Effective as of October 15, 2026.
InFlight Software, Inc. ("Inflight," "we", "us" or "our") provides software for designers, product teams and the AI coding agents they work with to share work, get feedback, and align with teammates. This Privacy Policy describes how Inflight processes personal information that we collect through our digital or online properties or services that link to this Privacy Policy, including our website at inflight.co, pages we host at inflight.page, the Inflight feedback widget that customers embed in their own pages, our Chrome browser extension, our Inflight app for ChatGPT, our MCP server for AI coding agents, our social media pages, and our marketing activities (collectively, the "Service").
Our websites, products, and services are designed for business customers and their representatives. We do not offer products or services for use by individuals for their personal, family, or household purposes. Accordingly, we treat all personal information we collect as pertaining to individuals in their capacities as representatives of the relevant business and not their individual capacities.
Personal information you may provide to us through the Service or otherwise includes:
We and our service providers automatically log information about your device and your interaction with the Service, such as:
We do not use pixel tags in our emails, and we do not collect advertising identifiers. See Tracking and other technologies for details.
When a customer adds the Inflight widget to a preview build, or shares an HTML page that we host at inflight.page, people who open that page can leave feedback through the widget. You can review as an anonymous reviewer under a display name you choose, or sign in to your Inflight account. We do not ask anonymous reviewers for an email address.
When you leave a comment, we store the comment text, any attachments and recordings you add, your display name or account, and the time. When you pin a comment to an element on the page, we also store what locates and describes that element: its position and selector, up to 2,000 characters of its text and HTML markup, its styles, attributes, and nearby elements, a cropped image of the element as you saw it, the full URL of the page, your viewport size and device pixel ratio, and your browser user agent. We store this so that the author, their teammates, and their AI coding agent can see exactly what you were pointing at. Captured markup, attributes, and images may include form values or other information shown in the pinned element. The widget does not passively record your session or log keystrokes. Recordings you choose to start are described below.
We also record who viewed a shared version and when, including anonymous viewers, so that authors can see that their work has been seen. The widget stores your sign-in token, member id, chosen display name, and draft comments in your browser's local storage on the customer's page so that you stay signed in across visits.
Feedback is visible to the members of the customer's workspace and to anyone else who holds the link to that page, and it is sent to the AI coding agent that the author connects to Inflight (see AI coding agents). Customers decide who they share preview links with and are responsible for telling reviewers that feedback left on their pages is shared in this way.
The Service includes a Chrome browser extension that records a narrated walkthrough of a browser tab you choose, and the widget and web app can record your screen in the same way. When you start a recording, and only then, we collect: video and audio of that tab or screen; audio from your microphone; your camera, if you turn on the camera bubble; the page paths and titles of pages you visit in that tab while recording; and details of the page elements you point at, click, or select (their text, attributes, styles, size, and position in the page), together with your cursor, scroll, and text-selection activity during the recording. This recording capture runs only between pressing record and stopping, and covers the tab or screen you choose. Video includes visible content, which may include form values and text you type. We do not log keystrokes. The extension does not read your browsing history or record other tabs.
Recordings are uploaded to your Inflight account and processed to produce a transcript, a summary, chapters, and still frames so that you and the people or tools you share the recording with can read it. We use Groq to transcribe the audio and to generate the title, summary, and chapters from the transcript, and Anthropic (with OpenAI as a fallback) to generate suggested edits from the transcript. The original uploaded video is deleted once it has been converted. A recording can be opened by anyone who has its link.
The extension stores your sign-in token, your microphone choice, and links to your recent recordings on your device. It does not use analytics, advertising, or tracking technologies. If the extension fails, it sends an error report to Sentry, our error monitoring provider, containing the error, the extension's own activity log (which can include the origin and path of the page being recorded, with URL query strings and fragments removed), the extension and browser versions, and your account id and email address, so that we can find and fix the failure. No report is sent for a successful recording.
Our use of information received through Chrome browser APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
You can connect an AI coding agent or assistant (such as ChatGPT through the Inflight app for ChatGPT, Claude Code, Codex, or Cursor) to your Inflight account. Agents connect to our MCP (Model Context Protocol) server at mcp.inflight.co. The connection is authorized by you on a consent page on inflight.co; we then issue the agent a token that acts as you, with the same permissions you have in each of your workspaces. The token lasts 90 days, is renewed while it is in use, and can be revoked by you at any time (see Your choices and controls). We do not issue refresh tokens, and we never share your password with an agent.
An agent calls our tools on your behalf, in response to your requests in the agent. The information an agent may send us is what those tools take:
Tool results are returned to the agent and become part of your conversation with it. They can include:
We return only what is needed for the request. Storage locations and internal diagnostic details are not included in tool results.
In ChatGPT, some tool results also render an Inflight card. The card runs inside ChatGPT, loads images and video of your shared work from our servers, refreshes itself by calling our server, and can open the shared page from inflight.co in a full-screen frame. To do this, the card holds a short-lived (12-hour) viewing token that ChatGPT stores with the card's state. The card never shows the viewing token to the model. When you use a "Fix this" control on the card, the reviewer's comment is placed into your conversation as a message from you.
Your conversation with ChatGPT, and everything the model sends to and receives from our tools, is also processed by OpenAI under OpenAI's own terms and privacy policy. The same is true of any other agent you connect: the agent's provider processes the tool inputs and outputs under its own policies, and we do not control how it stores your conversation.
For each tool call we log the name of the tool, the name of the agent client (for example "ChatGPT"), whether the call succeeded, your user id, and the workspace involved, so that we can operate and improve the integration. We do not log the contents of tool inputs or outputs in our analytics. If a tool fails unexpectedly, the error is reported to Sentry with personal data and authorization headers removed. Work and feedback that an agent creates through our tools is stored like work and feedback you create in the web app and is covered by the rest of this Policy.
Some features of the Service are generated by AI models run by third-party providers. We send each provider only the content the feature needs, and our agreements with them provide that they do not use your content to train their models.
We use first-party cookies and browser local storage to keep you signed in, remember your preferences, and protect password-locked pages. They include:
inflight_browser_session cookie (90 days) that keeps you signed in to the widget on hosted pages.inflight_member (signals that you have an account; grants nothing), inflight_handed_off (1 day) and inflight_sso (60 seconds), which carry you from inflight.co to a hosted page, and inflight_claim for claiming a portfolio review.inflight_page_pass (7 days), set when you unlock a password-protected page.We use PostHog to understand how the Service is used. On inflight.co, PostHog records page views and clicks, the events listed under automatic data collection above, and, once you sign in, your user id, email address, name, username, sign-up date, and the workspace you are in. Analytics requests are sent through our own domain and stored by PostHog in the United States. Access tokens are removed from URLs before they are sent. We do not record your sessions for replay.
The widget on customers' pages uses a separate, minimal PostHog configuration: it records only the events the widget itself raises (for example that it loaded, or that a comment was posted), with the page hostname and a reviewer id. Anonymous reviewers are identified by an anonymous id, without creating a person profile. For signed-in members, events include their account id and workspace and are associated with the same analytics profile used on inflight.co. The widget does not automatically capture page views or clicks, record sessions for replay, or capture anything typed for analytics. Its analytics state is kept in memory, without analytics cookies or local-storage persistence on the customer's page.
We use Sentry to collect error reports from the web app, widget, browser extension, and our servers. Reports from the web app include your user id, email address, and name, the page you were on, your browser, and your IP address; reports from the widget include your user id, the page URL, and your browser; reports from our servers have personal data and credentials removed. Our hosting provider Cloudflare keeps request logs, and we send security events (a hashed IP address, user agent, country, network, and request path, and sign-in events with your user id) to Axiom to detect abuse.
Marketing pages on inflight.co load fonts from Google Fonts and, on pages with a booking button, the Cal.com scheduling embed; your browser contacts those services directly. We do not use advertising pixels, retargeting, or interest-based advertising, and we do not use Google Analytics.
We use your personal information for the following purposes:
We analyze usage of the Service, including which features are used and how people move through it, to improve the Service, fix errors, and develop new features, using the analytics and error monitoring described above.
We may send you emails about Inflight's features and news. You can opt out as described in Your choices and controls. We do not sell your personal information and we do not use it for interest-based advertising.
We may create aggregated or de-identified data from personal information by removing information that makes the data identifiable to you, and use and share that data for our lawful business purposes, including to analyze and improve the Service and promote our business.
We share your personal information with the following categories of recipients:
We keep personal information for as long as needed for the purposes described above, and then delete or de-identify it. In particular:
You can review and update your profile and workspace settings by signing in to your account. Contact us to request a copy of the personal information we hold about you.
You can delete your comments, pins, recordings, projects, versions, and pages in the Service, and workspace admins can delete a workspace from its settings. To delete your account and the personal information tied to it, open Settings → Profile → Delete account. This removes your profile, sign-in, connected agents, and integrations; comments and versions you shared in a workspace other people still use stay there, attributed to “Deleted user”. A workspace in which you were the only member is deleted with your account and its subscription canceled. You can also email us at team@inflight.co from the address on your account. Anonymous reviewers can ask us to delete their feedback by contacting us with the page link and their display name.
The Connector page in your workspace settings lists every AI agent connected to your account, with the client name and when it was last used, and lets you revoke each one. Revoking a token stops that agent immediately. You can also remove the Inflight app from ChatGPT in ChatGPT's settings. The browser extension can be signed out from its own menu or uninstalled. Slack, GitHub, and GitLab connections can be removed from your workspace settings or from the provider's side.
You may opt out of marketing emails by following the unsubscribe instructions in the email or by contacting us. You will continue to receive service-related emails such as invitations, security notices, and billing messages. Review-activity notification emails can be adjusted in your account settings.
Browser settings and content blockers can block our analytics without affecting the Service. You can also ask us to exclude your account from analytics. Most browsers let you remove or reject cookies; if you block the cookies listed above, sign-in and password-protected pages may not work. We do not respond to "Do Not Track" signals.
If you sign in with Google or connect a third-party service, you can use your settings on that platform to limit the information we receive from it. Revoking our access there does not remove information we have already received, which you can ask us to delete.
We need certain personal information to provide the Service. If you do not provide information we identify as required, we may not be able to provide those services.
The Service may contain links to websites and online services operated by third parties, and our widget and card are embedded in pages and applications that are not ours. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, applications, or online services operated by third parties, including the preview builds that customers share through Inflight, and we are not responsible for their actions. We encourage you to read the privacy policies of the other services you use.
We use technical and organizational safeguards designed to protect your personal information, including encryption in transit, encrypted storage of connected-service tokens, time-limited and revocable agent tokens, and isolation of hosted pages on their own origin. Security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.
We are headquartered in the United States, and our service providers store and process data in the United States. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.
The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child's parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.
We reserve the right to modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date of this Privacy Policy and posting it on the Service or by other appropriate means. Any modifications will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). Your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledgment that the modified Privacy Policy applies to your interactions with the Service and our business.
Inflight uses the following third-party sub-processors to provide the Service. These companies process customer data on our behalf under their own privacy and security standards.
| Company | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | United States |
| Railway | Hosting for our API, MCP server, media processing, and cache | United States |
| Cloudflare | Hosting for inflight.co and inflight.page, request logs, page thumbnails | United States |
| Trigger.dev | Background job processing | United States |
| Resend | Transactional email delivery | United States |
| PostHog | Product analytics | United States |
| Sentry | Error monitoring | United States |
| Axiom | Security event logs | United States |
| Anthropic | AI-generated content (overviews, pin labels, questions, widget detection, suggested edits) | United States |
| OpenAI | AI-generated content (next steps, emoji and icon search, fallback for the above) | United States |
| Groq | Transcription, recording titles, summaries, and chapters | United States |
| ElevenLabs | Voice narration for AI-generated walkthroughs | United States |
| Stripe | Payment processing and subscription billing | United States |
Slack, GitHub, GitLab, Google, and OpenAI (as the provider of ChatGPT) are not sub-processors: they are services you choose to connect, and they handle your data under their own terms. We will update this list as sub-processors change. If you have questions, contact us at team@inflight.co.
Email: team@inflight.co