Privacy Policy

1. Who We Are

Refracted Cortex ("RC", "the Service") is operated by Digitally Demented Ventures LLC ("DDV", "we", "us", "our"), based in Alabama, United States.

• Website: https://refractedcortex.ai
• Contact: support@refractedcortex.ai
• Entity: Digitally Demented Ventures LLC

This Privacy Policy explains what data we collect, how we use it, where it is stored, and what rights you have.

2. The BYOK Model — Why It Matters for Privacy

RC operates on a Bring Your Own Key (BYOK) model. This has significant privacy implications:

What goes through RC (we can see it):

1. Account information (name, email, role, industry)
2. Billing and subscription data
3. Onboarding responses (used to build your CLAUDE.md profile)
4. Usage telemetry (feature usage, session counts, not conversation content)

What does NOT go through RC (we cannot see it):

1. Your AI conversations with Claude
2. The content of your prompts and Claude's responses
3. Any data you send to Anthropic through your API key

Your AI conversations travel directly between your browser (or desktop client) and Anthropic's servers using your API key. RC provides the architecture that structures those conversations (memory, context, agent instructions), but the actual AI interaction is between you and Anthropic. We are not a middleman for your AI usage.

3. What Data We Collect

3a. Account Information

When you create an account, we collect:

1. Name — to personalize your experience and CLAUDE.md profile
2. Email address — for account access, billing communications, and support
3. Password (hashed — we never store plaintext passwords)
4. Role and industry — used during onboarding to configure your architecture
5. Working style preferences — used to build your CLAUDE.md profile

3b. Billing Information

When you subscribe, we collect payment information through Stripe (our payment processor). We do not store your full credit card number. Stripe handles all payment processing and PCI compliance. We receive:

1. Last four digits of your card
2. Card expiration date
3. Billing address (for tax purposes)
4. Transaction history

3c. Architecture Files

Your architecture consists of files you create and maintain within RC:

1. CLAUDE.md — your cognitive profile
2. Memory files — persistent knowledge your system accumulates
3. Session logs — records of your sessions (metadata, not conversation transcripts)
4. Handoff documents — context transferred between agents
5. Agent configurations — your customizations to agent behavior

These files are stored in your personal container (Fly.io) and backed up to your GitHub repository. We have infrastructure-level access to these files for the purpose of delivering the service (e.g., deploying your container, troubleshooting issues), but we do not read, analyze, or use your architecture content for any purpose other than delivering and maintaining the service.

3d. Usage Telemetry

We collect anonymized usage data to improve the product:

1. Feature usage (which skills and workflows are used, how often)
2. Session frequency and duration
3. Tier and subscription status
4. Error logs and performance metrics
5. Onboarding completion rates

We do NOT collect:

1. The content of your AI conversations
2. The text of your CLAUDE.md or memory files
3. The content of your prompts or Claude's responses
4. Keystrokes, screenshots, or screen recordings

You may opt out of non-essential telemetry. See Section 9.

3e. Communication Data

When you contact support or we send you service communications:

1. Email correspondence with support@refractedcortex.ai
2. Transactional emails (billing confirmations, service alerts)

4. How We Use Your Data

We use the data we collect for these purposes and no others:

1. Delivering the service — setting up your container, deploying your architecture, maintaining your subscription
2. Billing — processing payments, managing subscriptions, issuing receipts
3. Support — responding to your questions and troubleshooting issues
4. Product improvement — using anonymized, aggregated telemetry to improve RC's features and performance
5. Service communications — sending transactional emails (billing, security alerts, service changes)
6. Legal compliance — maintaining records as required by law

We do NOT use your data for:

1. Advertising or ad targeting
2. Selling to third parties
3. Training AI models
4. Profiling or behavioral targeting
5. Any purpose unrelated to delivering and improving RC

5. Where Your Data Is Stored

Your Fly.io container region is selected during onboarding. Available regions are subject to Fly.io's infrastructure availability.

6. Third-Party Processors

We use the following third-party services to deliver RC. Each processes data only as necessary for their specific function:

We do not share data with any parties beyond those listed above unless required by law.

7. Your Rights

You have the following rights regarding your data:

Access

You can access your architecture files at any time through your RC session or GitHub backup. For account data, contact support@refractedcortex.ai.

Export

You can export your complete architecture at any time by:

1. Cloning your GitHub backup repository (contains your full architecture)
2. Downloading files directly from your container during a session
3. Requesting a complete data export from support@refractedcortex.ai

Correction

You can update your account information at any time through your RC settings. For corrections to billing data, contact support@refractedcortex.ai.

Deletion

You can request deletion of your data at any time:

1. Architecture files: Deleted when your container is removed (90 days after cancellation, or immediately upon request).
2. Account data: Deleted upon request, subject to legal retention requirements (billing records may be retained for tax/accounting purposes).
3. GitHub backup: Remains on your GitHub account — you control it. We do not delete your GitHub repositories.
4. Usage telemetry: Anonymized data cannot be traced back to you and is retained in aggregate.

To exercise any of these rights, email support@refractedcortex.ai. We will respond within 30 days.

Portability

Your architecture is designed to be portable. Your CLAUDE.md, memory files, and configurations are standard text files (Markdown). They are not locked into a proprietary format. If you leave RC, your architecture remains usable.

8. Data Security

We implement the following security measures:

1. Encryption in transit: All data transmitted between your browser and RC services uses TLS 1.2+.
2. Encryption at rest: Data stored in Supabase and Fly.io is encrypted at rest per their infrastructure standards.
3. Container isolation: Each user's Fly.io container is isolated. Users cannot access each other's containers.
4. Authentication: Password-based authentication with hashed password storage (bcrypt). No OAuth/social login.
5. API key security: Your Anthropic API key is stored encrypted and is only used to authenticate your sessions with Anthropic. It is never logged, displayed after entry, or shared.
6. Access controls: DDV team access to infrastructure is limited to the service operator (Daniel Walters) and is used only for service delivery and maintenance.
7. Security headers: Standard security headers (HSTS, CSP, X-Frame-Options) are implemented on refractedcortex.ai.

What we do not currently have:

• SOC 2 certification
• HIPAA compliance
• ISO 27001 certification
• Independent security audit (planned)

9. Cookies and Tracking

RC uses minimal cookies:

Essential Cookies (Cannot Be Disabled)

1. Authentication cookie — maintains your logged-in session
2. CSRF token — prevents cross-site request forgery

Analytics (Can Be Disabled)

1. Usage telemetry — anonymized feature usage, session counts, and performance metrics
2. No third-party advertising cookies
3. No tracking pixels
4. No social media tracking

To opt out of non-essential telemetry, contact support@refractedcortex.ai or adjust your settings in your RC account.

10. Children's Privacy

RC is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If we learn that we have collected data from a minor, we will delete it promptly. Contact support@refractedcortex.ai if you believe a minor has created an account.

11. International Users

RC is operated from the United States. If you access RC from outside the US:

1. Your account and billing data is processed in the US (Supabase, Stripe).
2. Your container may be hosted in a non-US region if you select one during onboarding (via Fly.io).
3. By using RC, you consent to the transfer of your account data to the US.

12. Data Retention

After the retention period, data is permanently deleted unless legal obligations require otherwise.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

1. We will post the updated policy on refractedcortex.ai.
2. We will update the "Last updated" date at the top.
3. For material changes, we will notify you by email at least 30 days before they take effect.
4. Your continued use of RC after the effective date constitutes acceptance.

14. Contact

For questions or concerns about this Privacy Policy or your data:

• Email: support@refractedcortex.ai
• Entity: Digitally Demented Ventures LLC
• Website: https://refractedcortex.ai

We aim to respond to all privacy-related inquiries within 30 days.