Privacy Policy

This Privacy Policy explains how MaxPoints LLC, doing business as MaxPoints (“MaxPoints,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you use Chef. Chef is a project control plane that includes our project directory, dashboards, boards, APIs, packages, project chat, and local and cloud coding-worker features (collectively, the “Services”).

This policy applies to information MaxPoints controls through the Services. Your use of Chef is also governed by our Terms and Conditions, and our AI Disclaimer explains additional considerations for AI-powered features.

Information Chef collects

Depending on the features you use, Chef may collect:

• Account and team information, including your primary and verified linked email addresses, personal or business email labels, password hash, account role, team membership and role, invitations, and account and worker identifiers.
• Project and board information, including project names, descriptions, websites, visibility and worker settings, repository names and remote URLs, branches, boards, tickets, checklists, due dates, comments, votes, suggestions, task updates, validation results, and files you attach.
• Prompts and AI content, including project-chat messages, task instructions, relevant board context, attachments, source code and repository context made available to a coding worker, AI responses, model details, token usage, and worker run results or errors.
• Connected-service information, including your GitHub login, repository metadata, Vercel project and team identifiers, and encrypted GitHub, Vercel, OpenAI API, or ChatGPT Codex credentials when you choose to connect or store them. Environment-variable values entered in Chef are relayed to your Vercel project and are not persisted in Chef's application database.
• Payment and subscription information, including the plan you chose, the amounts due, paid and refunded, Stripe customer, checkout session, subscription and invoice identifiers, subscription status and paid-through dates, and whether a MaxNova membership was bought with a project plan. Card details are entered on Stripe's checkout and never reach Chef. When you connect your own Stripe account to a project, Chef reads that account's customers, subscriptions and payments to show you its Stripe dashboard, and records a daily count of paying subscribers and monthly recurring revenue for that project's analytics.
• First-party analytics, including pathname-only page views, page titles, a pseudonymous visitor identifier, a session identifier, the time a page was open and in focus, product events, timestamps, your country, your device type, browser, and operating system as general labels, and attribution such as campaign parameters and a referrer with its query and fragment removed. Chef excludes project administration routes from this product analytics.
• Diagnostics and service activity, including sanitized error messages and stack traces, component stacks, pathname, browser user agent, worker status and heartbeat data, and server or security logs that may include an IP address, request time, and device or browser information.

We collect this information directly from you, automatically through your use of Chef, from project visitors who submit suggestions or votes, from workers you authorize, and from connected services when you direct them to interact with Chef.

Public and private project information

A project owner chooses whether a project is public or private and controls team access to private projects. Information intentionally presented on a public project page—such as its name, description, website, status, and aggregate votes—can be viewed by anyone. Project settings, private board details, attachments, integrations, and credentials are not made public through the public project page. Do not submit confidential or personal information in a public field.

How Chef uses information

We use information to:

• create accounts, authenticate users and workers, and administer teams and project access;
• operate boards, attachments, suggestions, votes, project chat, analytics, and error reporting;
• take payment for project plans and memberships through Stripe, confirm subscriptions, issue pro-rated refunds on cancellation, and show project owners their own Stripe figures;
• carry out task instructions through local or cloud coding workers and support approval, pull-request, merge, and deployment workflows;
• connect repositories and deployment projects and perform actions you request through GitHub and Vercel;
• measure use, diagnose failures, maintain availability, and improve Chef;
• protect accounts, credentials, projects, the Services, and other users from fraud, abuse, and unauthorized access;
• communicate with you about the Services and respond to support or privacy requests; and
• comply with law, enforce our agreements, and establish, exercise, or defend legal claims.

We do not use personal information for a materially different purpose without providing any notice or consent required by law.

AI and coding workers

When you use project chat, Chef sends your message, recent chat history, and relevant project and board context to the configured AI model. When you authorize a coding worker, the worker may process task instructions, attachments, repository content, command output, and other project context needed to complete the task. A local worker processes repository files in the environment where you run it; a cloud worker processes them in an isolated hosted sandbox.

Depending on the authentication option you choose, AI requests and related content may be processed through OpenAI, ChatGPT Codex, or Vercel's AI infrastructure under the applicable provider terms. Do not submit personal information to an AI feature unless it is necessary and you have the right to provide it. Review the permissions and data available to a worker before authorizing it.

Cookies and local storage

Chef uses HTTP-only session and refresh cookies, marked secure in production, to keep you signed in, maintain account security, and refresh an authenticated session. Short-lived cookies are also used to complete Vercel authorization. Disabling these cookies may prevent account and integration features from working.

Chef uses browser local storage for a pseudonymous first-party analytics identifier, a session identifier that expires after 30 minutes without activity, and attribution data, and to remember interface preferences such as sidebar layout. Chef does not use Google Analytics, advertising pixels, Flash cookies, or cross-site behavioral advertising on the Services covered by this policy.

The Chef browser extension

The MaxChef extension for Chrome lets you see and add tasks for a site you build with Chef. When you open it, it sends the address of the tab you are viewing to Chef to find out whether the site belongs to one of your projects. If you keep it open in Chrome's side panel and allow it to read the sites you visit, it does the same for each tab you switch to while the side panel is open. It does not read or send the sites you visit while it is closed.

On a site that belongs to one of your projects, the extension can take a screenshot of the page or of an area you select. Screenshots and unsent task text stay in your browser until you add the task, and are cleared when the browser closes. When you add a task, the extension sends its text, the page's address, and the screenshot you chose to Chef, where they are stored with the task and visible to the people and workers who can see that project's board.

The extension keeps a sign-in token in its browser storage so it can act for your account. Signing out of the extension, or signing out of Chef everywhere, revokes it. We use information from the extension only to provide these features. We do not sell it, use it for advertising, or use it to build a profile of your browsing, and our use of it adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

How we disclose information

We may disclose information to:

• Infrastructure providers that host Chef's application, database, private file storage, cloud worker sandboxes, and realtime dashboard updates.
• AI providers that process project chat or coding-worker requests as described above.
• GitHub and Vercel when you connect an account or direct Chef to read repository information, manage branches or pull requests, inspect builds, or manage deployment settings.
• Your team and the public, according to the project visibility, membership, role, and project-access settings selected by project and team administrators.
• Professional advisers, authorities, and safety-related recipients when reasonably necessary to obtain professional services, comply with law, protect rights or safety, investigate fraud or abuse, or enforce our agreements.
• Parties to a business transaction in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

We may also disclose information with your consent or at your direction, or disclose aggregated or de-identified information that cannot reasonably be linked to you.

We do not sell personal information

MaxPoints does not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising or process it for targeted advertising. If these practices change, we will update this policy and provide any notice and choices required by law before beginning them.

Data retention and deletion

We retain account, project, worker, integration, analytics, and diagnostic information for as long as reasonably necessary to provide and secure Chef, maintain the record of project work, comply with legal obligations, resolve disputes, and enforce agreements. Retention varies with the information and the status of the related account or project. Information may remain in backups for a limited period after deletion.

Deleting a task or project deletes its associated Chef records and requests deletion of its stored attachments. Resetting project analytics deletes the recorded page views, visitor data, events, and attribution for that project. Content already sent to a connected service, committed to a repository, included in a deployment, or copied by another authorized user remains subject to that location's controls and retention practices.

Data security

We use safeguards designed to protect information, including hashing account passwords and worker tokens, encrypting stored integration and AI credentials, restricting project and attachment access, and limiting cloud-worker job credentials by user, task, and expiration. Chef's error package is designed to remove common credentials and personal information from reports before transmission. No method of transmission, storage, or automated redaction is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting your account and worker credentials, limiting team and integration permissions, and avoiding secrets or unnecessary personal information in tasks, prompts, attachments, logs, source code, and public project fields.

Your choices and privacy rights

You can change project visibility and team access in Chef, remove project content, reset a project's analytics, sign out to clear authentication cookies, clear local storage through your browser, and revoke GitHub or Vercel access through the connected provider. Some choices may prevent the affected feature from working.

Depending on where you live and subject to applicable exceptions, you may have rights to confirm whether we process your personal information, access or obtain a portable copy of it, correct it, delete it, or withdraw consent. You may also have rights to opt out of a sale, targeted advertising, or certain profiling. MaxPoints does not engage in the sale or targeted-advertising practices described above.

To exercise a privacy right, mail us using the contact information below and describe your request. We may need to verify your identity and authority. Where applicable, you may use an authorized agent or appeal a denied request. We will not discriminate against you for exercising a privacy right.

Children's privacy

Chef is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

Third-party services and links

GitHub, Vercel, OpenAI, ChatGPT, and other websites or services you access through Chef control their own privacy practices. Their policies apply to information they process, and disconnecting an integration in Chef does not automatically delete information held by that third party. Review the provider's settings and privacy policy and revoke access there when appropriate.

Changes to this Privacy Policy

We may update this policy as Chef, our data practices, or legal requirements change. We will post the updated policy and revise the “Last updated” date above. If a change is material, we will provide additional notice when required by law.

Contact us

Questions or requests concerning this Privacy Policy may be mailed to:

Email: support@maxchef.app