Privacy

Last changed 15 October 2026

Walden is an idea book: you write ideas down and work them out, alone or with a team. This page says what Walden keeps about you, why, who else handles it, how long it stays, and how to have it removed. Walden is made by Virtu Studios, which is responsible for your data. Write to privacy@walden.so about anything here.

What Walden keeps

• Your account. Your name, email address and profile picture, from signing in. Your workspaces, and the role you have in each.
• What you write. Ideas, pages, canvases, sketches, files you add, chats with the AI, and questions left in the margin or on a canvas. A note on a canvas carries the name of whoever put it there, for the people who can open that canvas. This is the point of Walden and stays until you delete it.
• Files. A file you add is kept with the idea you added it to, or with the project when you add it to the project itself, with its name and who added it, and only the people in that workspace can open it. Opening one gives a link that works for a few minutes. A screenshot is shown from an address that opens it for whoever has it, as screenshots always have been. When a file other than a picture is added, Walden pulls its text out once, on its own servers and without calling an AI model, and keeps that text beside the file, so the chat can read it; the text goes when the file does. Text you paste that is too long for one message is kept the same way, as a text file on the idea, and goes to the AI with that message, as anything you write to it does; one pasted on Home and never sent is deleted after thirty days.
• A build you keep open. If you hand an idea off and keep it open, Walden keeps what the coding agent you gave a key to sends back while it builds: its list of tasks, the links to its commits, what it says went differently from the idea, the addresses it gives for a preview and a pull request, and the questions it asks when the idea doesn’t answer something, with what it found and, when whoever runs it answers there, their answer, kept beside the question as theirs until someone puts it on the page. Walden also keeps how many times it looked something up in the idea and how many of those found nothing, never what it asked. If you take a task, send a build back or mark it built, your name is kept beside that, for the people in that workspace; the agent is told who took a task and who sent it back. Of the key, Walden keeps a fingerprint and the last four characters, so you can tell your keys apart. It never keeps the key itself.
• Billing. Your plan, credits, and what each AI request cost. Card details go to Stripe; Walden never sees the number.
• Use. Which days you opened the app, and the AI requests you made, to count active people and to charge credits.
• Leaving. When you delete your account, end a paid plan, or leave or are removed from a team, Walden writes down that it happened, which plan it was on, how many days since you joined, and, for a deleted account, how many ideas were in your idea book. If you say why, in the delete dialog or on Stripe’s cancellation page, your words are kept with it. None of it carries your name, email or workspace, so it stays after your account is gone. It is how Walden learns what makes people go.
• Visits to the site. Counted as described next.

How visits are counted

Walden counts visits to learn how people find it and whether they come back. It sets no cookie for this and stores no IP address. When a page loads, the server takes your IP address and your browser’s description of itself, mixes them with a secret key and the current month, and keeps only the result: a code that lets the same browser be recognised until the month ends, and then never again. With it Walden keeps the page, the site that linked you, if any, and your country and region as guessed from the IP address.

That code is not your name, but it can single you out, so it is treated as personal data. If you sign up, the code from that visit is kept beside your new account, to know which link brought you. Visit records are deleted after 180 days, and at once if you delete your account.

If your browser sends Global Privacy Control or Do Not Track, your visits are not counted at all. You can also object by writing to privacy@walden.so.

AI

When you ask the AI for something, and when Walden reads a saved page to suggest what to ask next, the text needed (and, when a UI sketch is checked before you see it, a picture of that sketch, taken on Walden’s own servers) goes through Vercel’s AI Gateway to the model that answers: Anthropic, OpenAI, Google or TypeSafe AI, depending on the job and on your choice. Walden asks the gateway to send it only to providers that have agreed not to train on it, and all four have. Walden does not use what you write to train models either. The chat beside the idea list reads across the ideas of the workspace, what earlier ideas ruled out or settled at hand-off, and ideas waiting in Deleted, and sends what a question needs the same way. If you add your own model key, requests go under your account and your terms with that provider. Walden checks the key with that provider when you add it, keeps it encrypted, and deletes it when you remove it or the paid plan ends.

A project can have up to five GitHub repositories connected, each with its own switch. While a repository's switch is on, the code a request needs from it goes to the model the same way; a repository whose switch is off sends nothing. Walden keeps a digest of each such repository (its file tree, its routes and the files that define its data), made again when its default branch changes, and sent only while its switch is on. A line you write about what is in a repository goes to the model with its code. When you pick files in the chat, Walden asks GitHub for the names of the files in each of the project's repositories it may read and keeps them in your browser while the chat is open. A file you pick is read when you pick it and again each time the chat answers; Walden keeps the names of the files you picked with your conversation, never what is in them. Files that look like secrets, such as .env files, keys and certificates, are never read.

You can also pick, in the chat, files added to the idea or to the other ideas in its project. The text Walden pulled out of each goes to the model with each message, the same way, until you take the file off; Walden keeps which files you picked with your conversation.

When a second reader has left questions on a page, Walden reads them against the page once you have saved it and stopped typing, to say under a question that the page may answer it now. The saved page and those open questions go to the classifier, TypeSafe AI’s, through the gateway and under the same terms. It only marks a question: it removes nothing, and it never reads a question a person asked.

Coding agents

You can hand an idea off and keep it open to the coding agent that builds it. You make a key for one workspace and give it to the agent; it opens every project there, including ones made later, and the ideas that are in no project. With it, the agent can list and read the ideas in that workspace that were handed off and kept open: their first page and their other pages, as they stand (a UI sketch as the markup it was drawn in), the names of the files added to them or used from another idea of the project, and the text Walden pulled out of those files, and the list of that build, with the name of anyone in the workspace who took a task on it or sent it back, and the name of whoever picked each idea up. One person’s agent builds an idea at a time: once it is picked up, by choosing it from the list or by making its list, another person’s key can read it and change nothing of its build, until whoever runs that other agent chooses to take it over. It keeps that list in Walden: its tasks, which of them are done, a line on what it is doing, the links to its commits, and at the end what it says it built. When the idea doesn’t answer something, it can leave a question beside the part it is about, and pass on the answer the person running it gave; only a person answers on the page. Only a person can mark a build built. It cannot read anything else, and it cannot change a word of a page. An owner can turn coding agents off for a whole workspace, in Settings, and then no key opens anything in it. The agent is yours, not Walden’s: what it does with what it reads, and where it sends it, is under your agreement with whoever makes it. Walden calls no AI model to answer it.

A key acts as you, and only while you are in that workspace, as an owner, an editor or a viewer. It stops working when you take it back in Settings, when you leave the workspace, and when you delete your account.

Walden emails you about a build at five moments and no others: when the work is picked up, if you handed it off; when the build first asks a question the idea doesn’t answer, if you handed it off and someone else is running the agent; when it is finished, if you can edit that workspace; when a review sends it back, if your key picked the work up; and when it is marked built, if you are in that workspace. Each goes once for a build. None is sent for a task, none carries anything the agent wrote, and none is sent to you about what you did yourself. You can turn each of them off in Settings, under Emails.

When an idea is handed off, what it ruled out and what it settled is kept with it, so it can be found again. A coding agent with a key can look it up in the projects its key opens. And when you write, in another idea of the same workspace, something that seems to go against one of those, Walden asks you about it in the margin: the saved page is read against what those earlier ideas decided, and what matches is sent to the classifier, TypeSafe AI’s, through the gateway and under the same terms as every other AI request. It only ever asks, and it never reads across workspaces.

Cookies

Walden sets only the cookies it needs to work, so it doesn’t ask first:

• walden-session keeps you signed in, for up to 30 days.
• walden-signin carries a sign-in to its end, for up to 10 minutes.
• color-scheme remembers light or dark, for a year.
• sidebar_state remembers whether the sidebar is open, for a week.

No advertising cookies, and no analytics or tracking scripts from anyone else. The one thing on the site that comes from outside is the film on the home page, YouTube’s player, and it loads only when you press play; until then the page shows a still kept on Walden’s own servers.

Who else handles it

These services process data for Walden, only to run it:

• Vercel hosts the site and routes AI requests (the AI Gateway).
• Convex stores everything Walden keeps.
• WorkOS handles sign-in, teams and single sign-on.
• Stripe takes payments.
• LaunchDarkly decides who is let in while Walden opens, by account and email address.
• Anthropic, OpenAI, Google and TypeSafe AI run the AI models.
• Resend sends the operator’s own emails about the service, and the emails about a build described below. For those it is given your email address, the idea’s title, and the first name of whoever sent a build back or marked it built.
• GitHub, only if you connect a repository.
• YouTube (Google) plays the film on the home page, once you press play. Until then the page shows a still kept on Walden’s own servers and nothing is loaded from Google. The player is embedded in YouTube’s privacy-enhanced mode; playing it is under Google’s privacy policy, and Walden sends it nothing about you.

Walden does not sell your data or share it for advertising.

Where it is kept

Mostly in the United States. Data sent from the UK or the European Economic Area is protected there by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, as each provider offers.

Why Walden may use it

• To provide the service you signed up for: your account, what you write, billing, and the AI you ask for.
• Walden’s legitimate interest in knowing how people find it and keeping it secure: counting visits and active days, stopping abuse. You can object, as above.
• Legal obligations: payment records, which Stripe keeps for as long as tax law requires.

How long it stays

Your account and what you write stay until you delete them. A deleted idea or project waits in Deleted for thirty days, where you can bring it back, then it is removed, with its files and what a build left on it; a file taken off an idea waits thirty days too, then it is removed; a deleted project takes its ideas with it, and brings them back with it. A key’s fingerprint goes when its project is deleted. Visit records go after 180 days. You can download a copy of everything that is yours, and delete your account, yourself, in Settings under Your data. The copy is one file: each idea in your personal idea book as its hand-off package, and your account (name, email, settings, the readers you wrote and the questions you asked) beside them. Deleting cancels your plan, removes your name, email and picture, deletes your personal idea book with its files, and deletes the visit and activity records tied to you, all at once. The note that you left, described above, stays, because nothing in it points back to you. Work you did in a team’s workspace stays with that team, shown as a deleted account. Stripe keeps payment records for as long as tax law requires.

Your rights

Wherever you live, you can ask to see the data Walden holds about you, to have it corrected or deleted, to have a copy you can take elsewhere, and to object to or limit how it is used. Under the GDPR and UK GDPR these are your legal rights, and you can complain to your data protection authority. Californians have the same rights under the CCPA, and Walden will not treat you differently for using them. Write to privacy@walden.so; you will have an answer within 30 days. You can download that copy yourself at any time, and any single idea through Hand off; an owner can download every idea in a team’s workspace from its General settings.

Children

Walden is not for anyone under 16, and does not knowingly keep data about them. If you believe a child has an account, write to privacy@walden.so and it will be deleted.

Changes

If this page changes in a way that matters, the date above changes, and people with an account are told before it takes effect.

Privacy·Terms