Privacy Policy

Here's what information rx7db handles, why we need it, and how long we keep it.

At a glance

• We do not sell personal information.
• We do not share personal information for advertising, marketing, or cross-context behavioral advertising.
• We use only the information we need to run, secure, support, and improve rx7db.
• Interactions with rx7db are logged to help us understand usage and improve the product.

Information we handle

The information we handle depends on how you use rx7db:

• Website and connection data: IP address, browser or client details, timestamps, requested pages or MCP endpoints, and basic error or performance information generated when you connect to the service.
• Service content: questions, tool arguments, session identifiers, responses, and any vehicle configuration or other information you choose to provide. Don't include anything you don't want us to process.
• Account and authentication data: a truncated SHA-256 fingerprint of your Anthropic API key, used to bind a session and saved vehicle profile to the key that created them. For private-beta access, we also retain your invitee label and the full SHA-256 digest of your API key in the access allowlist. The rx7db application does not persist the raw API key.
• Communications: information you provide when you contact us, request beta access, or exercise a privacy right.

Your MCP client sends your Anthropic API key in a request header. We use it only to run the internal agent for your request, which means passing it to Anthropic for that call. Anthropic handles this data under its own policies and terms.

How we use and disclose information

We use information to:

• deliver, maintain, secure, troubleshoot, and support rx7db;
• authenticate requests, maintain sessions, and remember a vehicle profile when you ask us to save one;
• monitor performance, investigate abuse or errors, and improve the accuracy, safety, reliability, and features of the product; and
• comply with law, enforce our terms, and protect users, the service, and the public.

We log interactions with rx7db to understand how the service is used and improve the product. We do not sell personal information or give it to data brokers, advertisers, or other third parties for their own marketing or advertising.

We disclose information only when necessary to operate the service, including to infrastructure, hosting, security, and AI-service providers acting on our behalf; when you direct us to do so; or when required by law, to protect rights and safety, or as part of a corporate transaction. These providers may process information in countries other than your own, subject to the safeguards required by applicable law.

Retention

We retain information only for as long as reasonably necessary for the purposes described above. Session records and associated transcripts expire after seven days of inactivity. A vehicle profile you save remains associated with your API-key fingerprint until you clear it or we no longer need to retain it. Your invitee label and full API-key digest remain in the active allowlist while you are enrolled in the private beta and may be retained longer when needed for security, audit, legal, or dispute-resolution purposes. Interaction and operational logs are retained for a limited period and may be kept longer when needed for security, legal, or dispute-resolution purposes.

Security and changes to this policy

We use reasonable administrative, technical, and organizational measures to protect information. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

We may update this policy as rx7db or its legal requirements change. When we do, we'll post the new policy here and update its effective date. We may also announce material changes through the service or the private-beta channel.