’s name and how each connection picked for the run is described. A sign-in for each of those connections is kept in that connection’s vault at Anthropic until the connection is removed: Tengu writes a fresh one before each run and while runs use it (a pasted key is kept as it is). What the NPC reads and writes through them, the web pages it searches and reads, and what Tengu’s own tools answer it pass through its session; for a Claude Code run it starts in your Claude account, that includes Claude’s questions, its notes and its pull request. Anthropic keeps each session (its messages and tool calls) on Tengu’s account; Tengu keeps the run’s steps, asks and report with the ticket, for the team. When a workspace is deleted, its NPCs’ sessions are deleted at Anthropic and their agents archived in the hours after its connections are disconnected, and before the workspace is deleted for good.

A ticket’s Claude thread is kept in Tengu with the ticket, for the team only. What someone writes to Claude there is posted as a comment on Claude’s pull request in GitHub, by Tengu’s GitHub App, and Claude’s own comments on its pull request, and QA’s findings with their screenshots, come back into the thread.

• Vercel: hosts the app and this site, and runs the AI Gateway that passes AI requests on to Anthropic or Google, or to Amazon Web Services (Bedrock) or Google Cloud (Vertex AI), which run the same models.
• Supabase: the database, sign-in and its sign-in codes, and file storage.
• Stripe: card payments and invoices. Card numbers go straight to Stripe and never reach Tengu.
• Resend: the email Tengu sends: invites, billing notices, members’ and client guests’ update emails, and alerts to our staff. Sign-in codes may go through it too. It also keeps the name and address of everyone who signs up, as a contact for Tengu’s news, which they can unsubscribe from in any of those emails.
• Anthropic (Claude) and Google (Gemini): the AI models behind Tengu Bot, asking Tengu (on Today, in the quick bar, the evening sweep and reply drafts), meeting recaps, meetings’ outcomes, calls’ suggested projects, video tickets and release notes. Google also receives the videos Tengu Bot is asked to watch and the videos posted in meetings, to transcribe them. Anthropic also runs NPCs (Studio) on its Managed Agents, on Tengu’s account: their sessions, and the sign-ins of the connections they use.
• Recall.ai (Studio): records the calls you send Tengu Bot to, and tells Tengu who joins and leaves a call recorded for a meeting. Once the recap is written, Tengu asks Recall.ai to delete the recording, audio and transcript; for a meeting’s call, once Tengu has copied the recording into its own storage. On plans with Meetings, it also keeps the Google Calendars members connect in sync, with a copy of each one’s Google token that Tengu gives it, and sends Tengu Bot to the calls of a series a member switched on, until the member disconnects their calendar.
• Slack: alerts to our staff also go to Prizmstack’s own Slack workspace.
• PostHog: product analytics and the recordings of visits to this site and the app (see What we collect), kept in the United States.

Each processes data to provide its service to us, under its agreement with us. Stripe also uses payment and device information to prevent fraud, under its own privacy policy. The tools you connect, like ClickUp, Linear, Jira, GitHub, Slack, Intercom, Google Drive, Google Calendar, Claude and your own Supabase and PostHog projects, and the webhook addresses you add, receive what Tengu sends them under your own agreements with them. A script or agent with one of your organization’s API keys, through the Agent API or Tengu’s MCP server, reads what the key’s maker can see (or the lists the key names), and changes it only when the key can write. For members, pictures that came from ClickUp load straight from ClickUp.

Tengu uses Google for two things, each on a member’s own Google account, which they connect themselves: Tengu Bot’s docs (Studio), and their own Google Calendar, on Today and, on plans with Meetings, for their meetings. Both use the same account. Tengu asks Google for the account’s email and id, and for each permission below only when the member connects what needs it.

Google Drive, for Tengu Bot’s docs. These are Google Drive files a team picks for Tengu Bot to answer from, and Tengu reads the files each member picks with their account. Tengu asks Google for its drive.file permission, which lets Tengu open only the files someone picks in Google’s picker, never the rest of their Drive. That permission would also let Tengu change those files; Tengu never does. Whoever picks a file first agrees that the team gets answers from it. Tengu copies the text of each picked file, in sections under its headings, keeps that copy in its database at Supabase, and checks the file every 15 minutes or so for a new version. For an answer, Tengu Bot finds the sections a question needs and sends them with the question to the AI models above, through Vercel’s AI Gateway, to write it. The answer is posted in Slack where a teammate asked, in a team channel or a direct message, never to a client guest or in a channel a client may read: it can quote the files and sum them up, and it links to the file and section each part came from. In Tengu, the team sees the files’ names and links on their shelves.

Google Calendar, for Today and meetings. A member who connects their calendar gives Tengu two of Google’s permissions: calendar.events.readonly, to see the events on their calendars, and calendar.app.created, to make calendars of Tengu’s own and manage the events on those alone. With the first, Tengu reads the events on their main calendar one day at a time, for the day they look at on Today: each event’s title, times, description, location, call link, guests’ emails and answers, who organizes it, whether it shows them as busy, and its link in Google Calendar. That permission is read-only: Tengu can’t change or delete anything on the member’s own calendars. Only the member sees their day as their calendar has it, beside their plan for it. Tengu reads it live and stores none of it: an event that is the call of a meeting space the member is in (see Meetings, below) links to that space, found each time from the event’s id, which call of its series it is and its organizer, and kept nowhere.

With the second, Tengu makes one calendar of its own on the member’s Google account for each workspace they use it in, named for the workspace (“Tengu · Acme”), and writes only there: the member’s planned blocks for the day, one event each, with the block’s name and times, shown as free, so they never make the member look busy to anyone booking time with them, with no reminders, marked as Tengu’s and the member’s, and linking back to Today. Tengu makes that calendar only when it first writes a block for them, and again only when Google says it no longer has it (asked again after a pause, as when the member deleted it in Google Calendar) and Tengu writes a block after that: a day planned with no blocks never brings it back. Tengu can’t list the member’s calendars, so it keeps the id of each calendar it makes, and deletes again one it made and couldn’t keep (two tabs each made one) until it goes; a calendar whose making Google never confirmed to Tengu is one Tengu can’t find again, and stays in the member’s Google Calendar for them to delete. To keep the blocks as the plan, Tengu reads back the events on that calendar alone: their names, times, guests, whether they show as busy, and the marks Tengu put on its own blocks. It changes and deletes those events as the plan changes, except one that has ended or that the member invited someone to, which stays as it is. Tengu never reads the Tengu calendar’s events as the member’s meetings.

Tengu uses what it receives from Google only for these two features: to answer the team from the files the team picked, and to show each member their own day, write their planned blocks and, on plans with Meetings, run their meetings from their calls. Apart from those answers, shelves, days and meetings, it goes only to the service providers that run Tengu for us, under their agreements with us: Vercel, which hosts Tengu, where the files are read, each answer is put together, each calendar is read and each Tengu calendar written, and runs the AI Gateway that passes answers on; Supabase, which keeps it; Recall.ai, on plans with Meetings, which keeps the calendar in sync (below); and the model providers above, which write each docs answer from the files and suggest each call’s project from its title. Nothing Tengu reads from a calendar for Today goes to an AI model, and of the calendar events it keeps only a call’s title does, to suggest which project its time goes to. A call’s meeting space takes its title from the calendar event, and, like every meeting’s title, the model providers that write a meeting’s outcomes and a call’s summary see it, as the Meetings part below says. PostHog’s recordings and analytics leave it out: the files’ names, links and text, calendar events, every meeting’s title, and the Google account a member connected, are never recorded. Tengu doesn’t sell it, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. People at Prizmstack read it only as Google’s policy allows: when you ask us to, to look into abuse or a security problem, or when the law requires it.

Tengu’s use, and transfer to any other app, of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. In Settings, Google Calendar’s Disconnect deletes the Tengu calendar, with every planned block on it, those the member invited someone to included, and anything else they put there, then has Recall.ai delete its copy of the calendar (on plans with Meetings), and stops Tengu reading the member’s calendar; their own calendars stay as they are. If Google Drive is connected too, it stays connected; if not, the calendar was all the connection held, so Disconnect ends the Google connection as Disconnect Google does, and Tengu asks Google to take back what the account gave it, unless the same Google account is connected in another workspace. Disconnect Google ends both: the Tengu calendar goes first, then Recall.ai’s copy, then the connection (below). While Google or Recall.ai doesn’t answer, neither finishes: your calendar stays connected, a Tengu calendar Google already deleted stays deleted, and Settings asks you to try again. If Google won’t let Tengu delete the Tengu calendar, or Google has stopped letting Tengu use your account, the disconnect goes ahead and Settings names the calendar for you to delete in Google Calendar yourself, or, if someone else owns it now, to remove it from your list (its Settings › Remove calendar › Unsubscribe) and ask them to delete it. You can also remove Tengu’s access yourself at any time in your Google account’s settings; Tengu can’t delete its calendar after that, so delete the Tengu calendar in Google Calendar.

The text Tengu copied from a file is deleted when the file is taken off its shelf, when the shelf goes (with its project or channel), and when the Google connection that read it goes: the member disconnects in Settings, leaves the workspace or becomes a client guest, the workspace stays paused or on Free for 30 days, or the workspace is deleted. A connection Google stopped letting Tengu use is deleted after 7 days. A channel’s docs shelf, and the text Tengu copied for it, goes with the Slack workspace, 7 days after Tengu Bot is removed from it (see Slack (Tengu Bot)); the files stay in Google Drive. The files’ names and links stay on their shelves until someone removes them, so they can be picked again. When a member leaves the workspace or becomes a client guest, and when the workspace stays paused or on Free that long or is deleted, Tengu first deletes their Tengu calendar, with everything on it, as Disconnect does, then Recall.ai’s copy of their calendar. A Tengu calendar Tengu doesn’t delete stays in their Google Calendar: one Google won’t let Tengu delete, or doesn’t answer for, one a long hold or a deletion runs out of time before reaching, and one Tengu can no longer reach, on a connection Google stopped letting Tengu use or whose calendar they had switched off by connecting again without it. When they leave or become a client guest, the workspace’s admins are told so, to tell them. When a member disconnects Google, leaves the workspace or becomes a client guest, and when a workspace is deleted, Tengu also asks Google to take back what the account gave it, unless the same Google account is connected in another workspace. If Google doesn’t take it back then, Tengu deletes its copy of the account’s token all the same, so nothing can use what the account gave it.

Meetings (Studio). Meetings can start from a member’s Google Calendar. On plans with Meetings, Tengu gives Recall.ai, our meeting-bot provider, a copy of the Google token it keeps (encrypted, in Supabase Vault) for the member’s calendar, and Recall.ai keeps the calendar in sync. Google issues that token for everything the account gave Tengu (Google Drive’s files, the calendar and the Tengu calendar), and Recall.ai uses it only to read the calendar. If Recall.ai doesn’t take it at once, Tengu tries again later, and Settings says so. Tengu keeps, for the next 28 days, only the events with a Google Meet, Zoom, Microsoft Teams or Webex link: their title, times, link, Google’s id for them, series, organizer and the email addresses of the people invited. Tengu uses them only for the member’s meetings: to list their calls to come on My meetings, each with the project its time goes to (suggested by an AI model from the call’s title alone when no ticket key in it or member’s pick places it), as a call starts to offer its meeting space to the teammates on it, and for a series the member switched on to make each call’s space and send Tengu Bot. While a call has no space, it is offered to each teammate whose calendar holds it and to whoever the organizer’s own invite names; once someone made it, only to its organizer, whoever the organizer’s invite names and whoever the invite of someone already in the space names. An address is matched to a teammate’s sign-in or calendar address; a teammate who declined the invite is never offered it, and client guests and anyone outside the team are never told, added or emailed. Whoever makes a call’s space adds the teammates their invite names (only those it shows them, when the organizer hid the guest list), and people who join the same meeting space see each other there. An offer shows who of the team is on the call and how many others, never their addresses, and no more of the list than the organizer lets invitees see. A meeting space knows its call by a key, a SHA-256 hash of Google’s id for the event, which call of its series it is and its organizer, never the link or its passcode; Recall.ai is given the workspace, that key and the call’s start, so that one Tengu Bot goes to the call. The same rules as above apply: only Recall.ai, the providers that run Tengu and the model providers that suggest a call’s project and write its summary see it, PostHog never records it, nor any meeting’s title, and it is never sold, used for advertising or used to train AI models.

A calendar’s events, with the inbox notices that offered their calls, are deleted a day after they end or leave the calendar, and all of them go when the member disconnects their calendar or Google in Settings, leaves the workspace or becomes a client guest, when the workspace stays paused or on Free for 30 days, when the workspace is deleted, and when Google has stopped letting Tengu use the account for 7 days: Tengu then asks Recall.ai to delete its copy of the calendar, after the Tengu calendar, and keeps asking until Recall.ai has. When the workspace moves to a plan without Meetings, Tengu asks Recall.ai to delete its copy of each member’s calendar too, and keeps asking until Recall.ai has, and their events go with it; their calendar stays connected for Today, and moving back to a plan with Meetings gives Recall.ai a copy again, with no new consent. Meeting spaces already made from a call stay, like any other meeting, and let go of the call’s key once its events are deleted. Until Google verifies Tengu’s use of the calendar permissions, Google’s screen warns that it hasn’t verified Tengu, and no more than 100 people in all can connect a calendar; everyone can still paste a call’s link into a meeting.

Tengu Bot is Tengu’s Slack app. An owner, an admin or someone in Operations adds it to a Slack workspace from Admin › Tengu Bot and picks the channels it works in. This is what it reads in Slack, what it keeps and for how long, what it does there, what it does for one member at a time, and what goes when it is removed.

What it reads: in the channels an admin connects (to a list, or on Studio to docs), the threads it is mentioned in or takes part in; every message in a channel an admin set to Every message, each of which goes to an AI model that decides whether it asks for work; the direct messages people send it; the files in a thread it is asked about; the message someone runs one of its message shortcuts on (Create ticket, Add to Today or Save as note), which Slack sends with the shortcut; the names of the people it talks with; and, for each member of a connected channel (up to 200), whether they are a Slack guest or from another company, kept as one yes or no per person and looked up again once it is over a day old, so team-only details stay out of a channel a client can read. It never asks Slack for anyone’s email address.

What arrives but isn’t used: Slack sends Tengu Bot every message in every channel it is in, word of people joining and leaving those channels, and every change to a profile in the Slack workspace. Joins and leaves only make it check again who can read the channel, and a profile change only whether someone it looked up is a guest now. The rest is dropped as it arrives, or as soon as Tengu Bot sees it isn’t for it, and never kept: the messages it doesn’t keep (below), and every other profile change. A message whose handling still fails after its retries is kept 7 days, to find out why.

How long it keeps what it reads:

• Messages: in a channel set to Every message, every message there; elsewhere, only the threads it is mentioned in or takes part in, and the direct messages people send it. Each is kept 30 days, with edits and deletions followed, so it can follow a thread without asking Slack again. A reply a member sends from Today is kept with its thread, like the thread’s other messages.
• A draft waiting for someone’s yes (a ticket preview’s Create, a change’s Approve): 48 hours, then deleted 30 days later.
• Its activity log (who asked, in which channel or DM, and what it did), which admins see in Admin › Tengu Bot: 35 days.
• A thread a member ignored on Today: only a one-way fingerprint of the message that asked them and its Slack workspace’s id, never its words, channel or people, for 15 days.
• Slack’s ids for the events it received, and direct-message notices waiting to go out: 7 days.
• Where an NPC’s ask, hand-back or stop went in Slack (the direct message or channel thread, so it can change once someone answers): until a day after the ask is answered or expires, and 30 days for a hand-back or a stop.
• Which threads became which tickets, linked Slack accounts, the guest checks above and the channels it was removed from: until 7 days after Tengu Bot is removed (a link goes sooner when its member unlinks or leaves the workspace).
• A member’s token for replies as them: until they disconnect it or unlink Slack, or Tengu Bot is removed, or one of the other ways under Disconnecting replies below.
• Call recaps (Studio), of the calls Tengu Bot is sent to from a channel: the minutes, and the tickets they suggest with quotes from the call, stay until the channel is removed from Tengu Bot, or 7 days after Tengu Bot is removed from the Slack workspace. A meeting in Tengu linked to the channel stays, with its calls, only without its channel.
• What each request cost the workspace’s AI pool stays with its usage; the Slack user who asked, and the message it was for, are taken off it 7 days after Tengu Bot is removed.
• Tickets, comments and files people make from Slack are your workspace’s work, kept like the rest of it. A to-do or note a member makes from a Slack message is theirs, kept as How long we keep it says.

What it does without being @mentioned: it joins a public channel only when an admin who is in that channel connects it, to a list or to docs, and tells the channel, in one message, who connected it, how it listens and, with Meetings on, that a pasted call link sends its recorder; it says so again if an admin sets the channel to Every message or turns Meetings on. A private channel needs /invite @Tengu Bot first. It never joins a channel it was removed from, even when an admin connects the channel again: removing it turns the channel off in Tengu until someone there invites it back and an admin turns the channel on. In a channel where an admin turned Meetings on (Studio), a linked member who pastes a Zoom, Google Meet, Microsoft Teams or Webex link sends its recorder into the call, and, with Meetings, makes the call a meeting room of theirs, which the channel’s recap links to. The recorder joins as “Tengu Bot (recording)” and says in the call’s chat that it records (on Webex, where it can’t write in the chat, only its name says so), and its reply in Slack asks whoever sent it to tell everyone on the call. Automations post in connected channels, each post saying who set it up, and DM people, on a schedule or when a ticket changes, as their maker set them up. A meeting in Tengu (Studio) DMs its people who linked Slack: that they were added, reminders to answer, the votes, check-ins and questions that need them, its wrap-up, and word of its calls (a meeting space made for their call, its summary, why Tengu Bot isn’t recording); as a call on their Google Calendar starts, it offers them its meeting space. Its recap goes in its channel only when the host asks at wrap-up, saying who wrapped it up. “Push to production” opens a release pull request on GitHub; a person merges it there.

For one member at a time: three more things work for one member, once they link their Slack account to Tengu. None of them searches Slack or reads a channel’s history, and none touches Slack’s own to-dos, saved items or reminders.

Add to Today and Save as note. In a message’s More actions menu, Add to Today puts the message on the member’s Today as a to-do, titled from its words (up to 140 characters), and Save as note keeps its words (up to 2,000 characters) in their private notes. Each keeps the message’s link, to open it in Slack. Each first shows the member those words in a box to change, and keeps nothing until they press Add or Save. Slack sends Tengu that one message when the member picks it; Tengu asks Slack only for its link, and for the names of the member, of who wrote it and of who it mentions.

Waiting on you. Today lists the Slack threads where someone @-mentioned the member or asked them something, and they haven’t answered since. Tengu finds them only in the threads Tengu Bot already keeps, from the last 14 days, never in direct messages, and only in channels the member is in now (Tengu asks Slack which, with Tengu Bot’s access): someone mentioned in a private channel they aren’t in, or have left, never sees it on Today. A question that names the member without an @-mention counts only in a thread they took part in. The list is worked out each time Today asks for it, shown to that member alone, and not stored. When a member ignores a thread there, Tengu keeps a one-way fingerprint of the message that asked them and its Slack workspace’s id (never its words, its channel or the people in it) so it stays off their list until someone asks them again; the fingerprint is deleted 15 days later, or 7 days after Tengu Bot is removed from that Slack workspace, and those of the organization’s other workspaces stay. Ignoring changes nothing in Slack.

Replies as you. The first time a member presses Reply on one of those threads, Tengu asks Slack for one permission on their own account, chat:write, which lets an app post messages as them. It asks for nothing that reads their messages. Tengu keeps the token Slack gives it in Supabase Vault, with their Slack link, and uses it for one thing: to post the reply the member wrote, in the thread they are answering, when they press Send. Tengu never posts as them otherwise. Without it, they can copy their reply and open the thread in Slack.

Suggested replies. When a member asks for a draft, the thread as Tengu Bot keeps it (its first message and the newest ones, up to 30), with the names of the people in it, goes to the AI models above for that one draft. The draft is shown to the member to change or throw away, and posts only if they press Send. Tengu keeps none of it, only that a draft was made, by whom and what it cost, for the workspace’s AI pool.

Disconnecting replies. In Settings › Apps › Slack, Disconnect under Replies as you asks Slack to take the permission back and deletes the token; the member’s Slack link stays. Unlink Slack does the same, and unlinks them. The token is also deleted when Slack says it was revoked (the member or their Slack admins removed Tengu’s access), when Tengu Bot is removed from the Slack workspace, when the member leaves the workspace or becomes a client guest, when the workspace stays paused or on Free for 30 days, and when the workspace is deleted; each of the last four also asks Slack to take it back. Slack gives an app one token per person in a Slack workspace, so Tengu doesn’t ask Slack to take back one that another Tengu workspace in the same Slack still holds.

AI: Tengu Bot’s drafts, answers and minutes, and the replies Tengu drafts for a member, are written by the models in AI features above. Tengu never uses Slack data to train or fine-tune AI models. AI can get things wrong: check what it drafts before you rely on it.

Where it goes: Tengu uses what it gets from Slack only for Tengu Bot’s work and the three things above, and keeps no more of it than this page says. It goes to the service providers in Who processes data for us, to run them, and to the tools your team connects, under your own agreements with them: ClickUp, for a workspace our staff have linked to it live, which gets the tickets and comments Tengu Bot writes on the lists linked there, Team only comments included; GitHub, whose release pull requests can carry tickets’ titles; and on Studio the connections an admin adds for Tengu Bot (such as Supabase, Intercom or Linear), which get the parts of a conversation the model passes to them. Tengu Bot sends PostHog nothing. PostHog records visits to Tengu’s pages (see What we collect), and in Tengu a recording shows what was on screen, which can include tickets and comments made from Slack, and the channel names and activity in Admin › Tengu Bot. Recordings leave out the to-dos on Today, the threads waiting on a member and the replies drafted for them. A to-do added from a Slack message keeps its words, and once a member times it, its name also shows wherever that time is named (the timer in the top bar and its notices, the timesheet and reports), which recordings can include. Tengu doesn’t sell what it gets from Slack or use it for advertising.

When Tengu Bot is removed from a Slack workspace, in Slack or with Disconnect in Admin › Tengu Bot, its token is deleted from our database at once, and so are the tokens members there gave Tengu for replies as them (copies in our backups go as they are overwritten). Tengu also checks each day that its access still works, and treats access Slack has ended as a removal. Seven days later, everything else Tengu kept of that Slack workspace for your organization is deleted: the connected channels with their settings and docs shelves (with the text Tengu copied from Google Drive files for them; the files stay in Drive), the message copies, which threads became which tickets, linked Slack accounts, guest checks, its activity log, who asked for each use of the AI, the fingerprints of threads members ignored on Today, and call recaps with their minutes and suggested tickets (meetings in Tengu stay, only without the channel). Adding Tengu Bot back within those 7 days picks up where it left off. A member who replied as themselves connects that again. Tickets, comments and files your team made from Slack stay: they are your team’s own work in its Tengu workspace, until your team deletes them or the workspace is deleted. So do automations your team set up, with the channels they post in, and the notices Tengu already sent, until your team changes or deletes them, and the to-dos and notes members made from Slack messages, until they delete them (a to-do a member timed keeps naming that time on the timesheet and in reports, kept like the rest of your team’s time).

Asking us: to have Tengu’s Slack data for your organization deleted sooner, or to ask what it holds, write to hello@tengu.work (see Your choices). Members can unlink their own Slack account in Settings › Apps at any time.

Prizmstack staff are in a customer’s workspace only when the customer set it up with us (for a design partner, our staff create the organization and own it until they hand it over) or invited them. After a handover they stay admins, with an admin’s view of rates, pay and margins, until they leave or the owner or an admin removes them. Admin › Members labels each of them “Tengu staff, free”, and they take no seat.

Our staff console shows each company’s state, plan and seats, the owner’s name and email, the admins’ names, the names of people who have left it, its Stripe customer ID and its billing history. Staff carry out emailed requests about accounts from it, and each one is logged with who did it and why. The people who run Tengu’s infrastructure can reach the database, at Supabase, to keep Tengu running, fix problems and carry out requests like the ones on this page.

Our staff also see PostHog’s analytics and recordings of visits to Tengu’s pages (see What we collect). A recording shows what was on screen, your workspace’s work included, apart from what recordings leave out. We watch them to see how Tengu is used and to fix it.

When something breaks that only we can fix (a disputed payment, a job that keeps failing, a request that failed on our side), our staff get an alert by email and in our Slack. It carries ids, counts and the error’s message, with keys, tokens, signed links and email addresses taken out; an error’s message can still name something from your workspace.

• A workspace’s data: while the workspace exists. The owner deletes it in Admin › Settings: the team and its clients lose access at once, and everything in it is deleted 30 days later. Until then the owner can undo it and download the data. When it is deleted for good, everyone’s Tengu account stays, only cut off from it: signing in again shows no workspace until they join or start one, and a workspace they left before still finds their history when it invites them back.
• Your account: until you delete it (see Your choices).
• Connections: if you disconnect a tool in Tengu, or de-authorize Tengu in GitHub, we delete that connection’s tokens within 10 days. Tengu Bot’s Slack token, and the tokens members gave for replies as them there, go at once when it is removed from Slack or disconnected, and the rest of what it kept 7 days later (see Slack (Tengu Bot)). A Linear or Jira key you paste for an import is deleted when that import finishes, fails or is cancelled. A project’s PostHog key, and what its Analytics tab read, go at once when it is disconnected or the project is deleted, and when the workspace stays paused or on Free for 30 days. Quests you imported, and the people (names, emails and pay rates), projects and hours a time tracker sent while Tengu imported from one, stay in your workspace.
• Call recaps: recaps, and the tickets they suggest, stay until their channel is removed from Tengu Bot, until 7 days after Tengu Bot is removed from the Slack workspace, or until the workspace is deleted, and go sooner if its owner asks. Once a recap is written, our recording provider deletes the call’s recording, audio and transcript. A call recapped in Slack with no meeting room keeps only its recap: Tengu keeps no copy of its audio or video, or of a video Tengu Bot watched for a ticket, and a proposed ticket links back to the Slack message it came from. Removing Tengu Bot from a call keeps nothing of it. We keep a call’s link with its passcode until a day after the call ends, then only its address; our copy of the Slack thread the link was sent in keeps that message, link and all, for the 30 days below.
• Meetings: a meeting’s videos, files, posts, transcripts, prep and notes, and read receipts stay with your workspace until its host (or an admin) deletes the meeting, which removes its videos and files from storage too, or until the workspace is deleted. Tickets it made, and the tickets linked to it, stay. Prep or a note someone removes goes for good 30 days later; a removed member’s stay, under their name. A call recorded for a meeting is the exception: its recording and its transcript stay in Tengu for 90 days after the call ended, for the meeting’s people only; then both are deleted, with the email addresses the call gave, and the meeting keeps Tengu’s summary. On a plan with Meetings, a call a linked member sends Tengu Bot to from a Slack channel gets a meeting room of its own, hosted by them, and is kept as a meeting’s call is; the channel’s recap links to it.
• Slack threads Tengu Bot is mentioned in or takes part in, and every message in a channel set to Every message: 30 days, so it can follow them without asking Slack again, with the replies members send in them from Today. Direct messages to Tengu Bot are kept no longer. The threads waiting on a member are read from these, not kept apart; for one a member ignores, Tengu keeps only a one-way fingerprint of the message that asked them and its workspace’s id, for 15 days. When Tengu Bot is removed from the Slack workspace, they go 7 days later if they haven’t by then. The rest of what it keeps is in Slack (Tengu Bot).
• Tengu Bot’s docs: the text copied from a picked file until the file, its shelf or the Google connection that read it goes (see Google user data); the files’ names and links until someone removes them or the workspace is deleted, or, on a channel’s shelf, until 7 days after Tengu Bot is removed from the Slack workspace.
• Slack, for Today: a message added to Today stays on that day’s plan; one saved as a note stays until the member deletes it, and goes for good 30 days after. Both stay when Tengu Bot is removed from the Slack workspace: they are the member’s own. Time a member tracks on such a to-do is named after it on the timesheet and in reports, kept like the rest of your team’s time. A member’s token for replies as them stays until they disconnect it, Tengu Bot is removed, or one of the other ways in Slack (Tengu Bot) above.
• A connected Google Calendar: nothing Tengu reads for Today is kept. On plans with Meetings, each call with a link from now to 28 days ahead, deleted a day after it ends, and all of them when the calendar is disconnected (see Google user data).
• A deleted ticket: goes at once, with its subtasks, comments, files and Claude thread. The time logged on it stays, under its last name, and so does the record of its Claude runs and pull requests.
• The hunter’s stretches and Usage: kept with your workspace’s data, and deleted with it.
• Waitlist sign-ups: until you ask us to take you off, by writing to hello@tengu.work, or delete your Tengu account.
• Billing records and agreements: invoices at Stripe, our billing history and the record of each agreement made when starting or joining a workspace or paying stay after a workspace or an account is deleted, for tax and as proof of what was agreed. After an account is deleted, its agreements keep only ids, no name or email. Canceling or deleting doesn’t remove the card saved at Stripe or the company’s customer record there.
• Usage and recordings (PostHog): recordings for 30 days; the analytics for as long as our PostHog plan keeps them, up to 7 years. Deleting your Tengu account doesn’t reach PostHog: write to hello@tengu.work and we delete what it holds about you.
• Technical logs: for a limited time, to run and secure the service. The IP addresses we use to limit sign-in attempts are deleted after a day.
• Backups: deleted data can stay in our backups for a limited time, until they are overwritten.

Everyone gets the same choices: to see, correct, download and delete the personal data we hold about them, and to stop the emails that can be stopped. Depending on where you live, you may have more rights; we honor these choices for everyone.

• Download or delete your account yourself in Settings › Your account (client guests: your organization menu › Your account), or from the Delete my account link on onboarding. Download my data gives one file: your account (email, name, picture, when it was made and when you last signed in), every workspace you are or were in (its name, your role, the name it knows you by, and when you were invited, joined and left) and your waitlist sign-up.
• Deleting your account needs a sign-in from the last 15 minutes and your email typed out. An owner first hands the workspace over, or deletes it and waits until it is deleted for good, 30 days later. Your sign-in, name and email go at once, with any Tengu staff role and your waitlist sign-up, and you leave every workspace: your Slack links (with replies as you) and Slack notification settings, ClickUp sign-in, Google connection (with the text Tengu copied from the files you picked, and Recall.ai’s copy of your calendar), day plans and inbox go, agent tokens acting as you are revoked, and a running timer stops. What PostHog holds about you goes when you write to us (see How long we keep it).
• The work you did in a workspace (comments, time, timesheets, pay, ticket history and uploads) stays with that workspace, under the name it knew you by, and its exports show a blank email for you. To have your name taken off too, ask the workspace’s owner: when they tell us in writing, we show you there as “Former member”. If that workspace invites you back, your work and your name come back with you.
• A whole workspace: owners and admins download its data with Export in Admin › Settings, and the owner deletes it there.
• Anything else, or if you can’t sign in: write to hello@tengu.work and we will answer within 30 days. We act on a request only when it comes from the account’s own address. If your workspace is run by your employer, we may need to work with its owner (see Who is responsible).
• Emails: members choose which news emails they get in Settings › Email, and client guests turn theirs off with Email me updates in their inbox. To stop a workspace’s update emails without signing in, use the Stop these emails link in any of them, or the Unsubscribe your mail app shows; Settings or the inbox turns them back on. To come off the waitlist, write to hello@tengu.work and we take you off the same day. Sign-in codes and billing emails come with the account and can’t be turned off; if one reaches the wrong address, write to us.
• Two-factor sign-in: turn it on or off in Settings › Two-factor sign-in (client guests: Security). There are no recovery codes: if you lose your authenticator app, write to hello@tengu.work from your account’s address, and once your workspace’s owner or another admin confirms it is you, we remove it and sign you out everywhere.

Tengu sets no advertising cookies. From your first visit, on this site and in the app, it sets PostHog’s analytics cookie (a year), which tells one browser’s visits from another’s and, once you sign in, ties them to your account. It is set without asking first: there is no cookie banner. Signed in, cookies also keep you signed in and remember choices like your look and layout. When an owner or admin adds a card or confirms a payment in Admin, Stripe sets two cookies of its own, __stripe_mid (a year) and __stripe_sid (30 minutes), which it uses to prevent card fraud. The cookie policy lists every cookie and what each is for.

Tengu doesn’t track you across other sites. The one third party that may is Stripe: when an owner or admin adds a card or confirms a payment in Admin, Stripe collects information about that device and uses it across the sites that use Stripe to prevent fraud, under its own privacy policy. No one else tracks visitors across sites through Tengu. PostHog’s analytics are Tengu’s own: its cookie is read only on Tengu’s pages, and what it records isn’t sold or used for advertising. Tengu doesn’t change what it does for a Do Not Track or Global Privacy Control signal: it treats every browser the same, whatever it sends.

Tengu is a tool for work, for people 18 and older, and isn’t meant for children. We don’t knowingly collect a child’s data, and if we learn we hold some, we delete it. If you think we do, write to hello@tengu.work.

If this page changes in a way that matters, we email workspace owners before the change takes effect. Questions: hello@tengu.work, or by post to Prizmstack LLC, 30 North Gould St, Ste R, Sheridan, WY 82801, USA. Security reports: the security page.