Privacy Policy
This policy explains what we collect, why, and the choices you have. We keep it short on purpose: we collect only what the service needs to work.
1. Data we collect
- Account data: your email address, your chosen sign-in method, and your workspace membership role. You sign in with a password you set (held only as a scrypt hash with a random per-account salt), with Google or GitHub, or with a six-digit code we email you to confirm a new address or reset a password.
- Plan content: the implementation plans you submit, the reviewer feedback and readiness results the models produce, and the resulting reports — stored in your workspace.
- Provider configuration: if you bring your own model API keys, those keys are stored encrypted at rest (AES-256-GCM) and are never shown back to you in full after you save them.
- Billing data: your plan, wallet balance, and purchase history. Payment card details are collected by Paddle (our payment processor), not by us; we never see or store your card number.
- Usage logs: minimal server logs (IP address, request path, timestamps) used for security and abuse prevention.
2. How we use it
To operate the service: sign you in, run the review on your plans, store and show your reports, enforce your plan and wallet, and support you. We do not sell your data and do not use it for advertising.
3. Plans are never used by us for AI training
We never use your plans, reviewer feedback, or reports to train AI models, and we do not sell them or use them for advertising. Plan text is sent to model providers only to produce the review you asked for. Our own commitment ends at the providers we choose for you. Providers you connect with your own keys are governed by their terms and your account settings, not by us.
- Managed mixes. Requests routed through OpenRouter are sent with
data_collection: "deny", so only upstream providers that do not collect your data are selected; if none is available for a chosen model the run fails rather than proceeding anyway. Direct calls to OpenAI, Anthropic, Google, and DeepSeek use operator accounts configured for no training and minimal retention. - Your own keys. Plan text goes from our servers to your provider using your key. That provider's terms and your account settings govern retention and training — we cannot override them, so check them if this matters to you. This is the one place where we cannot make a promise on your behalf, and our Terms say the same thing.
We cannot make a universal promise on behalf of every provider. What we can state precisely is the setting we enforce on each request and the account configuration we control, which is what the two points above describe.
4. Third-party subprocessors
- Paddle — payment processing and merchant of record (tax/invoicing).
- Resend — sends your sign-in and notification emails.
- Hetzner — hosts our servers (EU data centers).
- Model providers — when you run a session, the models you select (e.g. OpenAI, Anthropic, Google, DeepSeek, OpenRouter, and others) receive the plan text needed to produce reviewer feedback and readiness results.
These providers process data only as needed to provide their part of the service.
5. Retention
Your plan reports and run history are stored in your workspace and listed according to your plan's history window (7 days on Free until you add funds, 90 days after a top-up and on Team). That window controls what the app lists; it does not delete anything.
A workspace owner can delete the workspace and everything in it at any time. A member can leave instead: their access ends immediately and the workspace stays with its owner. Deleting a workspace removes its plans, reports, runs and evidence entries from the live service.
One limit worth stating plainly: backups are kept for up to 14 days, and deleting a workspace does not rewrite archives that already exist. A deleted workspace can therefore remain inside a backup archive until that archive ages out. The backup script encrypts each archive with an age key when one is configured for the deployment, and otherwise writes a permission-restricted file whose protection depends on the host's disk and off-site storage. Each archive contains the whole workspace — plans, reports, run logs, auth records and the billing ledger — and is stored on the server, and off-site when an off-site copy is configured.
6. Cookies & local storage
We use one essential cookie: a signed, HttpOnly session cookie that keeps you signed in for 30 days. The marketing site stores your chosen color theme in your browser's local storage. Cloudflare Web Analytics (a privacy-oriented visitor count, not advertising) may load on these pages. We use no advertising cookies.
7. Your rights
- Access and export: your plans and reports are available in the app; you can copy or download them at any time.
- Deletion: you may delete your account and workspace from within the app, which removes your plan content, reports, configuration, and billing records. Email [email protected] to request deletion or to exercise any other data right.
- Correction: you can update your provider configuration and workspace settings at any time.
8. Security
We store data with restrictive file permissions, encrypt provider API keys at rest, and require authentication for your workspace. No security is perfect; please report issues to [email protected].
9. Changes
We may update this policy. Material changes will be posted on this page with a new date. Continued use after a change means you accept it.
10. Contact
Privacy questions or requests: [email protected].