Privacy

What is stored

Only what an account needs to work:

• Your email address. Lowercased, and used as the identity that different sign-in methods attach to.
• Your name and avatar, if a provider you connect gives them.
• OAuth links. Which providers you connected and the account id each one gave us, so signing in again finds the same vault.
• A password hash, if you set a password. Never the password: it is put through scrypt with a per-account salt and cannot be read back out.
• The components you save, and any files that belong to them.
• Timestamps: when the account was made and when it was last used.

What is deliberately not stored

• Raw IP addresses. Rate limiting needs to recognise a repeat caller, not know where they live, so addresses are salted and hashed before being written. The hashes are pruned after 24 hours.
• Analytics, tracking pixels, advertising identifiers, and third-party scripts. There are none. Pages load nothing from a domain other than this one.
• Password reset and confirmation links. Only a hash of each is kept, and it is deleted the moment the link is used.

Who else sees it

Running this service needs a small number of processors. Each sees only what its job requires:

• Neon: the database. Accounts and metadata.
• Cloudflare R2: file storage. The private bucket has no public access; files are served through short-lived signed URLs that expire after an hour.
• Resend: outbound email. Sees the address a message is going to and its contents.
• Vercel: hosting. Sees requests as they are served.
• GitHub and Google: only if you choose to sign in with them, and only to confirm who you are.

Nothing is sold, and nothing is shared for advertising. Data is disclosed otherwise only where the law requires it.

Who can see your vault

Your vault is private by default. There is no public profile, no directory and no discovery: another account cannot browse to it, search it, or find out it exists.

Administrators cannot read your vault. That is a deliberate limit, not an omission. An administrator can suspend an account and can disable a specific item when a valid complaint names it, but there is no path in the software that renders someone else's content to them.

The one way anything leaves is a share link you create yourself. Those expire, are read-only, and can be revoked. The Terms explain how long revoking takes.

Keeping and deleting

• Account data is kept for as long as the account exists.
• You can delete your account yourself, at any time, from /account. It is immediate and there is no grace period.
• Deleting removes your account row, the OAuth links attached to it, your outstanding sign-in and reset links, your hashed rate-limit records, and your waitlist entry if you had one. Losing the waitlist entry means losing your approval, so coming back means asking again.
• Share links you issued are revoked rather than deleted, and stop working. The record that they existed is kept, because a share link is valid by its signature: forgetting one would bring it back to life rather than kill it.
• Hashed rate-limit records are pruned after 24 hours.
• Backups may take up to 30 days to age out.

Your rights

You can download everything we hold about you as a JSON file from /account, without asking anyone. It does not include the collection itself: the items in the vault belong to the operator and none of them is yours to take.

You can also ask for a correction, or for deletion, by writing to the address below; expect a reply within 30 days. Depending on where you live you may also have the right to complain to a data protection regulator.

Contact

Clupai, Samridh Limbu
70 Elgar Road, Burwood, Victoria 3125, Australia
privacy@clupai.com

Australian privacy law applies to this service. If you are not satisfied with a response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.