Privacy

Accounts store email, display name, roles, subscription state and investigation artefacts you run. Row-level access: you see only your rows.

Investigations persist findings with public source URLs. We do not buy personal-data dumps. Retention follows the plan (30 days / 365 days / forever).

Public teasers are rate-limited by hashed IP. We do not sell visitor data.

Legal basis for investigative processing of public-source personal data is legitimate interest with a documented balancing test. Subjects may request access or erasure of what the product has stored.

AI calls send evidence excerpts to xAI under the operator's key. Prompts treat fetched page text as untrusted data.