How we handle data, threats, and disclosures.
Transparency is a core tenet. Here's what we do — and what we don't do — with your data, plus the threat model we operate under and how to reach us if you find something broken.
What we collect.
The short list. If a datum isn't on it, we aren't holding it.
- Account email — used for account and order-routing updates, plus the weekly digest only if you opt in.
- Chat queries — rate-limited, logged for abuse prevention, scrubbed of addressable PII after 30 days.
- Basic request metadata (timestamps, user agent, IP) — standard access logs, retained 30 days.
What we never collect.
On the marketing side: no Discord IDs, no wallet addresses, no chain-analysis surveillance. No payment data is handled on any marketing page; payments only enter the system through the routed-orders flow.
Shipping addresses are stored only on routed orders, encrypted at rest, and purged 90 days post-fulfillment. There is no standing buyer profile; if you route two orders six months apart, the second one starts from scratch on the address field.
Who we're defending against.
We assume adversaries including hostile regulators, competing proxies, and compromised vendors — any one of whom has an incentive to make our data unreliable, our users identifiable, or our infrastructure compromised. Planning for all three keeps us honest about scope.
The chat bot's data layer is read-only — it cannot mutate the corpus or any user record. Order routing is single-purpose-scoped: the routing service has no read access to the chat corpus or the research surface, and vice-versa. Fewer joins, fewer blast radii.
Found something broken?
Email [email protected] with reproduction steps, affected surface, and your preferred contact method. A PGP key is not published yet; until it is, TLS to that address is the channel.
We respond within 72 hours for confirmed vulnerabilities, and within 5 business days for everything else. If you miss a response window, resend with [RESEND] in the subject line.