Privacy Policy

Effective date: July 25, 2026

This Privacy Policy explains how Distill.codes collects, uses, and shares information when you use the Service.

Information We Collect

Account information, such as email address, authentication identifiers, and account metadata from Clerk.

Billing information, such as Stripe customer, subscription, invoice, plan, trial, and payment status metadata. We do not store full payment card numbers.

Proxy key metadata, such as key hashes, encrypted key values, optional key names, creation time, rotation or deletion events, and last-used timestamps.

Operational metadata, such as request time, route, status code, latency, error class, IP address, user agent, and security-relevant events.

Error-monitoring data, such as a pseudonymous account identifier, technical error details, and application context sent to Sentry. We configure Sentry not to receive account email addresses or full request bodies.

Support messages and other information you choose to send to us.

Provider Request Handling

Distill.codes processes supported provider request bodies transiently to apply the selected prompt profile and forward the request to the upstream provider.

We do not store prompts, responses, code, repository contents, or full provider request/response bodies in the application database.

Provider credentials, authorization headers, and cookies may pass through the dedicated proxy host when required by your client and provider. Application logs must not record provider secrets or full bodies.

How We Use Information

To provide, secure, debug, monitor, bill, and improve the Service.

To authenticate users, manage proxy keys, enforce access, process subscriptions, and respond to support or legal requests.

To detect abuse, prevent fraud, investigate security incidents, and comply with law.

Service Providers

We use Clerk for authentication, Stripe for payments, Sentry for error monitoring, Railway for hosting and Postgres infrastructure, Cloudflare for DNS, security, and edge services, and supported LLM providers selected by your client.

These providers process information under their own terms and privacy commitments where applicable.

We do not use Google Analytics or advertising analytics. Clerk may use cookies or browser storage that are necessary to authenticate you and maintain your session.

Retention

We retain application audit events and Stripe webhook delivery identifiers for 90 days and delete records older than 90 days through a job scheduled at least daily. We retain account, billing, and proxy key records while the account is active and as reasonably needed to provide the Service, unless a longer period is required or permitted by law.

Security and application logs are kept for a limited operational period unless needed longer for investigation, abuse prevention, billing, legal, or compliance reasons.

Service providers may retain records under their configured schedules or for payment, tax, fraud prevention, security, backup, or other legal obligations.

Your Choices

You may request access, correction, deletion, or portability of personal information where applicable law gives you those rights.

You can rotate or delete Distill.codes proxy keys from the dashboard. You should also manage provider credentials directly with your provider.

Email [email protected] to make a privacy request. We verify the requester before acting, delete locally controlled account data and request deletion from applicable service providers, and explain any records that must be retained by law or until encrypted backups expire.

Security

We use reasonable administrative, technical, and organizational safeguards. No security measure is perfect, and we cannot guarantee absolute security.

Changes

We may update this Privacy Policy from time to time. When we do, we will post the updated version and update the effective date.

Contact

Privacy requests: [email protected]

Support: [email protected]