Privacy notice
Last updated 19 October 2026.
Data processed
Diagnostic answers and drafts are stored in this browser to restore your work. Do not enter sensitive or personal data in free-text fields. Diagnostic answers are not sent to the delivery Worker.
Optional draft assistant (BYOK, added 19 October 2026): if you choose to use it, your self-assessment answers and prompts are sent directly from your browser to the inference provider whose API key you paste (Google AI Studio, Groq, OpenRouter, Mistral, Cohere or Hugging Face). SanctiAgent's servers never receive your key, your prompt, or the draft. The API key is stored in this browser's local storage only and can be removed with “Forget stored keys”. The provider's own privacy terms then apply to what you send, including its retention and training policy — review them before use. The assistant does nothing until you press Generate draft.
Optional first-party product analytics are off unless you select “Allow analytics” in the page controls. If enabled, the browser sends the event type, tool slug, a client timestamp, and a small detail object (for example which tool was viewed or how many fields were answered — never free-text diagnostic answers). The Worker records only the event type, tool slug, and its own server timestamp in Cloudflare KV for up to 90 days; the client timestamp and detail object are discarded on receipt and never stored. The event record itself contains no IP address, email address, free text or client detail; each request is also bounded by the short-lived abuse-control counter described under rate-limit records. Your allow/decline choice is stored in this browser's local storage; use “Change analytics choice” on a tool page to update it. No analytics event is sent before opt-in.
Purchases are processed by Stripe, which provides payment status, purchased product, and customer email. The delivery service stores an opaque unlock token, a one-way email hash, product, issue time, and entitlement status. Unlock URLs do not contain email addresses. Rotating delivery links expire; one-time entitlement records do not expire unless refunded or revoked.
Abuse controls and rate-limit records
To stop automated abuse, the delivery Worker keeps short-lived counters in Cloudflare KV. Each counter is stored under the key ratelimit:<route>:<digest> with the value {count, resetAt} and a KV expiry equal to its window. The digest is a one-way keyed HMAC-SHA-256 of the client address (or, for recovery, of the submitted email address) when the optional rate-limit secret is configured, and an unsalted SHA-256 digest otherwise. A raw IP address or email address is never written to these counters. They are not used for analytics, profiling, advertising or re-identification, are not joined to your diagnostic answers, and disappear when the window ends. The records are:
- POST /create-checkout — hashed client address: 30 requests per hour.
- GET /success — hashed client address: 60 requests per minute; hashed session identifier: 20 requests per minute.
- GET /unlock — hashed client address: 120 requests per minute; hashed token: 30 requests per minute.
- POST /recover — hashed client address: 10 requests per hour; hashed email address: 3 requests per hour.
- POST /event — hashed client address: 60 requests per hour.
These counters are a best-effort abuse brake, not a durable account, quota or identity record. They apply even when you decline analytics. Because an unsalted hash of an IP address can be reversed by enumerating the address space, the operator is required to configure the rate-limit secret before accepting payments.
Purposes and retention
Purchase data is used to fulfil contracts, prevent abuse, support customers, and meet accounting obligations. Optional product events are intended to measure aggregate use; event records expire after 90 days. Webhook deduplication records expire after seven days. Browser drafts and the analytics preference remain in local storage until you clear them.
Processors and rights
Stripe processes payments; Cloudflare hosts the site and delivery service; Resend may deliver transaction emails when configured. The typeface is self-hosted from this origin; no third-party font or analytics request is made. Contact the operator to request access, correction, deletion, or objection. Legal identity and privacy contact must be confirmed before commercial launch; see Contact.
This notice describes the current implementation and is not a substitute for the required privacy-owner and legal review. Commercial launch remains on hold.