Your context is yours.

Segue is a personal context store: it lets AI assistants you connect save blocks of text and load them back by a short handle. Segue is operated by CSA Intelligence Inc., based in Toronto, Ontario, Canada ("we," "us"). It applies to segue.ai, the Segue web app, and the Segue MCP server.

What we collect

Account information. Your email address and a password. Passwords are stored only as cryptographic hashes using bcrypt; we cannot read them.

Your content. The contexts you (or your connected AIs) save: Markdown text, optional titles, handles, project names, and timestamps. Personal content is private to your account unless you explicitly share it, publish a handoff, or move it into a workspace. Access checks enforce the permissions for each kind of content.

Connected AI clients. When you connect an AI tool, we store its OAuth client registration, the scopes you approved, hashed access and refresh tokens, and when it was last active. We never see or store your credentials for those AI tools.

Billing. Purchases are processed by Polar Software Inc. as merchant of record. Polar — not Segue — collects your payment details; we never see your card number. From Polar we receive and store your subscription status, plan, billing period, and a Polar customer reference.

People you share with. If you share a context, we store the recipient's email address on your instruction, so we can deliver the link and so you can see and revoke the share later. We log when that link is opened and how many times, and we tell you the first time — a share you can't audit isn't really revocable. If the recipient has no Segue account, we also store a frozen copy of the context's text so there is something for the link to open; that copy is destroyed when they sign up, when you revoke, when the share expires, or when you delete the context, whichever comes first. We never email the recipient the context itself, only its title and a link, and we don't use their address for anything except that share.

Technical data. Standard server logs (IP address, user agent, request timestamps) kept for security, debugging, and rate limiting, and retained for 30 days.

Application diagnostics. We use Sentry to investigate application errors and keep the service reliable. Diagnostic reports can include error messages, stack traces, log messages, and request metadata captured when a problem occurs, plus performance information when enabled. Error and log details can contain information associated with the request being processed.

Usage events. To understand how Segue is used, we record one row per product action in our own database — what happened (a context saved, loaded, or deleted; an AI client connected), when, which account, and which AI client. For campaign landing pages, we also count requests and signup starts, and carry a small set of campaign labels through the signup form to measure signups and first-brief creation. This uses no tracking cookie or advertising pixel. We do not store full URLs, referrers, IP addresses, or user agents in these campaign events. These records deliberately hold no content: never the text of a context, its title or handle, your search terms, or your email address. They are first-party, stay on our infrastructure, and are never sent to an analytics vendor.

How we use it

To provide the service: storing and serving your contexts, authenticating you and your connected clients, delivering the shares you ask us to send, and enforcing plan limits. To keep the service safe: rate limiting, abuse prevention, and detecting token misuse. To bill you, via Polar. To email you transactional messages (password resets, billing notices, and the shares you send) — delivered through Resend. To understand aggregate product health, using metrics derived from service activity (for example, how many contexts are saved or loaded per week).

We do not sell your data. We do not show ads. We do not use your contexts to train AI models — ours or anyone else's. We read individual account content only if you ask us to (support) or the law requires it.

Email choices

Creating an account does not subscribe you to optional emails. If you choose to receive them in Settings, Segue may send product updates, tips, offers, and occasional feedback requests through Resend. We record your choice, when and where you made it, and the consent wording and sender identity shown to you. Existing accounts start with optional emails off.

You can withdraw consent at any time in Settings or using the unsubscribe link in an optional email, without signing in. Withdrawal takes effect immediately. Essential account emails, such as verification, password resets, security, billing, and sharing notices, continue. We use consent as the legal basis for optional emails and delete preference records when we delete your account.

Your connected AI clients

This part is unusual and worth understanding. When an AI you connected loads a context, that content is transferred to that AI's service — for example, loading a handle in ChatGPT sends that context to OpenAI, under OpenAI's terms and privacy policy. Your connected clients must have the scopes you approved on our consent screen, and you can revoke them in Settings at any time. People who have access to shared or workspace content can also load that content through clients they authorize. But once a context is loaded into another vendor's tool, that copy is governed by your relationship with that vendor, not by this policy. You carry the baton; mind where you pass it.

Sharing a context with another person

For an email share of a personal context, only you can share content you own, and only with an address you name. This kind of share is always read-only, always expires (14 days by default, 90 at most), and can be revoked in one click, which kills the link on the next request. Recipients cannot edit, re-share, or hand it on. If a recipient has a Segue account on that address, they see your later edits; if they don't, they only ever see the copy taken when you shared, and never anything you write afterwards.

Because an AI you've connected can call the sharing tool on your behalf, that permission is separate from reading and writing, off unless you approve it, and the first time any AI tries to send to a new address we email nobody until you confirm it in your browser. If something ever instructs your assistant to send your context somewhere you didn't intend, that is where it stops.

Who we share data with

We share data only with the processors needed to run the service:

Processor	Purpose	What they receive
Railway	Hosting and database (the United States)	All service data
Polar Software Inc.	Payments, merchant of record	Email, purchase and subscription data
Resend	Essential and consented optional email	Your email address, message content, and the addresses of people you share with
Sentry (Functional Software, Inc.)	Application diagnostics and error monitoring (United States)	Error details, stack traces, log messages, request metadata, and performance information when enabled

No third-party analytics, tracking pixels, or advertising SDKs run on Segue. Our web fonts are served from our own servers rather than a font CDN, so loading a Segue page does not hand your IP address to anyone outside the processors listed above.

We may disclose data if required by law, or as part of a merger or acquisition — in which case this policy continues to apply to data collected under it and we will notify you.

Cookies

Segue sets only essential cookies: a session cookie to keep you signed in and a CSRF token to protect forms. No tracking cookies, no cookie banner theater.

Workspaces

Workspace members share their name, email and membership role with the workspace. All members can read its briefs and templates. Guests can only read briefs they are explicitly invited to. Personal writing remains private unless you explicitly move it to a workspace. Workspace billing is separate from personal billing and uses a workspace customer record at Polar.

Workspace content and contribution history stay with the team when a member leaves or deletes their personal account. A billing administrator must transfer responsibility or close the workspace before deleting their account. Workspace administrators control membership and content access.

Retention and deletion

Your contexts stay until you delete them. Deleting a context is immediate and permanent — there is no trash. Briefs retain contribution history and templates retain versions until deleted. Revoking a client invalidates its tokens immediately, and revoking a share kills its link on the next request.

Shares expire on their own. When one expires or is revoked, any frozen copy we were holding for an accountless recipient is destroyed; we keep the record that the share existed, with whom, and when it was opened, so you can still audit it. Deleting a context destroys its shares and their copies along with it.

To delete your account entirely, email us at support@segue.ai; we will remove your account, contexts, client registrations, and instruct Polar to delete your customer record, within 30 days. Backups age out within 30 days after that. We retain billing records as long as tax law requires.

One exception, stated plainly: the usage-event records described above are anonymized rather than deleted — the link to your account is severed, and what remains is a contentless row saying an action happened at a time. Nothing in it identifies you. We keep them so deleting an account doesn't silently rewrite our own historical usage totals.

Your rights

You can access and export everything without asking us: every context is viewable, editable, and downloadable as Markdown in the web app. You can correct data by editing it, and delete it yourself as described above.

If you're in Canada, we handle personal information in accordance with PIPEDA; you may request access to or correction of your personal information, or complain to the Office of the Privacy Commissioner of Canada. If you're in the EU/EEA or UK, you have the rights the GDPR grants — access, rectification, erasure, portability, restriction, and objection — and our legal bases are performance of a contract (running the service you signed up for) and legitimate interest (security and abuse prevention). We don't do automated decision-making or profiling.

To exercise any right, email support@segue.ai. We'll respond within 30 days.

Security

Everything in transit is encrypted with TLS. Access, refresh, and password-reset tokens are stored only as SHA-256 hashes. Connected clients get narrow scopes and short-lived tokens (access tokens last 1 hour), and detected reuse of an authorization code revokes the whole token chain. Content reads require ownership, an active share, or authorized brief or workspace membership. No system is perfectly secure, but if we learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.

Children

Segue is not directed at children and requires users to be 16 or older. We don't knowingly collect data from anyone younger; if you believe we have, email us and we'll delete it.

International transfers

Segue is operated from Canada and hosted in the United States. Canada holds an EU adequacy decision for commercial organizations under PIPEDA; where data leaves your jurisdiction, we rely on that adequacy and our processors' standard contractual clauses.

Changes

If this policy changes materially, we'll email account holders and post the new version with a fresh effective date. Continued use after that date means the new version applies.

Contact