# Privacy Policy — DRAFT

> **DRAFT — not yet reviewed by counsel.** Placeholders in `[brackets]` must be
> filled in and the whole text reviewed by a lawyer before public launch.

**Controller:** `[Inviscid AI, legal entity + address]`, for the foamd service at
`[api.tryreynolds.com]`. Contact: `[privacy@tryreynolds.com]`.

## What we collect

- **Account:** your email address (sign-in is by magic link; we never see a
  password), the time you accepted the terms, and any invite code you used.
- **API keys:** a hash and a short prefix of each key, its name, and when it was
  last used. We never store the key itself after showing it to you once.
- **Usage ledger:** for every authenticated API call — who (user and key), what
  (method, path, the instance/job/study it touched), when, the response status,
  and the caller's IP address.
- **Metering:** when each compute instance started and stopped and its size.
- **Your content:** the files on your instances and whatever you put in the
  capture plane (studies, messages, results, artifacts). If you log your own
  model prompts and responses there, we store them for you as-is.

We do not run analytics or advertising trackers on the dashboard, and the
dashboard loads nothing from third-party CDNs.

## Why

To run the service, keep it secure, attribute usage to accounts, enforce
budgets and limits, investigate abuse, and — if you ask — support you. Legal
basis: performance of our contract with you and our legitimate interest in
operating a safe service.

## Who else sees it

- **Modal** (compute and volumes) and **Supabase** (database, auth, file storage)
  process data on our behalf. Both are in `[region]`.
- Optionally an error-reporting service (`[Sentry]`) receives stack traces
  without personal data.
- No one else, unless the law requires it.

## Retention

- IP addresses in the usage ledger are removed after **90 days**; the rest of
  the ledger row is kept for the life of the account.
- Instance data lives until you delete the instance.
- Deleting your account (`DELETE /v1/account`, or ask us) stops any running
  compute, destroys every instance's data, removes your uploaded artifacts,
  revokes your keys, and deletes your sign-in identity. Database rows tied to
  the account go with it. Backups held by our providers expire within
  `[30]` days.

## Your rights

Depending on where you live you may have rights to access, correct, export, or
erase your data, or to object to processing. Email `[privacy@tryreynolds.com]`;
we answer within `[30]` days. You can export your instance data yourself at any
time with the tar endpoint, and delete it yourself with the delete endpoints.

## Changes

We will post changes here and email you about material ones.

_Last updated: 2026-08-27 (draft)._