Privacy Policy

Only what we need to run the service: your email address, an encrypted hash of your password (handled by Supabase Auth), the OpenAI / Anthropic API keys you add (encrypted at rest with AES-256-CBC), and basic logs of cron-triggered usage polls so we can debug failed alerts.

We do not embed third-party analytics, ad pixels, fingerprinting libraries, session-replay tools, or marketing tracking SDKs.

We set exactly one category of cookie: a secure HTTP-only Supabase session cookie that keeps you signed in. It is first-party, expires when your session expires, and contains no advertising or tracking identifiers.

Provider API keys (OpenAI, Anthropic) are encrypted with AES-256-CBC before they are written to the database, using a server-side encryption key that never leaves our deployment. We decrypt them only inside the hourly usage-monitoring cron job, then immediately discard the plaintext.

We never log, expose, or transmit your provider keys to any third party other than the provider they belong to (OpenAI or Anthropic, when polling usage).

Your app-level API key is HMAC-signed using a server-side secret. The key encodes your account ID and a revocation version. You can rotate it at any time from the dashboard — the previous key becomes invalid immediately. We never log raw API keys submitted to the /api/verify endpoint.

Subscription billing is processed by Stripe. Card numbers, CVCs, and billing addresses are entered directly on Stripe-hosted checkout pages and never touch our servers. We receive only an opaque customer ID and a subscription status from Stripe webhooks.

You can delete any individual key, alert, or your entire account at any time. Account deletion removes your user record, all stored credentials, and all alert configurations within 30 days. Stripe retains payment records per their own retention policy and applicable financial regulations.

Have questions about our privacy practices?