Privacy Policy

We collect the following categories of information:

• Account information — name, email address, and password (stored as a secure hash) when you create an account.
• User content — formulas, notes, and other content you save to your account.
• Payment information — billing details processed by our payment provider (Stripe). We do not store full card numbers on our servers.
• Your AI key (Studio, optional) — if you choose to add your own API key from an AI company (Anthropic, OpenAI, or Google), we store it encrypted. We show only its last four characters and never display the full key again.
• Usage data — log data such as IP address, browser type, pages visited, and timestamps, collected automatically to operate and secure the Service.
• Cookies — essential cookies for authentication and session management. We do not use advertising cookies.

We use your information to:

• Provide, maintain, and improve the Service;
• Authenticate you and secure your account;
• Process payments and manage subscriptions;
• Respond to support requests and communicate service updates;
• Detect, prevent, and address fraud, abuse, or security issues;
• Comply with legal obligations.

We do not sell your personal information. We share information only with trusted service providers who help us operate the Service, including:

• Hosting and database providers;
• Authentication providers (including Google, if you sign in with Google);
• Payment processors (Stripe);
• Email delivery providers for transactional emails.
• The AI company you choose, only if you add your own AI key. When you test your key, run an AI formula review, or use the Label Decoder, we send your key and the content needed for that request (for example, your formula's name and ingredients, or the label text you paste) to that company. Their own terms and privacy policy apply to what they receive, and they bill you directly.

If you use Copy to my AI instead, nothing is sent by us. You choose what to paste into your own AI app.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, or property of our users or the public.

We retain your account information and User Content for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where retention is required for legal, accounting, or security purposes.

You can remove your AI key at any time from Account → Your AI key. It is also deleted when you delete your account.

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS) and at rest, hashed passwords, and access controls. No system is perfectly secure, and we cannot guarantee absolute security.

Depending on your jurisdiction (including the EU/UK under GDPR and California under CCPA), you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain uses. To exercise these rights, contact us at the email below.

Your information may be processed in countries other than the one you live in. Where required, we rely on appropriate safeguards such as standard contractual clauses to protect international transfers.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you through the Service. Your continued use of the Service after the changes take effect constitutes your acceptance of the revised policy.

Questions or requests about your privacy? Reach us at info@theapothecaryos.com.