Plain terms, not boilerplate. This covers Sagent specifically. Signing in doesn’t share your data with any other [sage] app, even though they share the same login system.
What Sagent Collects
Your Google account. Signing in with Google gives Sagent your name, email, and profile photo, via Supabase Auth. It’s the same OAuth flow any “Sign in with Google” button uses.
The research you connect. When you pick a Google Drive folder or upload files directly, Sagent reads their contents to run the pipeline. Drive sign-in requests read access to your whole Drive. That’s a Google API constraint, not a choice to read more than the one folder you pick (see the note on scope below). Sagent only ever fetches the folder you actually select.
What the pipeline produces. Extracted requirements, the generated PRD, every version and diff, and the evaluation/roadmap-signal output. All of it is stored in Sagent’s database, scoped to your account.
Run history. Sagent tracks how many pipeline runs your account has made and when, to enforce the run cap and rate limits that keep the app from being abused. See “Why a run cap?” below.
How It’s Used
Your research and account data are used for exactly one thing: turning your documents into a PRD you can read, edit, and export. Nothing is sold, used for advertising, or shared with anyone besides the third-party services below that the app is technically built on.
Two services see your content as part of running the app: Anthropic’s Claude API processes your research text to extract requirements and draft the PRD, and Supabase stores your account data, files, and PRD content. Neither is used for anything beyond serving your request.
Sagent’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage & Security
Every table in Sagent’s database enforces row-level security scoped to your account. One user’s projects, files, and PRD content are never visible to another user’s queries, enforced by the database itself, not just application code. Uploaded files live in a private storage bucket, path-namespaced per user and project.
The Google refresh token that lets Sagent access your Drive without asking you to sign in every time is encrypted at rest (Supabase Vault) and readable only by server-side code. It’s never sent to your browser.
Errors & Analytics
When something breaks, Sagent sends an error report to Sentry so it can get fixed. That report carries the error message, the stack trace, your browser and operating system, and which page you were on.
What’s deliberately kept out. Your IP address, your session cookie, your Google tokens, anything you typed or clicked, and the body of any request you made. Email addresses and anything token-shaped are stripped by pattern before a report is sent. There’s no screen recording.
Your documents and PRDs are not sent to Sentry, and that one took real care. Sagent’s Langfuse tracing records what goes into and comes out of the model, which is the whole point of it. That same data would have flowed into Sentry if performance tracing were left switched on, so it’s switched off entirely. Error reporting doesn’t need it.
One exception to that list, worth saying plainly. Sentry works out a rough location from your connection, city and country only, and keeps it. The address it worked that out from isn’t stored. The location is.
Honestly: an error message is written by code, not curated by a person. Known sensitive shapes get stripped and every message is truncated before sending, but a stray fragment of text in some unusual failure isn’t something I can rule out.
Page views and load times go to Vercel Analytics and Vercel Speed Insights, which is how I know whether anyone actually uses this and whether it’s slow. No cookie, no cross-site tracking. Both they and Sentry age this data out on their own retention schedules, and I don’t extend them.
Retention & Deletion
Deleting a project removes its uploaded files, PRD versions, and research metadata right away. There’s no soft delete, no 30-day grace period.
Honestly: signing out ends your session but doesn’t revoke Sagent’s Drive access on its own. There’s no self-service “disconnect Google Drive” button yet. That’s a real gap, not glossed over. If you want your Google refresh token and account data fully removed, reach out (see below) and it’ll be deleted by hand. You can also revoke Sagent’s access directly from your own Google Account permissions at any time, independent of anything Sagent does.
Why A Run Cap?
Sagent is sign-in-gated to an approved list of Google accounts, with a lifetime run cap and rate limits per account. It sits in front of a paid AI API key, and those limits exist to keep that from being misused, not to limit real usage.
Because Sagent requests Google Drive access, Google caps it at 100 total users across its lifetime while it’s in this unverified state, and Google expires the underlying permission roughly every 7 days, occasionally requiring you to sign in again. Ordinary Google account limits, not anything specific to how Sagent is built.
Reach out on LinkedIn. This is a one-person project, and I’ll handle it directly.
Connect on LinkedInLast updated: July 12, 2026