Privacy Policy

What we collect

• Account info

  your email address and provider profile name (when available), used to identify your session. We don't collect a password; sign-in goes through Supabase Auth.

• Conversations & bookmarks

  the questions you ask, the answers we generate, and the passages you save. These are tied to your account so you can return to them later.

• Laboratory reports you choose to upload

  only if you use the lab-report feature. That means the file or text you submit, the measurements read out of it, any corrections you make, and the analysis generated from them. Every report is read by a model: each page of a PDF — its image and any text it contains — or the text you paste or type is sent to a language-model provider (DeepSeek by default) to identify the results on it. That includes everything printed on those pages, such as your name and other details at the top of a report. The results it identifies are then checked against the document here before anything is kept. When you first open a full (supporter or member) report, and when you ask to rewrite its reading after a correction, the measurements read from it — names, values, units, and the ranges and flags your laboratory printed — are sent to that provider, with passages from our corpus, to write a cited reading across your results. If you ask a question about a report, your question and the same measurements are sent to that provider to write the answer. In none of these cases are the file or its filename sent. We keep an uploaded file for a short period so you can continue the same report later, and then delete it; that window is the same whatever else you choose. The measurements and analysis stay until you delete the report, or, for a report you did not save to your account, until the same window passes. We never add anything you upload to the public corpus, to search, or to analytics.

• Lab-report usage record

  a small, non-medical record of whether your account has used its one free lab-report preview. The lab-report feature is not available yet, so no account has one to spend; this describes what we will store once it is. It holds no filename, no measurement and no value — only the fact that the allowance was used — and it deliberately survives deleting a report, because otherwise deleting one would hand out the free preview again. It is removed when you delete your account.

• Rate-limit counters

  a running count of requests per day, scoped to your account, used to enforce the daily limit shown in Settings.

• Server logs

  standard application logs that include IP addresses, user-agent strings, and request paths, kept for up to 30 days for debugging and abuse defense.

We use Vercel Web Analytics for aggregate, cookie-free usage measurement. After you consent, it records redacted page routes, coarse acquisition categories, primary Oracle CTA clicks, reference-page engagement, anonymous account creation, and contribution or affiliate outbound clicks. We also use Vercel Speed Insights for anonymous real-user performance measurement: Web Vitals such as LCP, CLS, INP, FCP, and TTFB, together with the coarse route and path and with network, browser, device, operating-system, country, and Web Vital attribution data. Dynamic route identifiers and query strings are removed before sending. We never send your query text, answer text, source passages, email, user ID, account ID, conversation ID, or share token to either Vercel product. These events are never tied to your account or signed-in identity. Vercel Web Analytics and Vercel Speed Insights are both opt-in: they are disabled by default and only run after you accept the consent banner.

We also use Sentry to find and fix bugs, and it works in two separate ways. Operational error reports and sampled performance traces run whenever Sentry is configured, including before you answer the consent banner and after you decline it. We treat them as reliability monitoring rather than measurement, so the banner does not control them. They carry the error and its stack trace, the release and environment, sampled request timings, and route fields that pass through the same redaction as our analytics: a concept slug, conversation ID, or share token becomes a placeholder, and query strings and fragments are dropped. Our own code then strips the credential-bearing parts of an error report before it is sent: the authorization and cookie headers, and the parsed cookie map that would otherwise carry your session. We do not turn on Sentry's optional collection of request bodies or account identifiers. Sentry still receives the metadata any web request carries, including your IP address.

On-error session replay is the second behavior, and it is opt-in. It captures a short clip of the page when an exception occurs, it stays disabled until you accept the consent banner, and when it does run it masks all text, masks all inputs, and blocks all media. It records layout and interaction, not your content. One limit worth stating plainly: a replay recording also stores the address of the page it recorded. We redact the dynamic parts we can reach, but the recording format keeps its own copy of the address, so if you accept replay and then open a conversation someone shared with you, that link can appear in the recording. Decline the consent banner if you would rather that never happen. We do not embed third-party advertising or cross-site tracking, and we don't sell data to anyone.

Where your data lives

• Supabase

  stores your account, conversations, bookmarks, and rate-limit counters. Hosted in the US.

• Qdrant Cloud

  stores the corpus index that retrieval runs against. Our own servers turn your question into dense and sparse search vectors, plus optional derived vectors for a rephrased version of it, and the request we send Qdrant carries those vectors together with retrieval filters and a result limit. Qdrant returns the matching corpus passages. Your question text is not the query parameter Qdrant receives in this retrieval path, and the corpus itself is not personal data.

• Language-model providers

  run the models that interpret your question, rerank the retrieved passages, and write the answer. The configured provider receives your question, a limited amount of earlier conversation when the answer depends on it, and the retrieved passages, all inside the prompt. DeepSeek is the default in our code. Anthropic is the default failover when a provider request fails with a transient error and its key is configured. An operator can select Groq, Google Gemini, OpenAI, or Cerebras for any of these roles instead, and adding a provider beyond that list requires an update to this page. Each provider's standard data policy applies to that traffic, and we do not enable optional model-training data sharing with any of them.

• Voyage AI

  ranks the retrieved passages for relevance. When a search gets as far as ranking, the search query and the candidate corpus passages go to Voyage's API. The search query may be your question as you typed it, a rewritten version of it, or, for a comparison question, one of the individual things being compared. When the citation check runs after the answer is written, we also send its cited sentences back, each paired with the passage it cites, to check how well that passage supports the claim, so sentences from the answer you were shown go to Voyage too. If Voyage is unreachable we try to rank on our own servers instead, and if that also fails we fall back to the raw search order. Voyage returns relevance scores, an index identifying each passage in the list we sent, and a token count; it never writes any of the text you read. Voyage offers zero-day retention for accounts with a payment method on file, and we have it enabled, so what we send is not kept for model training. On our own diagnostic record of the request we keep the search query itself and how long ranking took, and, when they are available, the highest and the average relevance score across the passages we kept and a top score we blend ourselves from the relevance score and other signals. When the citation check runs we also keep, for each source the answer cites, the weakest score that source received; that one is stored alongside the saved answer as well.

• Cloudflare and DeepInfra

  turn search text into the numeric vectors we use to find matching passages in our library. The text goes to Cloudflare Workers AI first, and to DeepInfra only when Cloudflare cannot answer. It is what we search the library with: your question as you typed it, a rewritten version of it, or one of the individual things being compared; for a short question, a hypothetical passage a language-model provider wrote from it; the words you enter in the library search; and, if you ask a question about a lab report, that question with the name of the measurement it is about. No file, account detail, or earlier conversation is sent. Both return only the vectors. Each provider's standard data policy applies to that traffic, and we do not enable optional model-training data sharing with either of them.

Each of these vendors has its own privacy policy and security posture. Linking out to each: Supabase, Qdrant, DeepSeek, Anthropic, Groq, Google, OpenAI, Cerebras, Voyage AI, Cloudflare, DeepInfra, Sentry.

Cookies and tracking

We use cookies only for the session token that keeps you signed in. No advertising or third-party tracking cookies. We do not embed analytics that follow you across the web. When you first visit, a consent banner asks whether you agree to non-essential telemetry. Your answer controls three things: Vercel Web Analytics, Vercel Speed Insights, and Sentry on-error session replay. All three are disabled by default and run only if you accept. It does not control Sentry's operational error reports and sampled performance traces, which are described above and run whenever Sentry is configured. Your choice is stored locally in your browser and does not require an account.

Your rights

Regardless of where you live, you have these rights:

• Access

  ask us what data we hold about you, and we will tell you.

• Deletion

  delete every piece of data tied to your account with one click from Settings → Danger zone → Delete account. This cascades through conversations, messages, bookmarks, rate-limit counters, and finally your auth record itself. It is irreversible.

• Portability

  export your conversations as JSON or markdown from the conversation header menu.

• Correction

  sign-in name comes from your auth provider profile; update it there and it will propagate on next sign-in.

EU and UK residents also have the right to lodge a complaint with their supervisory authority. We are not required to appoint an EU representative under GDPR Art. 27 at our current scale, but if that changes this page will be updated.

Retention

We keep your data as long as your account exists. If you delete your account, the cascade runs immediately and the data is gone from our application database within seconds. Upstream backups (Supabase's point-in-time recovery, where applicable) may retain a copy for up to 7 days before the backup itself rotates.

Children

The service is not directed at children under 16. We do not knowingly collect data from anyone under that age. If you believe a minor has signed up, contact us and we will delete the account.

Changes to this policy

When the policy changes meaningfully, the “Last updated” date at the top of this page will change and the first-signin acknowledgment modal will reappear so you can review and re-accept.

Contact

For privacy questions or to exercise the rights listed above, email contact@bioenergeticoracle.com. Most rights requests are also self-serve from Settings.