Legal
Privacy Policy
TrueVectors is local-first by design. Your source code never leaves your machine, and our control plane stores only metrics-only receipts that describe an artifact — never a person.
Draft for review — not yet legal advice. This document is an honest description of how the product handles data, prepared for owner and counsel review before public launch. Effective date: [PLACEHOLDER: effective date] · Last updated: [PLACEHOLDER: last-updated date].
1. Who we are
This Privacy Policy explains how [PLACEHOLDER: legal entity name] ("TrueVectors", "we", "us") — operator of truevectors.ai, the TrueVectors Auditor, and the TrueVectors Hub at app.truevectors.ai — handles information. TrueVectors is a closed-source auditor for AI-generated code and agent output. Public software distribution is currently closed; this policy applies when access is authorized. Our registered place of business is [PLACEHOLDER: registered jurisdiction / business address].
2. The data boundary, first
Privacy is an architectural property of TrueVectors, not a promise bolted on afterward:
- Your source code never leaves your environment. The Auditor's engine runs against the checked-out CI/VPC workspace and produces its verdict there. This is the boundary we call G-6.
- The Hub stores metrics-only receipts. What is synced to the control plane is an aggregate receipt: counts, verification tiers, verdicts, severities, per-mode tallies, cost in USD, and hashed run/repository identifiers. It contains no source code, no file contents, no file paths, no finding prose, and no prompts. Ingestion fails closed against this schema.
- Metrics describe an artifact, never a person (G-2). The only personal data we process is the identity associated with an authorized account.
- Secrets stay secret (G-3). Bearer and device-link credentials are stored only as SHA-256 hashes; the plaintext is shown once at issuance and never retained.
3. Information we process
| Category | Examples | Source |
|---|---|---|
| Account identity | Email address and authentication metadata, via Supabase Auth | You, when authorized access is provisioned |
| Metrics-only receipts | Finding counts, verification tiers, verdicts, severities, cost in USD, hashed run/repo identifiers | The Auditor on your machine, when you choose to sync |
| Usage & billing data | Plan, trial status, entitlement, and (once billing is enabled) payment metadata held by our payment processor | You and your use of the service |
| Standard web telemetry | IP address, browser/device metadata, and request logs for the marketing site and Hub | Your browser |
| Error diagnostics | Crash and error reports used to keep the service reliable, via Sentry | The Hub/app at runtime |
We do not collect or store your source code, file paths, finding prose, or prompts. That data never reaches us.
4. The optional LLM tier
The deterministic proof tier needs no API key and sends nothing off your machine. A higher-assurance LLM tier is optional and off by default. When you enable it, it uses your own model API key or managed, metered tokens (Anthropic models accessed through Amazon Bedrock within our AWS environment). Only the content you explicitly submit for an LLM-assisted check is processed for that purpose; the deterministic boundary above is unchanged.
5. How we use information
We use the information above to: provide and secure your account and the Hub; show your fleet history and trends; meter and (at general availability) bill usage; keep the service reliable through error diagnostics; respond to your requests; and comply with legal obligations. We do not sell personal data, and we do not use your metrics to build a profile of you.
6. Legal bases
Where the GDPR or similar laws apply, we rely on: performance of a contract (providing the account and service), our legitimate interests (securing and improving the service), consent (where required, e.g. certain telemetry), and compliance with legal obligations. [PLACEHOLDER: confirm legal bases and any region-specific disclosures with counsel.]
7. Sharing and sub-processors
We share data only with vetted sub-processors who help us run the service (hosting, authentication, payments, email, and error monitoring), and where required by law. We do not otherwise disclose your information. The current sub-processor list and processing terms are in our Data Processing Addendum.
8. International transfers
Data may be processed in jurisdictions other than your own. Where required, transfers are protected by appropriate safeguards. [PLACEHOLDER: international-transfer mechanism — e.g., EU Standard Contractual Clauses / UK IDTA — and the relevant data-exporting/importing entities.]
9. Retention
- Metrics-only run receipts are retained for a bounded window (currently a default of 365 days) and then automatically purged. [PLACEHOLDER: confirm the retention window for general availability.]
- Account data is retained for the life of your account. You can delete your account and its associated data at any time from the Hub (Settings → Delete account) or by emailing us; on termination, customer data is deleted within 30 days.
- Backups are retained for a short rolling window and then expire.
10. Security
We maintain technical and organizational measures appropriate to the risk, including encryption in transit (TLS), tenant isolation via row-level security, least-privilege secret handling, SHA-256-hashed bearer credentials, and rate limiting on ingestion endpoints. No method of transmission or storage is perfectly secure, and we sell reasonable assurance, not a guarantee.
11. Your rights
Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing. You can delete your account and data self-serve in the Hub, or contact us to exercise any right. We will respond within the time required by law.
12. Children
TrueVectors is a tool for professional developers and organizations and is not directed to children. We do not knowingly collect personal data from children.
13. Changes
We may update this policy as the product evolves. Material changes will be reflected by an updated effective date, and where required we will notify account holders.
14. Contact
Privacy questions and data-rights requests: [PLACEHOLDER: dedicated privacy/DPO contact] or, in the interim, [email protected]. See also our Terms of Service, Data Processing Addendum, and Contact page.
This is an unreviewed draft. It must be reviewed by qualified legal counsel before TrueVectors goes public.