Privacy Policy

Template notice: replace company names, contact details, retention periods, subprocessors, and jurisdiction-specific terms before launch. This text is not legal advice.

Information you provide

We process account information such as your name, email address, authentication credentials, profile image, support messages, files you upload, API-key metadata, and billing identifiers. Raw API keys are shown once and are not stored; the application stores a cryptographic hash and readable prefix.

Information generated through use

The service may record session metadata, product activity, billing events, webhook identifiers, file metadata, waitlist position, referral information, and technical logs needed to secure and operate the service.

Infrastructure and subprocessors

Depending on configuration, data may be processed by:

• Cloudflare for Workers, D1, R2, KV, Email, and Workers AI;
• Stripe, Creem, or Waffo for payments;
• Resend, Cloudflare Email, or AWS SES for transactional email;
• Resend or Beehiiv for newsletters;
• configured analytics, chat, notification, and AI providers.

Only providers enabled by the operator receive the data required for that workflow.

Purpose and legal basis

We use data to provide and secure accounts, process purchases, deliver files and API access, respond to support, communicate service updates, prevent abuse, comply with law, and improve the product. Operators should document the legal bases that apply in their jurisdictions.

Retention and deletion

Account data is retained while an account is active and for the period required for security, tax, dispute, and legal obligations. Account deletion removes application database records through relational cascades and deletes owned R2 objects through the account-deletion workflow. Independent providers may retain records under their own legal obligations.

Your choices

You may update your profile, change email and password, revoke sessions, revoke API keys, manage billing through the selected provider, unsubscribe from newsletters, and request account deletion from the product settings.

Contact

Publish a valid privacy contact before launch and describe the process for access, correction, portability, objection, and deletion requests.