Legal

Privacy Policy

DRAFT v0.2 · 2026-07-25 · takes effect at public launch · under legal review — changes will be public

What we collect

  • Account data: your email address, plan, and credit ledger.
  • Usage records: endpoint, credits, timestamps, and a salted hash of your IP (we can rate-limit an address without storing it).
  • Waitlist: email and the source tag of the link you used.
  • Queried identifiers: processed to answer the query; bulk-job inputs and results are retained so you can download them, and deleted on request.

What we don't do

  • No sale or sharing of your data or your queries — to anyone, for anything.
  • No building of marketable datasets from customer queries.
  • One analytics tool, disclosed (added 2026-07-25): the marketing site at boundstone.io uses Google Analytics 4 to measure which pages and channels are useful. It sets Google cookies and shares usage data with Google. The dashboard and the API load no analytics at all, no other trackers exist anywhere, and fonts are self-hosted everywhere.

Where it lives

Infrastructure runs on Cloudflare's global network — requests are processed at the edge near you, wherever you are, and primary data stores run on Cloudflare D1 (Asia-Pacific primary region). Transactional email (sign-in links, account notices) is delivered via Emailit. Marketing-site analytics is Google Analytics 4 (Google LLC, United States; added 2026-07-25). Those are the only subprocessors; the list stays current on this page, and cross-border transfers are covered by our processors' standard contractual clauses.

Retention and your rights

Retention is scheduled, automated, and short — keeping detail longer than it serves you would be a liability dressed up as a feature:

  • Per-call usage detail (endpoint, timestamp, salted IP hash): 90 days, then automatically compacted into daily per-key totals. The totals — and your credit ledger, which contains no personal data — live as long as the account does, for billing integrity.
  • Bulk-job inputs and results (your uploaded identifiers): deleted 30 days after the job finishes. Download your results within that window; the job's metadata stays so your history still makes sense.
  • Sign-in tokens and expired sessions: swept daily. Health-probe history: pruned at 90 days.

Export everything we hold, or delete the account and all of it, self-serve from the dashboard — no ticket, effective immediately. Ask and we'll do the same for waitlist entries within 30 days. We serve users worldwide: Australian Privacy Principles apply as our home regime, and EU/UK users (GDPR), California residents (CCPA/CPRA) and everyone else exercise the same rights by the same channel — one request, no residency quiz.

Contact

privacy@boundstone.io — live and monitored. hello@boundstone.io reaches the founder for anything else.