Privacy Policy

DRAFT. The owner must complete and review this before launch.

1. Information We Collect

• Account email address.
• Stripe customer identifiers and subscription status.
• Per-call request metadata: route template, HTTP response status, latency in milliseconds, and timestamp.
• Per-key daily totals used to protect the service (calls; calls per endpoint; an estimate of distinct documents returned, kept as a one-way keyed summary that cannot list the documents; characters of text returned; timing statistics).
• Records of requests that name a canary record (which canary, which key, which endpoint, when).
• If an account is flagged for review, we keep more detailed daily totals for it for 30 days, for example how many newly added documents it retrieved, how its calls are timed, and which error codes it received. These are still totals: never queries, drafts or a list of documents.

2. Information We Never Store or Log

• Query text, verify draft texts, request bodies, and query strings are never stored, logged, or retained.
• IP addresses are not logged (access logs for reverse proxy and web server are disabled).
• The list of documents a customer read is never stored or logged.

3. Third-Party Services

• If Open Court runs on Fly.io, Fly.io is the hosting provider. Its edge proxy terminates TLS before requests reach the application, so requests pass through Fly.io's infrastructure decrypted. Open Court's own configuration logs no request bodies (queries and drafts); what Fly.io records is governed by its own policy. <!-- owner: confirm the host, and read Fly.io's privacy terms on request logging, before launch -->
• Live search queries are sent to foreign third-party government APIs only with `include_live=true`, and never for accounts with zero data retention enabled.
• Payments and card details are handled directly by Stripe. Open Court never sees or stores payment card information.
• Supabase (Postgres, Singapore) stores metadata and relational data; statements do not retain query text in tables.
• Cloudflare R2 stores corpus documents in blob storage. It never receives queries.

4. Retention

• Usage totals: 180 days.
• Canary hits: 2 years.
• Abuse flags and decisions: for as long as the account exists plus 2 years.

For full architectural details, see our [Data Flow Statement](/legal/data-flow).

← Back to Home