Privacy Policy

CuriousArch turns a plain-English description of a system into an architecture diagram and analyses where it breaks. This page says what we collect to do that, who else handles it, and how long we keep it.

What we collect

• Account: your email address (and, if you use Google sign-in, your Google name, email and profile picture). A guest account has no email and is identified by a random ID.
• Your work: the system descriptions you write, the diagrams and versions built from them, findings, queued changes and chat messages. Saved projects are stored against your account.
• AI usage records: for each AI request, which action it was, the model, token counts, cost, timing and outcome. We keep these to run the service and control cost.
• Prompts and responses: the full text sent to and returned by the AI is stored for debugging and quality checks and deleted after 30 days.
• Guest trial: for guest accounts only, a salted one-way hash of your IP address, used to limit how many trials one network can start. We do not store the address itself.
• On your device: a sign-in session cookie, your theme choice, and the ID of the project you last had open.

Why, and on what basis

To provide the service you asked for (building, saving and analysing systems), to keep it secure and prevent abuse (quota limits, IP hashing), and to understand and control its running costs. We do not sell your data and do not use it for advertising.

Who else handles your data

• Anthropic receives your descriptions, diagrams and chat messages to generate results. Their handling is governed by their own terms and privacy policy.
• Supabase hosts our database and authentication.
• Google, if you choose Google sign-in.
• hCaptcha, only if a bot check is shown when starting a guest session.
• Our hosting provider serves the site and sees standard request data such as IP address.

Please do not put secrets in a description

Descriptions are sent to a third-party AI service. Do not include passwords, API keys, personal data about other people, or confidential company information you are not free to share.

How long we keep it

• Projects and account: until you delete them or ask us to.
• Prompts and responses: 30 days.
• Usage records (no prompt text): kept to account for cost.
• Guest accounts and their projects: deleted automatically after about 30 days unless upgraded by signing in.

Your choices

You can delete a project in the app at any time. You can ask us to access, correct, export or delete your data, or your whole account, using the contact address below. If you are in the EU/UK you also have the right to complain to your data protection authority.

Security

Traffic is encrypted in transit, projects are protected by per-user access rules in the database, and AI usage tables can only be written by our server. No system is perfectly secure; tell us if you find a problem.

Children

The service is not directed at children under 16.

Changes

If this policy changes in a meaningful way we will update the date above and, where appropriate, tell you in the app.