DRAFT. The owner must review this before launch.
| Component | What it receives | What it keeps | How long |
|---|---|---|---|
| Open Court API (VPS or Fly.io machine) | Queries and drafts, in memory | Nothing (route, status, latency and daily per-key totals only; no query or draft text, no list of documents read) | Usage totals 180 days; billing events as long as billing requires |
| Supabase (Postgres, Singapore) | Queries as bound parameters while a statement runs | Nothing in tables. Postgres logs: see the database privacy check | Supabase log retention for the plan |
| Embedding model | Queries, in the API process (local model) | Nothing | — |
| Live providers (government APIs) | The query text, **only** with `include_live=true`, never for zero-retention accounts | Their own policies | Their own policies |
| Cloudflare R2 | Corpus documents (blob storage) | Corpus documents | Indefinite. Never queries |
| Stripe | Email, customer id, monthly call counts | As Stripe's policy | As Stripe's policy |
| Caddy (reverse proxy, VPS only) | Requests | Nothing (access logs discarded) | — |
| Fly.io edge proxy (Fly.io hosting only) | Requests, decrypted at the edge (TLS terminates there) | Open Court enables no request logging; anything Fly.io records itself is governed by its own policy | Fly.io's policy |
On a VPS, Open Court is not placed behind a third-party proxy or CDN. On Fly.io (the planned host), Fly.io's edge proxy is in the request path: it terminates TLS and forwards each request to the application. Open Court's own configuration logs no request bodies (the application access log is off), and queries travel in POST bodies, never in URLs. If the hosting changes, this statement changes first. <!-- owner: confirm the host, and read Fly.io's privacy terms on request logging, before launch -->