Privacy Policy

Account data. Your email address, the account name you choose, and timestamps for account creation and sign-in. There is no password, because sign-in uses a one-time emailed link.

Usage metadata. For each unit of AI usage you send or we sync on your behalf: the model identifier, token counts (input, cached input, output, and reasoning tokens where reported), a region code, a service tier, a label for which connection it came from, and a timestamp. If you choose to send an opaque pseudonymous end-user identifier, we store that string as given.

Provider credentials. If you connect a provider account, we store the credential you supply encrypted with AES-256-GCM under a key held only in the application environment. The database never holds it in plaintext.

Operational records. Estimates derived from your usage, and for paid accounts the retirement, invoice, and certificate records the service produces.

Prompts, completions, system instructions, embeddings, file contents, or any other content of your AI usage. This is enforced in code, not by policy: every ingest payload is scanned before parsing, and any content-shaped field anywhere in it causes the whole request to be rejected with an error and nothing stored. The database has no column that could hold such content, and a test asserts that it never gains one.

We do not collect payment card details. When paid plans open, card handling occurs entirely within Stripe and we hold only Stripe's tokenized references.

To provide the service you asked for: authenticating you, estimating the footprint of the usage you send, showing it in the console, and for paid accounts acquiring and retiring environmental certificates and producing the certificate record. We also send transactional email: sign-in links, a welcome message, and a notice when a free account reaches its monthly estimation limit.

Where the GDPR applies, the lawful basis is performance of a contract with you for the service itself, and our legitimate interest in securing the service and preventing abuse for the rate limiting described below. We do not rely on consent for any processing described here, and we do not send marketing email.

You can delete your account at any time from the console. Deletion is immediate and irreversible: your account, usage metadata, estimates, stored credentials, API keys, sessions, and your user record are removed in a single transaction. There is no grace period and no recovery, so export anything you want to keep first.

If you start a signup and never complete it, that pending record is removed after 30 days.

While your account exists, we keep your usage metadata and estimates for as long as the account does, because the value of the record is its history. Records that document a completed environmental certificate retirement are kept after deletion where we are required to retain them, because a retirement is an external event in a third-party registry that we cannot unmake; those retained records identify the retirement, not you.

Encrypted database backups may retain deleted data for up to 30 days before they age out.

Our infrastructure providers process data on our behalf: Vercel (hosting), Supabase (database, hosted in the United States), and Resend (transactional email). When paid plans open, Stripe processes payments. Where you connect a provider account, we call that provider's usage API with the credential you supplied.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we run no advertising or analytics trackers on the console.

You can access and export your data from the console, correct your account details, and delete everything as described above. Depending on where you live you may also have rights to portability, restriction, or objection, and to complain to a supervisory authority. Write to info@r3ckon.com and we will respond within 30 days. We will not discriminate against you for exercising any of these rights.

Sign-in links and session tokens are stored only as SHA-256 hashes, so a database disclosure does not yield working credentials. Links are single-use and expire in fifteen minutes. Sessions are held server-side and can be revoked. Provider credentials are encrypted as described above. Database access is restricted to a dedicated role with row-level security enabled on every table. Authentication and ingest endpoints are rate limited.

No system is perfectly secure. If you believe you have found a vulnerability, please write to info@r3ckon.com.

The service is for organizations and adults. It is not directed to children under 16.

If this policy changes materially we will notify account holders by email before the change takes effect. The effective date above always reflects the current version.