Privacy Policy

1. Who We Are

Refracted Cortex ("RC", "the Service") is operated by Digitally Demented Ventures LLC ("DDV", "we", "us", "our"), based in Alabama, United States.

• Website: https://refractedcortex.ai
• Contact: support@refractedcortex.ai
• Entity: Digitally Demented Ventures LLC

This Privacy Policy explains what data we collect, how we use it, where it is stored, and what rights you have.

2. AI Data Flow — How Your Conversations Are Handled

RC includes AI access as part of your subscription. AI requests are routed through RC's API proxy to multiple AI providers via OpenRouter. This section explains what data flows where.

How AI requests flow:

1. You interact with your private container (hosted on Fly.io).
2. Your container sends API requests through RC's proxy server.
3. The proxy forwards requests to OpenRouter, which routes them to your selected AI provider (Anthropic, OpenAI, or Google).
4. The AI provider processes your request and streams the response back through the proxy to your container.
5. Conversation content (your prompts and AI responses) is stored only in your container volume. It is not persisted on RC's central servers.

What RC's proxy captures (metadata only):

1. Token counts (input and output)
2. Cost per request (in USD)
3. Model used and request duration
4. A partial client identifier for routing (not your full user ID)

What RC's proxy does NOT capture or store:

1. The content of your prompts
2. The content of AI responses
3. Any data included in your messages to AI providers

RC provides the architecture that structures your AI interactions (memory, context, agent instructions) and handles API routing and usage metering. Conversation content passes through the proxy in transit but is not logged, stored, or analyzed by RC. Your conversations persist only in your personal container.

3. What Data We Collect

3a. Account Information

When you create an account, we collect:

1. Name — to personalize your experience and CLAUDE.md profile
2. Email address — for account access, billing communications, and support
3. Password (hashed — we never store plaintext passwords)
4. Role and industry — used during onboarding to configure your architecture
5. Working style preferences — used to build your CLAUDE.md profile

3b. Billing Information

When you subscribe, we collect payment information through Stripe (our payment processor). We do not store your full credit card number. Stripe handles all payment processing and PCI compliance. We receive:

1. Last four digits of your card
2. Card expiration date
3. Billing address (for tax purposes)
4. Transaction history

3c. Architecture Files

Your architecture consists of files you create and maintain within RC:

1. CLAUDE.md — your cognitive profile
2. Memory files — persistent knowledge your system accumulates
3. Session logs — records of your sessions (metadata, not conversation transcripts)
4. Handoff documents — context transferred between agents
5. Agent configurations — your customizations to agent behavior

These files are stored in your personal container (Fly.io) and backed up to your GitHub repository. We have infrastructure-level access to these files for the purpose of delivering the service (e.g., deploying your container, troubleshooting issues), but we do not read, analyze, or use your architecture content for any purpose other than delivering and maintaining the service.

3d. Usage Telemetry and AI Metering

We collect usage data to improve the product and meter AI usage:

1. Feature usage (which skills and workflows are used, how often)
2. Session frequency and duration
3. Tier and subscription status
4. Error logs and performance metrics
5. Onboarding completion rates
6. AI usage metadata: input token count, output token count, cost per request (USD), model selected, and request duration

We do NOT collect or store:

1. The content of your AI conversations (prompts or responses)
2. The text of your CLAUDE.md or memory files
3. Keystrokes, screenshots, or screen recordings

You may opt out of non-essential telemetry. See Section 9.

3e. Communication Data

When you contact support or we send you service communications:

1. Email correspondence with support@refractedcortex.ai
2. Transactional emails (billing confirmations, service alerts)

4. How We Use Your Data

We use the data we collect for these purposes and no others:

1. Delivering the service — setting up your container, deploying your architecture, maintaining your subscription
2. Billing — processing payments, managing subscriptions, issuing receipts
3. Support — responding to your questions and troubleshooting issues
4. Product improvement — using anonymized, aggregated telemetry to improve RC's features and performance
5. Service communications — sending transactional emails (billing, security alerts, service changes)
6. Legal compliance — maintaining records as required by law

We do NOT use your data for:

1. Advertising or ad targeting
2. Selling to third parties
3. Training AI models
4. Profiling or behavioral targeting
5. Any purpose unrelated to delivering and improving RC

5. Where Your Data Is Stored

Your Fly.io container region is selected during onboarding. Available regions are subject to Fly.io's infrastructure availability.

6. Third-Party Processors

We use the following third-party services to deliver RC. Each processes data only as necessary for their specific function:

We do not share data with any parties beyond those listed above unless required by law.

7. Your Rights

You have the following rights regarding your data:

Access

You can access your architecture files at any time through your RC session or GitHub backup. For account data, contact support@refractedcortex.ai.

Export

You can export your complete architecture at any time by:

1. Cloning your GitHub backup repository (contains your full architecture)
2. Downloading files directly from your container during a session
3. Requesting a complete data export from support@refractedcortex.ai

Correction

You can update your account information at any time through your RC settings. For corrections to billing data, contact support@refractedcortex.ai.

Deletion

You can request deletion of your data at any time:

1. Architecture files: Deleted when your container is removed (90 days after cancellation, or immediately upon request).
2. Account data: Deleted upon request, subject to legal retention requirements (billing records may be retained for tax/accounting purposes).
3. GitHub backup: Remains on your GitHub account — you control it. We do not delete your GitHub repositories.
4. Usage telemetry: Anonymized data cannot be traced back to you and is retained in aggregate.

To exercise any of these rights, email support@refractedcortex.ai. We will respond within 30 days.

Portability

Your architecture is designed to be portable. Your CLAUDE.md, memory files, and configurations are standard text files (Markdown). They are not locked into a proprietary format. If you leave RC, your architecture remains usable.

8. Data Security

We implement the following security measures:

1. Encryption in transit: All data transmitted between your browser and RC services uses TLS 1.2+.
2. Encryption at rest: Data stored in Supabase and Fly.io is encrypted at rest per their infrastructure standards.
3. Container isolation: Each user's Fly.io container is isolated. Users cannot access each other's containers.
4. Authentication: Password-based authentication with hashed password storage (bcrypt). No OAuth/social login.
5. API routing security: AI requests are routed through RC's proxy using RC-managed API credentials. Your conversation content passes through in transit but is not logged or stored by the proxy. Server logs capture only partial client identifiers and timing data.
6. Access controls: DDV team access to infrastructure is limited to the service operator (Daniel Walters) and is used only for service delivery and maintenance.
7. Security headers: Standard security headers (HSTS, CSP, X-Frame-Options) are implemented on refractedcortex.ai.

What we do not currently have:

• SOC 2 certification
• HIPAA compliance
• ISO 27001 certification
• Independent security audit (planned)

9. Cookies and Tracking

RC uses minimal cookies:

Essential Cookies (Cannot Be Disabled)

1. Authentication cookie — maintains your logged-in session
2. CSRF token — prevents cross-site request forgery

Analytics (Can Be Disabled)

1. Usage telemetry — anonymized feature usage, session counts, and performance metrics
2. No third-party advertising cookies
3. No tracking pixels
4. No social media tracking

To opt out of non-essential telemetry, contact support@refractedcortex.ai or adjust your settings in your RC account.

10. Children's Privacy

RC is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If we learn that we have collected data from a minor, we will delete it promptly. Contact support@refractedcortex.ai if you believe a minor has created an account.

11. International Users

RC is operated from the United States. If you access RC from outside the US:

1. Your account and billing data is processed in the US (Supabase, Stripe).
2. Your container may be hosted in a non-US region if you select one during onboarding (via Fly.io).
3. By using RC, you consent to the transfer of your account data to the US.

12. Data Retention

After the retention period, data is permanently deleted unless legal obligations require otherwise.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

1. We will post the updated policy on refractedcortex.ai.
2. We will update the "Last updated" date at the top.
3. For material changes, we will notify you by email at least 30 days before they take effect.
4. Your continued use of RC after the effective date constitutes acceptance.

14. Contact

For questions or concerns about this Privacy Policy or your data:

• Email: support@refractedcortex.ai
• Entity: Digitally Demented Ventures LLC
• Website: https://refractedcortex.ai

We aim to respond to all privacy-related inquiries within 30 days.