Privacy policy

Effective October 21, 2026.

Who we are

Pumpkin is made by Ezoic Inc. This policy covers the pumpkin.club website, your Pumpkin account, and the parts of the Pumpkin editor that talk to pumpkin.club (including sign-in, license checks, and optional Remote access). Contact: support@pumpkin.club.

What we collect

• Account data. Your email address, your name, and a hashed password. For business plans, the team name and the email addresses of people you invite.
• Billing data. Payments are processed by Stripe. We store your Stripe customer id, subscription id, seat count, and billing status. We never see or store full card numbers.
• Sign-in data. When the editor signs in, we store hashed sign-in tokens so the editor can confirm your license. Tokens are tied to your account and are deleted when you sign out or a license is revoked.
• Server logs. Standard web server logs (IP address, request path, time, user agent) kept for security and troubleshooting.

Organization identity and provisioning

If your business organization configures single sign-on (SSO), pumpkin.club stores its email domain claims and verification records, identity provider settings and metadata, and links between your account and the identity provider's subject identifier. OIDC client secrets are stored encrypted. We keep temporary sign-in state and assertion identifiers to complete sign-in and prevent replay. Your chosen identity provider receives sign-in requests and supplies identity information, such as your email, name, and subject identifier.

If your organization configures SCIM provisioning, we store a hash of its provisioning token, token use times, member email and name fields, external identifiers, group names and membership, and provisioning and disabled-access state. Organization owners and admins manage these settings and can see team membership and seat status; the configured identity provider can read and manage provisioning records. These records let us apply organization sign-in rules, assign or remove access, and prevent disabled users from regaining access through another sign-in path. Removing a membership does not itself delete the person's Pumpkin account or other account records.

Organization audit logs

When an organization enables audit logging and configures a supported cloud logging destination, the editor writes agent action metadata to that organization's storage. Records can link a member to times, action types, session and turn identifiers, outcomes, model-provider and token-use metadata, and hashed identifiers for paths, agents, and other action details. Raw commands and their fingerprints stay out. Audit records do not include raw shell commands or command arguments, prompts, file contents, or model replies. This audit record is separate from any other usage logging or content sharing you enable.

Organization owners and admins can view and export audit reports through pumpkin.club using the configured storage read access. Storage credentials saved on pumpkin.club for these reports are encrypted. Retention of uploaded records follows the storage owner's settings. Pending audit records are also staged in a local queue on the workspace host for retry; they can survive a restart and remain while upload is failing. Confirmed uploads are removed from the pending queue. Disabling the policy does not erase records already uploaded or pending locally. Audit records are written by the client and are not a tamper-proof or complete record of everything done on a machine.

Organization budgets

When an organization sets budgets, pumpkin.club stores its organization and per-member limits, the account and organization identifiers for Pumpkin-credit use, monthly charges, and reservations for running requests. We use these records to check credit budgets and show spend and limits to the member and authorized organization owners and admins. Budget months use UTC calendar months. Budget checks do not require storing prompt or file contents in the budget records.

Own-key budgets use cost estimates kept on the workspace host, scoped to the signed-in member and organization. Local records include the time, model, estimated cost, and any indication that an estimate is unavailable. These estimates are separate from the server's Pumpkin-credit records and are not a combined total across a member's machines. They count use recorded while the own-key budget applies; they may differ from provider invoices. Changing the month or removing a budget does not itself erase local ledger files. Other usage reporting you enable follows its own configured storage and sharing settings.

Published canvases

Publishing a canvas sends its title and HTML to pumpkin.club, where the HTML is stored compressed with share and owner identifiers. A public-link share is available to anyone who has the link; an organization-only share requires a signed-in member of the publisher's business organization. Shared pages are marked not to be indexed by search engines, which does not make a public link private. Updating a share replaces its stored HTML.

Revoking a share deletes its stored HTML and makes the link unavailable. A record of the share identifier, title, owner, and other share metadata remains so the identifier is not reused. Revocation does not erase copies someone already received. Contact support about deletion of retained account-linked records.

Advertising measurement

We advertise Pumpkin with Google Ads. To measure those ads, our public marketing and legal pages (the home page, pricing, features, comparisons, supported models, model pricing and capabilities, this policy, and the terms) load the Google tag from Google. That tag records Google Ads measurement and also sends the visit to the Google Analytics property linked to our Google Ads account, so we can see how ad visitors use those pages. It also runs on a minimal purchase confirmation page after we verify a completed payment with Stripe, and on a minimal sign-up confirmation page shown once, right after we create a new Pumpkin account (by email and password, with Google, or from a team invitation) and sign you in. It does not run on other account or billing pages, the sign-in and sign-up forms, signing in to an existing account, linking Google to an existing account, failed sign-ups, password reset, invitation forms, error pages, or later visits to the sign-up completion address.

On those public pages and the verified purchase and sign-up confirmations, your browser contacts Google directly, so Google receives your IP address, browser details, and cookies it may set or read for Google Ads and Google Analytics, a Google Analytics client ID, and site visit measurements used to connect visits with ad clicks and measure how people use the site. On public landing pages, we retain Google ad click identifiers so the tag can connect the visit to an ad. We remove other query parameters and the fragment before loading Google. On the purchase confirmation, we remove the full query string, including the Stripe checkout identifier. We tell the tag to report the page address without its query string or fragment and only the origin of the referring site. For a verified live, paid USD seat purchase, we also send the amount paid, currency, and a one-way hash of the checkout identifier so Google can recognize repeated reports of the same purchase. On the sign-up confirmation, before loading Google we replace the whole page address, including any invitation link, Google sign-in code, and return path, with the fixed address /signup/complete, and we report no referring site. We send only that a sign-up happened and a random transaction identifier that is not linked to your account. The page then continues to /signup/continue, which uses a short-lived cookie limited to that address to send you to the page you were heading to (or your account page); that cookie is not shared with Google and never causes a report. If your browser blocks the tag or scripts, the sign-up still completes and the page offers a Continue link; that sign-up is simply not measured. We have turned off ad personalization signals and enhanced conversions, and we do not send your email address, name, or account details to Google. Google handles this data under the Google Privacy Policy and its partner sites policy. You can block it with your browser's cookie or tracker settings, or manage Google ads at My Ad Center.

Model connections and optional services

The agent runs on your workspace machine. With your own provider keys, model requests go directly from that host to your chosen provider without a Pumpkin-hosted inference relay. Cloud models receive the prompts and context you send. Model API keys use protected secret storage.

When you use optional Pumpkin credits, your prompts and context pass through pumpkin.club to Fireworks for model inference, and responses pass back through the relay. pumpkin.club records account and organization identifiers, model, token counts, and cost for billing. Fireworks receives the model request content under its data policy. With your own OpenRouter key, requests instead go from the workspace host to OpenRouter and its selected model provider under their policies.

If you connect the optional Pumpkin Slack app, pumpkin.club relays Slack mentions and messages to your connected machines and sends the agent's progress and replies back to Slack threads. This can include content you or the agent place in those messages. The relay keeps no persistent message tables; thread routing metadata is kept in Slack messages. Slack retains messages under the workspace's settings and Slack's policies. Disconnecting the app does not erase messages already posted to Slack.

Enabled sync, usage reporting, connected tools, and submitted feedback can send data to the services you choose. Sync and reporting follow your configured storage and sharing settings. Remote access is described below. Read the connection guide.

Optional Remote access

The Remote broker stores your account's machine and device identifiers, public identity keys, approval and revocation state, and approximate online status. It sees request times, sizes, and network IP addresses. Pairing messages, device names, presence contents, and connection signaling are encrypted for the endpoints; the broker has no pairing root keys and cannot recover them for you. Session lists, prompts, replies, and commands travel only over encrypted WebRTC connections, not the broker mailbox, except for the optional question notices described next.

If you turn on push notifications for a Remote device, pumpkin.club stores that device's push subscription endpoint, platform, and last update time. When the agent asks a question, your computer encrypts a short notice for that device, including the question title, machine name, and session and request identifiers. pumpkin.club forwards the encrypted notice with its delivery time limit, urgency, and topic to your browser's push service, which delivers it to the device. pumpkin.club does not store the notice and has no keys to decrypt it; the push service sees delivery metadata, not the notice text.

When a direct connection is unavailable, configured Cloudflare Realtime TURN relays the encrypted connection. Cloudflare can observe connection metadata and traffic volume, but not the encrypted WebRTC content. Pumpkin issues separate one-hour credentials for each endpoint connection and requests their revocation when you remove a device. Failed provider revocations are retried; credentials also expire. TURN use can incur provider bandwidth costs. This protection assumes you trust the phone app delivered by pumpkin.club: a compromised app-delivery origin could access browser-held keys.

How we use data

To create and secure your account, bill you, send transactional email (invitations, password resets, and trial-end reminders), confirm your license to the editor, and keep the service running. We use the advertising measurement and site analytics described above to see which of our ads bring visitors to pumpkin.club and how people use our public pages. We also use the limited purchase and sign-up measurements described above to measure sales and new accounts from our ads. We do not sell personal data or send account identity, payment card details, or editor content to Google.

Who else sees it

• Stripe processes payments under its own privacy policy.
• Amazon Web Services hosts the site, database, and outbound email.
• Cloudflare provides the optional managed TURN relay described above.
• Fireworks receives model requests through the relay when you use optional Pumpkin credits.
• Slack receives messages and agent updates when you connect and use the optional Slack app.
• Your organization's identity provider and storage services receive the sign-in, provisioning, audit, or usage data described above when your organization configures them.
• Google receives the advertising and analytics measurement data described above from your browser when you visit our public pages or the verified purchase or sign-up confirmation.
• GitHub hosts the editor downloads; when you download, your browser fetches the file from GitHub's storage.

Retention

Account and billing records are kept while your account exists and for as long as tax and accounting rules require afterwards. Server logs are kept for up to 90 days. You can ask us to delete your account by emailing support.

Remote signaling expires after two minutes, pending enrollment messages after ten minutes, presence after 45 seconds, request nonces after 60 seconds, and TURN issuance metadata after one hour. Expired rows are excluded from delivery immediately and removed in bounded periodic database cleanup batches; physical deletion may take longer under a backlog. Approved and revoked device identities remain until account deletion or an explicit removal policy; turning Remote off does not erase unrelated account records or data an endpoint already received. Remote keys cannot be recovered by the server. Existing Advanced bucket mode remains governed by your own storage provider's retention and credentials.

Your choices

You can change your password, cancel your subscription, and request a copy or deletion of your data at any time. Write to support@pumpkin.club.

Changes

If this policy changes in a way that matters, we will update the date above and, for account holders, send an email.