Privacy Policy

1. What the product does

TODO

2. What we store once you create an account

If you create an account and save a project, we additionally store:

• The content of projects you explicitly save, in our database, associated with your account, so you can reopen and edit it later.

3. Account information

When you create an account, we store:

• Name, email address, and account ID — provided by you (email/password sign-up) or by Google (if you sign in with Google, we receive your name, email, and profile image from your Google account).
• Password — if you sign up with email and password, your password is hashed before storage; we never store or can see your plaintext password.
• Which version of these Terms/this Privacy Policy you accepted, and when — so we have a record of what you agreed to.
• Session data — when you're signed in, we store a session record that includes the IP address and browser/user-agent string associated with that sign-in, used for session security (e.g. detecting anomalous activity) and kept for as long as the session is active plus a short retention window afterward.

We do not ask for or collect marketing or newsletter consent, there isn't one to give.

4. Cookies

See the Cookie Policy for the full list. In short:

• Necessary cookies (always on): keep you signed in and remember your language. The Service doesn't work without these.
• Optional cookies (only after you accept the cookie banner): a random, non-identifying visitor ID used for the usage analytics described below.

5. Usage analytics

We track a small set of product usage events, for example that a page view happened or that an account was created, to understand how the product is used and to improve it. Each event records:

• The event name and the time it happened
• An anonymous visitor/session identifier (a random ID stored in a cookie, or your account ID if you're signed in)
• The page path the event happened on
• The country you're connecting from, at the country level only (e.g. "Spain," never a city, address, or precise coordinate), inferred from your network connection by our hosting provider's edge network, not from GPS or any device permission
• Small, fixed-shape metadata where useful

We never include in analytics: the content of any project you create, edit, or save, or passwords or authentication tokens.

This tracking only runs after you accept the optional-cookies banner. We also use Vercel Web Analytics and Vercel Speed Insights for aggregate traffic and performance metrics (also gated behind the same consent), which is separate infrastructure operated by our hosting provider.

6. Server logs

Like virtually every web service, our hosting and database infrastructure providers generate standard operational logs (e.g. request timing, error logs, IP addresses at the network level) as part of running the Service. These are operational/security logs, not a product feature we built, and are retained according to our infrastructure providers' own default policies.

7. Third-party service providers

We use the following categories of third-party providers to operate the Service. Exact vendors may change over time; this list reflects what's in use as of the date above.

• Hosting — Vercel (application hosting, Web Analytics, Speed Insights, and the edge geolocation used for country-level analytics above)
• Database — Neon (managed Postgres) for account and saved-project data
• Sign-in — Google (if you choose "Continue with Google")
• Transactional email — Resend, used only to send account-related email (e.g. password reset) and messages sent through our contact form, not marketing

These providers may process data on infrastructure located in different countries than you, which can mean your data is transferred internationally as part of normal operation. We haven't restricted our provider selection to any single region.

8. Data retention

• Account data (name, email, account ID) is kept while your account exists.
• Saved projects are kept until you delete them or delete your account.
• Usage analytics events are kept to support product analysis in aggregate form.

9. Account deletion

You can delete your account at any time from Account settings. Deleting your account deletes your account record and all projects you saved under it. Some records (for example, past events attributed only to your account ID, kept for product-analysis purposes as described above) may be retained in de-identified or aggregate form.

10. Your rights

Wherever you're located, we want you to be able to understand and control your data. You can:

• See your account's name and email in Account settings at any time
• Request an export of your account data (see Account settings)
• Delete your account and its content at any time
• Use the contact form for any other privacy request

Depending on where you live, you may have additional legal rights over your personal data (such as rights to access, correct, or object to processing, or to opt out of certain uses of your information). Reach out through the contact form and we'll address your request.

11. Security

We use industry-standard practices to protect your data, passwords are hashed, not stored in plaintext; sessions use secure, signed cookies; and access to your saved projects is restricted to your account. No method of storage or transmission is perfectly secure, and we can't guarantee absolute security.

12. Children

Redline Tool is not directed at children and is intended for general, professional use.

13. Changes to this policy

We may update this policy as the product changes. We'll update the date above when we do, and for material changes affecting existing accounts, we may ask you to review and re-accept.

14. Contact

Questions about this policy or your data: use the contact form.