Privacy & Data
This page answers exactly three questions: what we store, what we do NOT store, and how you delete it. Plain words, each line checkable against the code.
What we store (exhaustive — no "etc.")
- •Email address — the only required item (OTP sign-in, no password). No nickname, no avatar, no phone number.
- •A hash of the sign-in code: used for verification, expires in 10 minutes, not reversible (we cannot read it back either).
- •Session record: keeps you signed in, 30 days by default. It carries no IP address and no user agent — we do not record where you came from or what you came with.
- •Your own favourites, marks, device profile and drafts — content you produced on purpose.
- •A contact you voluntarily give when reporting something (it may be left empty).
What we do NOT store
- •No passwords — there is no password field at all; sign-in is email codes only.
- •No behavioural tracking: no analytics script, no third-party request, no ads, no algorithmic feed.
- •No IP access log at the application layer; rate limiting counts per minute in memory only — cleared on restart, never written to the database. The session table carries no IP and no user agent either (D244).
- •No real-name verification: we do not collect ID numbers, legal names, face images or phone numbers. An email address is all it takes to sign in.
- •We do not turn favourites or device profiles into a profile, and we never hand them out.
You can delete it at any time
- •One "Delete account" button removes the email, sessions, favourites, device profile and code records together.
- •No cooling-off period and no soft delete — deleted means deleted, with no restorable copy kept by us.
- •⚠️ Backup exception: a whole-database backup keeps one offline copy for disaster recovery, on a rolling basis, used for nothing else.
Crawlers and AI: public content welcome, private pages excluded
- •Public content: welcome to index, to quote, and to train on (`robots.txt` and `ai.txt` say the same thing).
- •Private pages (sign-in, account, favourites, notifications, submit, admin) and mutating endpoints: explicitly not welcome.
- •★ The layer that matters: private pages are served with `private, no-store` — not just "please do not fetch", but "do not keep it even if you do".
Your rights
- •To know: this page is the exhaustive list. We collect nothing that is not written here.
- •To delete: one button on the account page (see above).
- •To correct or request removal: email us at the address in the footer — take it down first, verify after, no gatekeeping.
- •To ask: questions about any line above go to the same address.
This page is not legal advice. It is an honest description of what we actually do — and every line can be checked against the code and the gates.
Contact us (takedown / correction / claim): contact@aiworkswell.com — we take down first, verify second, no gatekeeping.