Slides.win plugin privacy
Effective 3 October 2026. This page describes the Slides.win ChatGPT and Codex integration.
Data used for your request
Slides.win receives the connected account identity, granted permissions and tool inputs needed to read or modify your products, campaign copy, original images, saved revisions, generation requests and exports. OAuth credentials are handled by the host and server, not collected in chat. The account profile tool returns an opaque account ID without a name or email address.
The studio shares selected campaign and slide identifiers, revision, language, format and copy with the conversation through the host's model context. Unsaved-copy status is also disclosed. Use Clear shared selection to remove this studio's attachment. Messages and results already in the conversation follow the host's retention controls.
Storage and providers
Account records and images are stored in Cloudflare D1 and R2. Rendering and durable work run on Cloudflare. Generation sends the explicit prompt, relevant product context and selected image references to the configured AI provider, which may be OpenAI or Cloudflare Workers AI. Saved generation receipts record submitted settings and reference checksums. Reading campaigns and exact-wording edits do not require a generation provider call.
Account controls
Every request enforces account ownership and permission. OAuth access expires after one hour; rotating refresh grants expire after thirty days. Revoke a connection in Slides.win MCP settings to stop future access. Download links expire after two minutes and also stop working when that connection is revoked or the campaign changes.
Campaigns, originals and exports persist in the account for later work. Disconnecting a plugin does not erase those records or conversation history. Contact Slides.win support for data-access or deletion requests; this plugin does not provide automated account erasure.
Operational records
The existing service records account-scoped generation and export receipts, usage, errors and campaign activity needed for accounting and recovery. Infrastructure request logs can contain timestamps and request metadata. Private download URLs are bearer capabilities and should not be shared. This integration does not add third-party advertising pixels or claim conversion measurements.