Privacy policy

The short version

The text you send here is not stored. Not the input, not the redacted output, not the token mapping, and not in the logs. What is stored is a row of numbers per run — how many characters, how many findings of each type, how many were left as unsure, how many credits were spent — which is enough to show you your history and bill you, and is not enough to reconstruct a single word you sent.

What we collect

When you sign in we receive your email address and display name from our identity provider (signin.ounie.com). When you run a redact or rehydrate call we write one row containing: the verb, the mode and token format you chose, which detectors you selected, the number of documents, the character count, the number of findings by type, the unsure count, the credit reservation and settlement, and timestamps.

There is deliberately no column in that table capable of holding your text, your redacted output, or your mapping. The repository contains a test that reads the database migration and fails the build if such a column appears.

Logs

“We do not store your text” is only true if it is also true in the log stream, so the failure paths in this service record an error identifier rather than an error message. A message can quote the input that produced it; an identifier cannot. Request bodies are never logged.

The mapping

In tokenize mode the mapping from tokens back to original values is generated inside the request and returned to you in the response. We do not keep a copy. If you lose it, the values cannot be recovered — not by you, and not by us. That is not a limitation we intend to fix; it is the reason handing you the mapping is safe in the first place.

What is sent to third parties

Nothing. The detection engine is rules and checksums running in this service — there is no model provider, no search provider and no data vendor in the path, and your text does not leave the process that received it. That is a design decision with a cost (it is why person names are not detected) and this is the benefit side of it.

What we don't do

We don't track you across the web. There are no third-party analytics scripts, no advertising pixels and no session replay. We don't use anything you send to train any model — there would be nothing to train on, because it is not retained.

Where data lives

Run rows and credit ledger entries are stored in a Neon Postgres database hosted in the US. Those rows contain counts and billing metadata only, as described above.

Payments

Credit purchases happen on ounie.com, where Stripe processes payment. This product never sees your card number; it only reads and debits your Ounie credit wallet. Stripe's privacy policy is at stripe.com/privacy.

x402 calls are settled in USDC on-chain and are pseudonymous — we record the paying wallet address and the transaction hash, nothing more. An x402 run is stored without an owner, because a keyless caller has no account to attach it to.

Deletion

To delete your account or download your data, open a privacy ticket. We respond within 7 days and complete the deletion within 30. Note that the deletion concerns your account and your run counts — your text was never there to delete.

Contact

/contact · routed to ounie@ounie.com