Privacy

What we do not collect

• Health data of any kind. No symptom logs, no conditions, no biometrics, no intake forms. This is a structural rule rather than a policy preference: the schema has nowhere to put it, and adding one is a decision that has to be written down and argued for.
• Anything that follows you. No tracking cookie, no fingerprint kept past a day, no session recording, and nothing that links a visit here to you anywhere else.
• Advertising and third-party trackers. None. Nothing here is sold, shared, or brokered, and no advertising network is given a way to observe you.

What we do collect

Page counts. We use Vercel Web Analytics to count which pages are read and where readers came from, so we can tell whether a video or a link sent anyone. It sets no cookie and stores nothing in your browser. Vercel tells one visit from another with a hash of the request, and discards that hash after 24 hours, so a visit today cannot be joined to one tomorrow. Before a page address is sent, we remove everything after the ? except campaign tags and the name of an assistant that linked here, so what you search for is never reported, and the sign-in and account pages are not reported at all.

Calls from an assistant. When ChatGPT, Claude, an editor or another program asks our MCP server a question (see connecting an assistant), we do not store the question, with one exception. When a question finds nothing in the graph, we add one to a count for that day against its wording, lower-cased and stripped of punctuation, so we can see what to add next. Only a short name is ever counted: at most four words, no number standing on its own, no address or link, and none of the words people use about themselves, so “zinc” is counted and “my blood pressure” or “5 mg melatonin” is not. The count carries the day and nothing else: no address, no client name, no time of day. We cannot tell a person’s name from a substance’s, so please do not type one. Counts are deleted after a year.

How many calls. For the MCP server and the read API, we keep a count per day of the calls each tool or endpoint served, so we can see whether anyone uses them. Each count carries the day, the tool or endpoint’s name and, if the call came with a paid API key, a number standing for that key (never the key itself). Nothing else: no question, no address, no client name, no time of day. A call without a key cannot be told from anyone else’s. A call with one can: if you hold a key, we can see how many calls it made to which endpoint on which day, which is what a metered API is billed on. Counts are deleted after 400 days.

To enforce rate limits we count calls per minute, keyed to the client’s name and to a keyed hash of the network address the call came from — never the address itself, and the hash cannot be turned back into one without a secret only the server holds. These counts are deleted within the hour. When the client is a hosted assistant, the address was the assistant’s, not yours.

One display preference. The explorer remembers whether you folded its key away, in your browser’s local storage, so it stays as you left it. It is a single on-or-off value, it is never sent to us, and clearing your browser’s site data removes it.

Email you send us. If you write to an @catalystproject.ai address, for instance from the access page, your address and your message are held by our mail provider. We use them to reply, and for nothing else. Ask and we will delete them.

An email address, if you ask to hear when a plan or the twin opens. We store the address, which plan (or the twin) you asked about, and the page you asked from, and nothing else. We write to it once, when that opens. It is deleted twelve months after you left it, or sooner if you ask.

If you buy an API key. Stripe takes the payment and holds your card, billing address and invoices; we never see a card number. We keep the email address you paid with, the plan, the subscription’s status and a one-way hash of your key, which is enough to honour the key and nothing more. Billing records are kept for seven years after a subscription ends, because revenue records have to be; a cancelled key’s hash is deleted ninety days after it stops working. We also keep a log of the payment events Stripe sends us (amounts, dates and Stripe’s reference numbers, no contact details) for seven years, and we email you a receipt for each payment and a notice if a payment fails or is refunded.

Only if you sign in, which nothing on the public site requires:

• An email address. Sign-in uses a one-time link sent to your address, so there is no password to store and none is stored. The address identifies your account and is not used for anything else.
• A session cookie. Set by our authentication provider to keep you signed in. It is not an advertising or measurement cookie, and there is no other cookie on this site.

Our hosting and database providers keep ordinary server logs, which include IP addresses, as every web server does. We do not join those logs to accounts or use them to build a profile.

Processors

Five, each acting on our instructions: Vercel hosts the site and counts page views, Supabase provides the database and authentication, Microsoft 365 holds the email sent to us, Stripe processes payments for API keys, and Resend sends the emails about a subscription. The reference data behind the graph is fetched from public sources, listed on the attribution page — those are sources we read, not parties we send anything to.

Your account

If you have one, you can ask us to delete it and the address attached to it, and we will. Since an account holds an email address and nothing else, there is little to export — but ask and we will send you what there is. Write to privacy@catalystproject.ai.

How long we keep it

An address left to hear when a plan opens is deleted after twelve months, automatically. An account and its email address are kept until you ask us to delete them. Server logs held by our hosting and database providers roll off on those providers’ own schedules, measured in days rather than years. We do not keep a separate copy of them. Email you send us is kept while the conversation it belongs to is open, and deleted when you ask.

Where it is held

On infrastructure operated by Vercel, Supabase and Microsoft, which may process and store data in the United States and other countries. If you are reading this from the UK or the EU, that is an international transfer, and it is made under the standard contractual terms those providers offer for it.

Your rights

Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can object to what we do with it, ask us to restrict it, and withdraw consent where consent is what we relied on. Since an account holds an email address and nothing else, most of these are quick.

Write to privacy@catalystproject.ai. If you are in the UK or the EU and think we have handled your data badly, you can also complain to your data protection authority — in the UK that is the Information Commissioner’s Office. We would rather you told us first, but you do not have to.

Children

This site is not directed at children, and accounts are not intended for anyone under 16. If you believe a child has given us an email address, tell us and we will delete it.

Changes

If this changes — as it did when API keys went on sale, and as it will when paid memberships open and an account gains a list of the things it follows — the date at the top changes with it, and the new terms will describe the new practice rather than being widened in advance to permit it.