description: aiputty.com's privacy policy: what d2 keeps about you, why, who else handles it, for how long, and your choices. Linked from the consent screen, sign up, the footer and Stripe.
tags: #legal #public #wip #listed

Privacy

Draft for razie (designer-196, 2026-10-23). Not legal advice: worth a lawyer's read before it goes live. The [to fill] marks are facts only you know.

Short version: what you write and build here is yours. We keep it so you can use it, we never sell it, and you can take it with you or delete it. Below is everything we keep, and why.

Who we are

aiputty.com ("d2") is run by [to fill: legal name], Ontario, Canada. Questions: [to fill: privacy contact email].

What we keep, and why

Your account: your email, handle, name, and a hash of your password (never the password itself). We need these to let you in and to write to you about your account.
What you make: your projects, topics, pages, apps, files, objects and their history; your thoughts, which only you and your own AI read; your chats with your agents. We keep them so you can use them. They're not used to train anyone's AI [to check: each AI provider's own terms, via OpenRouter].
Your AI's work: what the agents you connect do, under your name: their calls, the items they file, their messages. You see all of it, and you can stop any agent at any time.
Your secrets: keys and secrets you put in the vault are stored encrypted. Your agents get them only where you allowed them, and a value is shown only to you, when you reveal it.
Logs: the requests to d2 (address, time, who, the result), the security audit (sign-ins, lockouts, payments, permission decisions), and the client log your browser plugin uploads. We use them to keep d2 working and safe, and to answer your support requests. Kept [to fill: N] days; the audit's critical records for [to fill: N] days.
Payments: your plan, add-ons and credits. Card details go to the payment provider and never reach d2.
Cookies: one session cookie to keep you signed in, and settings your browser remembers (theme, panes). No advertising or tracking cookies [to check].

Who else handles it

We share only what each one needs to do its job, and nobody gets your data to sell:

Stripe (and PayPal, where you choose it): payments.
OpenRouter, and the AI providers it routes to: when an agent runs on d2's credits, its prompts and answers go through them. An agent on your own key goes to the provider you chose.
DigitalOcean: the servers d2 runs on, and backups.
A mail provider ([to fill: Resend, once mail is on]): the emails we send you.
The law: if a valid legal request requires it, or to protect people or d2 from harm.

Your choices

See and export: everything you made is in your projects; [to fill: export: how today].
Delete: delete your account at any time from your preferences. Your projects and thoughts go with it. Backups age out within [to fill: N] days.
Your AI: stop, revoke or pause any agent and token from Security.
Mail: account mail is needed to run your account; anything else you can turn off.

Children

d2 isn't for children under [to fill: 13 or 16]. We don't knowingly keep their data.

Changes

When this policy changes in a way that matters, we ask you to agree again on the consent screen.

Last changed: [set on publish]. The terms of use: Terms.