Privacy Policy.
We minimize what we collect, encrypt what we hold, and never resell the subjects you ask us to investigate. This policy explains what that means in practice.
1 · What we collect
Account data: your name, organization, and email. Case data: the subjects and questions you submit, and the reports delivered to you. Payment data is processed by our payment providers; we store a transaction reference, not your card number.
We collect minimal product analytics to keep the service working. We do not run third-party advertising trackers.
2 · Your case subjects
The subjects and questions you submit are confidential to your account. We do not sell, share, or repurpose them as marketing material, and we do not disclose who asked about whom.
Collected open-source artifacts that feed the Codex knowledge graph concern the subjects of investigation, not you as a client.
3 · How we protect it
Data is encrypted in transit (TLS) and at rest. Reports are delivered as self-contained files. Collected artifacts are hashed under a Berkeley-Protocol chain of custody, and access to client data is scoped and logged.
API keys for Codex and Dossier access are shown once and stored hashed. You can rotate a key at any time from your portal.
4 · Retention
We retain your account and delivered reports for as long as your account is active, so your library stays available. We minimize retention of raw case inputs beyond what's needed to build and support the report.
You can request export or deletion of your account data; deletion removes your reports from the portal.
5 · Your rights
Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. Email the address below and we'll act within the period your regulation requires.
We honor opt-outs for any non-essential notification from your portal settings.
6 · Contact
Questions about this policy or your data: privacy@rookreports.com. A PGP key is on file if you need to reach us encrypted.