Security and data handling
Last updated: October 2026
What we access
The bot reads new messages only in public channels it has been invited to. It never reads private channels or direct messages. The full list of Slack permissions, and why each is needed, is on the support page.
What we store
- The text of messages detected as quotes, who posted them, and the channel. Messages that are not quotes are not stored.
- Generated images and the prompts used to make them.
- Workspace metadata (name, icon, connected channels, settings) and billing status.
- Slack bot tokens, encrypted at rest with AES-256-GCM, kept only while the app is installed.
Where it lives and who can see it
The app runs on Cloudflare Workers. Data is stored in Cloudflare D1 and images in a private Cloudflare R2 bucket. Images are served only to signed-in members of the workspace that created them. There is no public gallery and we do not post workspace content to social media.
AI processing
Quote text is sent to OpenAI or Anthropic to detect quotes and write image prompts, and to OpenAI or Google to generate images. These providers process it per request under their API terms. We do not use your data to train models. AI output can be unexpected or inaccurate; every prompt is filtered for workplace safety and channels can require manual approval before anything is generated. The full list is on the sub-processors page.
Retention and deletion
Uninstalling the app revokes the bot token immediately. Quotes, images and workspace settings are kept so a reinstall picks up where you left off, until you ask us to delete them. Deletion requests are completed within 30 days and confirmed by email. Individual images can be deleted from the dashboard at any time.
Payments
Stripe processes all payments. We never see or store card numbers.
Reporting a problem
If you think you've found a security issue, please contact us with the details. We reply within 2 business days.