Privacy Policy

1. Information We Collect

We collect information you provide directly: email address (for authentication), project content, feedback submissions, and file attachments. We also collect usage data including IP addresses, browser user agents, and page views for security and analytics purposes.

2. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Send transactional emails (magic links, invite notifications)
• Process payments via Stripe
• Maintain audit trails for security and compliance
• Improve the Service through anonymized usage analytics

3. Data Sharing

We do not sell your data. We share information only with service providers necessary to operate the platform:

• Vercel — Hosting and file storage
• Stripe — Payment processing
• Resend — Transactional email delivery
• GitHub — Issue creation (only when you connect your account)
• Anthropic — AI-powered feedback analysis (feedback content only, no personal data)

4. Data Retention

Your data is retained as long as your account is active. When you delete a project, all associated invites, feedback, attachments, and audit events are permanently removed. Account deletion removes all your data.

5. Cookies

We use essential cookies for authentication (session management). We do not use advertising or tracking cookies.

6. Security

We implement security measures including: invite token hashing (SHA-256), rate limiting, comprehensive audit logging, and encrypted data transmission (HTTPS). Passwords are never stored — we use passwordless email authentication.

7. Your Rights

You may access, update, or delete your personal data at any time through your account settings. You may unsubscribe from non-essential emails via the unsubscribe link in any email.

8. Changes

We may update this policy from time to time. We will notify you of material changes via email or a notice on the Service.

9. Contact

For privacy questions or data requests, contact us at privacy@lupr.dev.