Anteproof › Legal › Privacy policy

Privacy policy

The whole of what Anteproof collects about you, why, for how long, who processes it for us, and what you can ask us to do.

Draft of 4 September 2026.

Draft, under counsel review, effective on publication. This text is a draft. It has not taken effect; it is being reviewed by counsel and becomes effective on the day it is published here without this notice. Questions: [email protected].

1. Who we are 2. What we collect 3. Why, and on what basis 4. Product analytics 5. Cookies 6. Sub-processors 7. International transfers 8. Retention 9. Your rights 10. Security 11. Children 12. Changes 13. Contact

1. Who we are

Recoilix LLC, a Delaware limited liability company operating from North Carolina and doing business as Anteproof ("we", "us"), is the controller of the personal data described here. Contact: [email protected], or by post at Recoilix LLC, 4030 Wake Forest Road STE 349, Raleigh, NC 27609, United States. This policy covers anteproof.com, api.anteproof.com, the MCP server, the weekly digest and the account features. It does not cover the websites of the sub-processors named below, which have their own policies.

Most of the Service is a public record about software projects and organisations, not about people. Personal data enters only when you create an account, subscribe, use an API key, write to us, or visit the site.

2. What we collect

Account data. When you sign in, our identity provider (Clerk) gives us your email address, a user id and, if you sign in with Google, the name and profile picture Google shares. We store the email address and the user id; the sign-in itself, including any password or one-time code, is handled by Clerk and never reaches us.
What you do in the product. The entities on your watchlist, your plan and trial dates, the API keys you create (we store only a hash of each key and its name), per-day call counts per key, and anything you upload to check, such as a lock file or SBOM (kept only as long as needed to answer, see section 8).
Billing data. Subscriptions are sold and processed by Stripe as merchant of record. Stripe collects your payment details, billing address and tax information under its own privacy policy; we never see or store card numbers. We keep the customer and subscription identifiers Stripe assigns, the plan and interval, and the status Stripe reports (active, past due, cancelled).
Product events. First-party records of what happens in the product — a page viewed, a search made, a sign-in, a key created, a checkout started — with the time, the page or endpoint, the UTM parameters and referrer the visit arrived with, the account id if you are signed in, and a keyed hash of your IP address. Section 4 explains how these are used.
Server logs. IP address, user agent, the URL requested, the response code and the time, kept for security and fault diagnosis. Our network provider (Cloudflare) also keeps its own edge logs.
Newsletter. If you subscribe to the weekly digest, the email address you give the newsletter provider (Beehiiv), whether the email was opened or a link clicked, as Beehiiv reports it, and your subscription status.
Correspondence. What you send us by email, and our replies.

We do not collect special-category data, do not buy data about you, do not run advertising, and do not sell or "share" (in the California sense) personal data with anyone.

3. Why we use it, and on what legal basis

Purpose	Data	Basis (GDPR / UK GDPR)
Running your account, watchlist, keys and subscription	Account, product use, billing identifiers	Performance of our contract with you
Metering API use and enforcing plan allowances	Call counts per key	Contract
Keeping the Service secure; detecting and limiting abuse; diagnosing faults	Server logs, hashed IP in product events	Our legitimate interest in a secure, working service
Understanding how the product is used and where sign-ups come from	Product events with UTM attribution	Our legitimate interest in improving the product and measuring our own marketing; you may object (section 9)
Sending the digest you asked for	Newsletter email	Consent; withdraw by unsubscribing
Service messages about your account (receipts, trial ending, renewal, security notices)	Account email	Contract, and our legitimate interest in telling you about your account
Tax, accounting and legal record-keeping	Billing identifiers and Stripe's records	Legal obligation
Answering you	Correspondence	Legitimate interest

We do not make decisions about you by automated means that have legal or similarly significant effects. The forecasts the Service publishes are about software projects and organisations, not about you.

4. Product analytics: first-party only

We measure the product ourselves. Product events are recorded by our own servers into our own database; no third-party analytics, advertising or session-replay service is loaded on the site, and no event is sent to one. Concretely:

Events carry the account id when you are signed in, otherwise a first-party identifier held in your browser (section 5), so a visit can be connected to a later sign-up.
The UTM parameters and referrer of the visit are recorded so we know which of our own posts or listings brought you. We do not follow you to other sites.
Your IP address is not stored in events. A keyed hash of it (a one-way value computed with a secret that is rotated) is stored instead, used only to rate-limit and detect abuse. The hash cannot be turned back into the address, and the rotation means it cannot be used to track you over long periods.
Events are used in aggregate. We do not build advertising profiles and do not sell, share or transfer event data to anyone.

We honour the Global Privacy Control signal as an objection to the attribution use described here.

5. Cookies and browser storage

Only first-party cookies and storage, set by us or by the identity provider on our domain:

Sign-in. Session cookies set by Clerk on anteproof.com that keep you signed in. Strictly necessary for the account features.
Attribution. A first-party identifier and the UTM parameters of your first visit, kept for up to 90 days, used as described in section 4. Not strictly necessary; you can object by sending the Global Privacy Control signal or by clearing site data, and it is never set from a third-party domain.

There are no advertising cookies, no third-party analytics cookies, and no cross-site tracking. Fonts are loaded from Google Fonts, which receives the request for the font file (and so your IP address) but sets no cookie; we are considering self-hosting them.

6. Who processes data for us (sub-processors)

Provider	Purpose	Location
Clerk, Inc.	Sign-in and account identity	United States
Stripe, Inc.	Checkout, subscriptions, invoices and tax, as merchant of record (Stripe is an independent controller for the payment itself)	United States and EU entities
Cloudflare, Inc.	Network edge, TLS, DNS, DDoS protection, email routing	Global edge; United States
Hetzner Online GmbH	Hosting of the public serving plane, database and product-event store	Germany
Resend, Inc.	Transactional email (receipts, account notices)	United States
Beehiiv, Inc.	The weekly digest newsletter	United States

Each processes data only for the purpose listed, under a written agreement. We will update this list before adding a sub-processor that handles account data; customers with a data processing addendum are notified as it provides.

7. International transfers

We are in the United States and the database is hosted in Germany. If you are in the EEA, the United Kingdom or Switzerland, your data is transferred to the United States when it reaches us or a US sub-processor. For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with each provider, or on the provider's certification under the EU-US Data Privacy Framework where it holds one. A copy of the clauses we use is available on request.

8. How long we keep it

Data	Kept
Account, watchlist, keys	While the account exists; deleted within 30 days of a deletion request or of closing the account
API call counts	13 months, for allowance enforcement and usage history
Uploaded lock files or SBOMs	Processed to produce the answer, then deleted within 24 hours; only the derived list of package names is kept with the answer
Billing identifiers and subscription status	As long as tax and accounting law requires (in the US generally 7 years); Stripe keeps its own records under its policy
Product events	Event-level data 13 months, then aggregated; the IP hash key rotates at most every 90 days
Server logs	At most 90 days
Newsletter	Until you unsubscribe; suppression record kept afterwards so we do not re-add you
Correspondence	3 years

9. Your rights

Wherever you are, you can ask us to tell you what we hold about you, correct it, delete it, give you a copy in a portable form, restrict how we use it, or stop a particular use. Where we rely on legitimate interest (product analytics, attribution) you may object and we will stop unless we have compelling grounds. Where we rely on consent (the digest) you may withdraw it at any time by unsubscribing. Email [email protected]; we answer within 30 days and may ask you to confirm it is your account. You can remove watchlist entries and revoke API keys yourself on the account page; to close the account, email us.

EEA, UK, Switzerland. You have the rights above under the GDPR, UK GDPR and FADP, and the right to complain to your supervisory authority (for the UK, the Information Commissioner's Office). We have not appointed an EU or UK representative at this time; contact us directly.
California. You have the rights to know, delete, correct and to opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information and do not use sensitive personal information; we will not discriminate against you for exercising a right. An authorised agent may act for you with written permission.
Other US states. Residents of states with comparable laws have comparable rights; use the same contact.

10. Security

Traffic is encrypted in transit; data is encrypted at rest by our hosting provider. API keys are stored only as SHA-256 hashes. The forecast archive the public reads is served from a read-only copy, and customer account data lives in a separate database. Access to production is limited to the people who operate it, over authenticated private networking. If a breach affects your data we will tell you and the relevant authority as the law requires.

11. Children

The Service is not directed at anyone under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

12. Changes

We will post changes here with a new effective date. Account holders are emailed at least 14 days before a change that reduces their rights or adds a new use of their data takes effect.

13. Contact

Privacy requests and questions: [email protected]. Everything else: [email protected]. Post: Recoilix LLC, 4030 Wake Forest Road STE 349, Raleigh, NC 27609, United States. Related documents: the terms of service, the refund and cancellation policy, the data processing addendum for business customers, and the legal page.