Privacy Policy
Draft 1 — sourced from docs/Mapparoo-Privacy-Policy.md. Placeholder markers stay visible until launch.
Open items to resolve before publishing (kept visible on purpose):
- Entity form/state for Water and Stone, and a mailing address (CCPA notices customarily include one; a registered-agent or PO box address works).
- Sandbox vendor — currently [sandbox vendor: expected Vercel Sandbox, pending qualification closure]. Must be final before publishing; it is a named IP processor.
- Hosting provider and region — [DigitalOcean or Hetzner, US region pending Slice 16 decision]. Affects § 6 (where data lives).
- Email provider — TDR default is Resend; confirm.
- Anthropic data-handling terms — confirm the current retention/training posture at publish time and mirror the exact language here and on the custody page (CDR § XI.12 open item).
- Whether telemetry consent is asked at sign-up or only in account settings (FDR fn 5) — § 3 wording adjusts slightly either way.
- Contact address (currently [privacy@mapparoo.com] / [support@mapparoo.com]).
Each section opens with a plain-language summary in a box like this one. The summary helps you read; the full text under it is the policy.
1. Who we are and what this covers
In plain terms: This policy explains what Mapparoo collects, why, who processes it, how long we keep it, and how to get it deleted. The short version: we collect the minimum, we name everyone who touches your data, and deletion is self-serve and real.
Mapparoo is operated by [Water and Stone, entity form/state] ("we," "us"). This policy covers the Mapparoo web application at mapparoo.com, hosted guide links, and related emails. It does not cover GitHub, Stripe's checkout pages, or other third-party services you interact with directly — their own policies govern there.
We are based in the United States and operate the Service from US infrastructure. If you use the Service from elsewhere, your information is processed in the US.
2. What we collect
In plain terms: Three kinds of things: your account details, the content you deliberately connect for analysis, and the operational exhaust every web service has (logs, errors, payment records). We never see your full card number. Product telemetry is off unless you turn it on.
Account information. Email address, display name, password (stored only as a hash), and — if you sign in with GitHub — your GitHub identity and account email. Payment card details go directly to our payment processor (Stripe); we store only the last four digits, the payment method type, and transaction records.
Content you connect for analysis ("customer IP"). When you invoke a run: your repository's contents at a pinned commit, and the planning documents you upload or select. Handling and retention of this content is governed by the custody commitments in § 5 — the headline is that the full repository clone is temporary and deleted at run end, and what persists is the analysis artifacts you own.
Operational data. Server logs (IP address, timestamps, requests — with repository and document content never written to logs), error reports (via Sentry, with scrubbing configured), email delivery records, anti-abuse signals from Cloudflare Turnstile on registration and feedback forms, and webhook records from Stripe and GitHub.
Product telemetry (opt-in only). Off by default; collected only if you enable the consent toggle in your account. When enabled, we collect shape only: document-set scale and style class, detected stack, verification tier achieved, finding-type distribution, and guide-reading behavior (views visited, toggle usage, walkthrough completion). Never collected, even with consent: repository contents, document contents, finding specifics, or any project-identifying text.
What we don't do. No advertising trackers, no third-party analytics scripts, no data sales, no cross-site tracking. Hosted guides are served from a dedicated cookieless origin — readers of a shared guide need no account, and the guide artifact makes no external requests at all.
3. How we use information
In plain terms: To run the service you asked for, bill you, email you about your own runs and account, keep the service secure, and — only if you opted in — improve the product from anonymous shape data.
We use information to: operate the Service and execute the runs you invoke; authenticate you and secure your account; process payments and maintain required financial records; send transactional email (run complete/failed, receipts, security events, link expiry — never containing repository content, document content, or finding specifics in the body); prevent abuse and defend the Service; comply with law; and, with your consent, analyze telemetry to improve the product.
We do not use your content or personal information for advertising. We do not sell or share personal information as those terms are defined under the CCPA (§ 8).
AI processing. Analysis is performed via the Anthropic API. Your content is processed under [Anthropic's data-handling terms — confirm current retention/training posture at publish time]; it is not used to train models.
4. Who processes your data
In plain terms: Every processor is named — the ones that touch your code, and the ones that only touch account data. Adding one is an announced change, never a silent one.
Processors of customer IP (your repository and document content):
| Processor | Role |
|---|---|
| GitHub | Source of repository content (read-only App you install) |
| Anthropic | AI analysis (API processing of run content) |
| [Sandbox vendor — expected Vercel, pending qualification] | Isolated execution of install/build/test during runs |
| Cloudflare (incl. R2) | Object storage of uploads and artifacts; network transit and edge security |
Processors of personal (non-IP) data:
| Processor | Role |
|---|---|
| Stripe | Payments, receipts, invoices |
| [Resend — confirm] | Transactional email |
| Sentry | Error reporting (scrubbed) |
| [Hosting provider — DigitalOcean or Hetzner, US region, pending] | Application and database hosting |
The current list, with links to each processor's data-processing terms, is maintained on our public custody page. Adding a processor of customer IP is a change-control event: we update the disclosure before the new processor touches anything.
5. Custody and retention of your content
In plain terms: Your full repository exists in two places during a run — GitHub and the sandbox — and the temporary clone is deleted when the run ends. What we keep is your work product, until you delete it.
(a) The temporary full-repository clone exists only inside the per-run sandbox and is deleted at run end. We retain no raw clones.
(b) Repo-path documents fetched for a run are deleted from the processing workspace at run end. Documents you upload are stored (content-addressed, private) until you delete them or their project.
(c) Registries and guides — which embed only the code and document excerpts cited as evidence — are retained as your work product until you delete the guide, the project, or your account.
(d) Run history (dates, snapshot references, status, price) is retained until its project is deleted. Finding feedback is deleted with its project.
(e) Stakeholder edition links can expire and can be revoked at any time; a revoked or expired link serves a neutral page with no project details.
6. Retention of everything else
In plain terms: Account data lives while your account does. Deleting your account deletes your work; the few records the law makes us keep (purchase records) are cut loose from your identity.
Account information is retained while your account is active. When you delete your account: all projects and artifacts are deleted, hosted links are revoked, and GitHub authorization is revoked. Purchase and tax records are retained as required for financial and legal compliance, dissociated from your deleted profile to the extent the law allows. Server logs and error reports are retained on short operational windows ([e.g., 30–90 days — set before publishing]) and are not mined for anything beyond operations and security. Database backups age out on our backup schedule; deleted data disappears from backups as they cycle.
7. Cookies
In plain terms: Sign-in cookies only. No ad cookies, no analytics cookies, and shared guide links set no cookies at all.
The application uses cookies solely for authentication and session security (including CSRF protection). Hosted guides and stakeholder editions are served from a dedicated cookieless origin and set no cookies. We do not use advertising or third-party analytics cookies, so there is no cookie-consent theater to click through.
8. Your rights (including California)
In plain terms: You can see, correct, export, and delete your data — mostly self-serve, and by email for anything the account view doesn't cover. California residents get these as CCPA rights; we honor the same for everyone. We don't sell data, so there's nothing to opt out of.
Self-serve, from the account view: view and edit your account details, change your email or password, revoke GitHub access, toggle telemetry consent, download your guides and registries, delete projects, and delete your account.
By request to [privacy@mapparoo.com]: anything else, including a copy of the personal information we hold about you.
California residents (CCPA/CPRA). You have the rights to know, access, correct, delete, and port your personal information, and to not be discriminated against for exercising them. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months; there is accordingly no "sell/share" opt-out to exercise, and we do not use or disclose sensitive personal information beyond what is necessary to provide the Service. The categories we collect are those in § 2 (identifiers, commercial information, internet activity, and the content you provide), collected from you directly, used for the purposes in § 3, and disclosed only to the processors in § 4. To exercise any right, email [privacy@mapparoo.com]; we will verify the request against your account email. You may use an authorized agent; we will verify the agent's authority.
We extend the same rights to all users regardless of residence.
9. Security
In plain terms: The honest summary: minimal collection, read-only access, short-lived credentials, isolated execution, encryption in transit, and no repository content in logs or emails — plus the boring, load-bearing basics.
Measures include: read-only repository access via short-lived per-run tokens that are revoked before any of your code executes; sandbox isolation for untrusted code; private object storage served only through authenticated proxies; TLS everywhere; hashed passwords and hashed share-link tokens; database access restricted to the application; signed webhook verification; rate limiting; and structured logs with content redaction. No system is perfectly secure; if a breach affects your personal information, we will notify you as required by law — and, as a matter of policy, plainly and promptly.
10. Children
In plain terms: Mapparoo is not for children.
The Service is not directed to children and requires users to be 18 or older. We do not knowingly collect personal information from anyone under 18; if you believe we have, contact [privacy@mapparoo.com] and we will delete it.
11. Changes and contact
In plain terms: Material changes come with email notice before they take effect, not after.
We may update this policy. For material changes we will give at least 14 days' notice by email before the new policy takes effect. The current policy, with its effective date, is always at this page.
Contact: [privacy@mapparoo.com] · [Water and Stone, mailing address]