Privacy

Last changed 25 October 2026

Walden is an idea book: you write ideas down and work them out, alone or with a team. This page says what Walden keeps about you, why, who else handles it, how long it stays, and how to have it removed. Walden is made by Virtu Studios, which is responsible for your data. Write to privacy@walden.so about anything here.

What Walden keeps

• Your account. Your name, email address and profile picture, from signing in. Your workspaces, and the role you have in each.
• What you write. Ideas, pages, canvases, sketches, files you add, chats with the AI, and questions left in the margin or on a canvas. A note on a canvas carries the name of whoever put it there, for the people who can open that canvas. This is the point of Walden and stays until you delete it.
• Files. A file you add is kept with the idea you added it to, or with the project when you add it to the project itself, with its name and who added it, and only the people in that workspace can open it. Opening one gives a link that works for a few minutes. A screenshot is shown from an address that opens it for whoever has it, as screenshots always have been. When a file other than a picture is added, Walden pulls its text out once, on its own servers and without calling an AI model, and keeps that text beside the file, so the chat can read it; the text goes when the file does. Text you paste that is too long for one message is kept the same way, as a text file on the idea, and goes to the AI with that message, as anything you write to it does; one pasted on Home and never sent is deleted after thirty days.
• A build you keep open. If you hand an idea off and keep it open, Walden keeps what the coding agent you gave a key to sends back while it builds: its list of tasks, the links to its commits, what it says went differently from the idea and what it chose that the idea doesn’t say, the addresses it gives for a preview and a pull request, and the questions it asks when the idea doesn’t answer something, with what it found and, when whoever runs it answers there, their answer, kept beside the question as theirs until someone puts it on the page; what they decide there while it builds is kept the same way, as a question with their answer. Walden also keeps how many times it looked something up in the idea and how many of those found nothing, never what it asked. If you take a task, send a build back or mark it built, your name is kept beside that, for the people in that workspace; the agent is told who took a task and who sent it back. Of the key, Walden keeps a fingerprint and the last four characters, so you can tell your keys apart. It never keeps the key itself.
• Billing. Your plan, credits, and what each AI request cost. Card details go to Stripe; Walden never sees the number.
• Use. Which days you opened the app, and the AI requests you made, to count active people and to charge credits.
• Leaving. When you delete your account, end a paid plan, or leave or are removed from a team, Walden writes down that it happened, which plan it was on, how many days since you joined, and, for a deleted account, how many ideas were in your idea book. If you say why, in the delete dialog or on Stripe’s cancellation page, your words are kept with it. None of it carries your name, email or workspace, so it stays after your account is gone. It is how Walden learns what makes people go.
• Early access. Before a part of Walden is open to everyone, Walden keeps a list of who it is on for: accounts, email addresses, or every address at a company’s domain. Whoever runs Walden keeps the list, and nothing outside Walden sees it. Deleting your account takes you off it.
• Visits to the site. Counted as described next.

How visits are counted

Walden counts visits to learn how people find it and whether they come back. It sets no cookie for this and stores no IP address. When a page loads, the server takes your IP address and your browser’s description of itself, mixes them with a secret key and the current month, and keeps only the result: a code that lets the same browser be recognised until the month ends, and then never again. With it Walden keeps the page, the site that linked you, if any, and your country and region as guessed from the IP address.

That code is not your name, but it can single you out, so it is treated as personal data. If you sign up, the code from that visit is kept beside your new account, to know which link brought you. Visit records are deleted after 180 days, and at once if you delete your account.

If your browser sends Global Privacy Control or Do Not Track, your visits are not counted at all. You can also object by writing to privacy@walden.so.

AI

When you ask the AI for something, and when Walden reads a saved page to suggest what to ask next, the text needed (and, when a UI sketch is checked before you see it, a picture of that sketch, taken on Walden’s own servers) goes through Vercel’s AI Gateway to the model that answers: Anthropic, OpenAI, Google or TypeSafe AI, depending on the job and on your choice. Walden asks the gateway to send it only to providers that have agreed not to train on it, and all four have. Walden does not use what you write to train models either. The chat beside the idea list reads across the ideas of the workspace, what earlier ideas ruled out or settled at hand-off, and ideas waiting in Deleted, and sends what a question needs the same way. If you add your own model key, requests go under your account and your terms with that provider. Walden checks the key with that provider when you add it, keeps it encrypted, and deletes it when you remove it or the paid plan ends.

A project can have up to five GitHub repositories connected, each with its own switch. While a repository's switch is on, the code a request needs from it goes to the model the same way; a repository whose switch is off sends nothing. Walden keeps a digest of each such repository (its file tree, its routes and the files that define its data), made again when its default branch changes, and sent only while its switch is on. A line you write about what is in a repository goes to the model with its code. When you pick files in the chat, Walden asks GitHub for the names of the files in each of the project's repositories it may read and keeps them in your browser while the chat is open. A file you pick is read when you pick it and again each time the chat answers; Walden keeps the names of the files you picked with your conversation, never what is in them. Files that look like secrets, such as .env files, keys and certificates, are never read.

You can also pick, in the chat, files added to the idea or to the other ideas in its project. The text Walden pulled out of each goes to the model with each message, the same way, until you take the file off; Walden keeps which files you picked with your conversation.

When a second reader has left questions on a page, Walden reads them against the page once you have saved it and stopped typing, to say under a question that the page may answer it now. The saved page and those open questions go to the classifier, TypeSafe AI’s, through the gateway and under the same terms. It only marks a question: it removes nothing, and it never reads a question a person asked.

Coding agents

You can hand an idea off and keep it open to the coding agent that builds it. You make a key for one workspace and give it to the agent; it opens every project there, including ones made later, and the ideas that are in no project. With it, the agent can list and read the ideas in that workspace that were handed off and kept open: their first page and their other pages, as they stand (a UI sketch as the markup it was drawn in), the names of the files added to them or used from another idea of the project, and the text Walden pulled out of those files, the Figma frames on their pages (each one’s link, the words in it and Walden’s picture of it, as it was handed off and as it is now), and the list of that build, with the name of anyone in the workspace who took a task on it or sent it back, and the name of whoever picked each idea up. One person’s agent builds an idea at a time: once it is picked up, by choosing it from the list or by making its list, another person’s key can read it and change nothing of its build, until whoever runs that other agent chooses to take it over. It keeps that list in Walden: its tasks, which of them are done, a line on what it is doing, the links to its commits, and at the end what it says it built. When the idea doesn’t answer something, it can leave a question beside the part it is about, and pass on the answer the person running it gave; only a person answers on the page. Only a person can mark a build built. If you ask it to, and you can edit that workspace, it can also start a new idea there, as you: your own words as you gave them, and drafts of its parts that count for nothing until you keep them. It cannot read anything else, and it cannot change a word of a page that already exists. An owner can turn coding agents off for a whole workspace, in Settings, and then no key opens anything in it. The agent is yours, not Walden’s: what it does with what it reads, and where it sends it, is under your agreement with whoever makes it. Walden calls no AI model to answer it.

A key acts as you, and only while you are in that workspace, as an owner, an editor or a viewer. It stops working when you take it back in Settings, when you leave the workspace, and when you delete your account.

A project can name the coding agent its ideas go to, and then handing an idea off can start that agent where your team already runs it, on your own account with the agent’s maker, never on Walden’s. Walden opens an issue in the project’s repository, as its own GitHub app: the issue says where the idea is in Walden and how to read it, and in a private repository it carries the idea’s text as well, since the agent may have no other way to it; in a public repository it carries the link alone, because an issue there is public. From then on Walden reads what GitHub sends it about that repository’s branches, pull requests and checks, to say where the build stands, and writes comments on that issue when a question is answered here, when a review sends the build back, when the idea changes, and when you cancel. It never merges, never pushes code, and never puts your key in an issue: the key is a secret you add to the repository yourself. Where the agent has to be assigned the issue, Walden asks GitHub to confirm who you are and assigns it as you; the token that takes is used for that and kept nowhere. Two moments of each run, when its first push and its pull request arrived, are kept for whoever runs Walden to see how the feature does, and are shown to nobody else.

Walden emails you about a build at five moments and no others: when the work is picked up, if you handed it off; when the build first asks a question the idea doesn’t answer, if you handed it off and someone else is running the agent; when it is finished, if you can edit that workspace; when a review sends it back, if your key picked the work up; and when it is marked built, if you are in that workspace. Each goes once for a build. None is sent for a task, none carries anything the agent wrote, and none is sent to you about what you did yourself. You can turn each of them off in Settings, under Emails.

When an idea is handed off, what it ruled out and what it settled is kept with it, so it can be found again. A coding agent with a key can look it up in the projects its key opens. And when you write, in another idea of the same workspace, something that seems to go against one of those, Walden asks you about it in the margin: the saved page is read against what those earlier ideas decided, and what matches is sent to the classifier, TypeSafe AI’s, through the gateway and under the same terms as every other AI request. It only ever asks, and it never reads across workspaces.

Chat apps

You can add Walden to a chat app that takes connectors, and sign in to it through WorkOS. The app then acts as you, and only when you ask. It can read what you can read: the ideas in every workspace you belong to, with their pages, sketches, the text of their files and the words in their Figma frames, and what earlier ideas there ruled out or settled. It can start a new idea in a workspace where you are an editor, with your own words as you gave them and drafts of its parts that count for nothing until you keep them; and add drafts to an idea you can edit (questions, things you are not doing, a part that is still empty), never in place of anything you wrote. It never changes a word you wrote, cannot hand an idea off or build it, and reaches no workspace where an owner has turned coding agents and chat apps off. Walden keeps which apps you signed in with, the name each gave when it did, and whether you disconnected one, and nothing about when you used them. What the app does with what it reads, with your conversation, and with the words it sends here, is between you and whoever makes it. You can disconnect an app in Settings, under Chat apps, and it stops at once; deleting your account removes the record. Walden calls no AI model to answer it.

Figma

You can connect your own Figma account, in Settings under Figma, to put frames from your Figma files on the pages of an idea. Walden only asks Figma for permission to read: who you are, and the files you can open. It never writes anything to Figma. It keeps the token Figma gives it for your account, encrypted, with your Figma name and email address. Each person connects their own. When you disconnect, or delete your account, Walden deletes the token; Figma gives apps no way to cancel one, so it stops working on its own when it runs out.

Walden reads Figma as you only when you put a frame on a page, when someone opens a page with that frame on it, or when you ask it to. When you put a frame on a page, it asks Figma for a picture of that frame, the words in it, its name and the names of its file and page, and keeps them with the idea, where everyone who can read the idea sees them, whether they use Figma or not. When someone opens the page later, at most once an hour, it asks Figma whether the file changed, and if the frame did, it asks for the frame again and keeps the new picture in place of the old one. When the idea is handed off, the picture as it was then is kept too, until the idea is reopened. The pictures count toward your workspace’s storage. When Figma won’t give a picture, or the person whose Figma keeps a frame current disconnects it or leaves the workspace, anyone who can edit the idea can keep it current with their own Figma, and from then on it is read as them. When you choose frames from a file, Walden asks Figma for the file’s pages and the names and sizes of its frames, and keeps none of that. Walden reads no other file.

Cookies

Walden sets only the cookies it needs to work, so it doesn’t ask first:

• walden-session keeps you signed in, for up to 30 days.
• walden-signin carries a sign-in to its end, for up to 10 minutes.
• color-scheme remembers light or dark, for a year.
• sidebar_state remembers whether the sidebar is open, for a week.

No advertising cookies, and no analytics or tracking scripts from anyone else. The one thing on the site that comes from outside is the film on the home page, YouTube’s player, and it loads only when you press play; until then the page shows a still kept on Walden’s own servers.

Who else handles it

These services process data for Walden, only to run it:

• Vercel hosts the site and routes AI requests (the AI Gateway).
• Convex stores everything Walden keeps.
• WorkOS handles sign-in, teams and single sign-on, and signing in the chat apps you connect.
• Stripe takes payments.
• Anthropic, OpenAI, Google and TypeSafe AI run the AI models.
• Resend sends the operator’s own emails about the service, and the emails about a build described below. For those it is given your email address, the idea’s title, and the first name of whoever sent a build back or marked it built.
• Figma, only if you connect your Figma account: to read the frames you put on a page, and the files you choose them from, as you.
• GitHub, only if you connect a repository: to read it, and, if your project names a coding agent, to open and comment on the issue that starts a build there.
• YouTube (Google) plays the film on the home page, once you press play. Until then the page shows a still kept on Walden’s own servers and nothing is loaded from Google. The player is embedded in YouTube’s privacy-enhanced mode; playing it is under Google’s privacy policy, and Walden sends it nothing about you.

Walden does not sell your data or share it for advertising.

Where it is kept

Mostly in the United States. Data sent from the UK or the European Economic Area is protected there by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, as each provider offers.

Why Walden may use it

• To provide the service you signed up for: your account, what you write, billing, and the AI you ask for.
• Walden’s legitimate interest in knowing how people find it and keeping it secure: counting visits and active days, stopping abuse. You can object, as above.
• Legal obligations: payment records, which Stripe keeps for as long as tax law requires.

How long it stays

Your account and what you write stay until you delete them. A deleted idea or project waits in Deleted for thirty days, where you can bring it back, then it is removed, with its files, the pictures of its Figma frames and what a build left on it; a file or a Figma frame taken off an idea waits thirty days too, then it is removed; a deleted project takes its ideas with it, and brings them back with it. A key’s fingerprint goes when its project is deleted. Visit records go after 180 days. You can download a copy of everything that is yours, and delete your account, yourself, in Settings under Your data. The copy is one file: each idea in your personal idea book as its hand-off package, and your account (name, email, settings, the Figma account you connected, the readers you wrote and the questions you asked) beside them. Deleting cancels your plan, removes your name, email and picture, forgets your Figma connection, deletes your personal idea book with its files, and deletes the visit and activity records tied to you, all at once. The note that you left, described above, stays, because nothing in it points back to you. Work you did in a team’s workspace stays with that team, shown as a deleted account. Stripe keeps payment records for as long as tax law requires.

Your rights

Wherever you live, you can ask to see the data Walden holds about you, to have it corrected or deleted, to have a copy you can take elsewhere, and to object to or limit how it is used. Under the GDPR and UK GDPR these are your legal rights, and you can complain to your data protection authority. Californians have the same rights under the CCPA, and Walden will not treat you differently for using them. Write to privacy@walden.so; you will have an answer within 30 days. You can download that copy yourself at any time, and any single idea through Hand off; an owner can download every idea in a team’s workspace from its General settings.

Children

Walden is not for anyone under 16, and does not knowingly keep data about them. If you believe a child has an account, write to privacy@walden.so and it will be deleted.

Changes

If this page changes in a way that matters, the date above changes, and people with an account are told before it takes effect.

Privacy·Terms