Privacy

Effective 19 October 2026. Applies to xyntherium.com, its API, the hosted MCP server at mcp.xyntherium.com and hosted Verify Gate runs.

The short version

We use what you send us to provide the service, and for nothing else. We do not sell it, and we do not use it to train models.
Text you ask Xyntherium Verify to check is stored encrypted for a short, plan-dependent window, then deleted. What we keep longer is hashes and counts.
You can ask us to delete your account and its data at any time: support@xyntherium.com.

Account: your email address, name if you give one, and sign-in data (through Supabase Auth).
Verify checks(the API, the MCP server, the free tool, hosted Gate runs): the question, answer and source text you send. It is stored encrypted (AES-256-GCM) for your plan’s retention window: 7 days on Free, 30 on Builder, 90 on Team, 1 day for the anonymous demo. After that it is deleted. We keep the evidence ledger, which holds hashes of that text with verdicts and offsets but not the text, for 30, 90 or 365 days by plan.
Verify Gate in local mode runs in your CI and sends us nothing. In hosted mode we record counts, decisions and hashes; the repository is stored as a SHA-256 of its name.
Multi-model chat (the app at /query): your questions and the answers, kept in your history so you can return to them.
API keys: only a SHA-256 hash and a short prefix. The key itself is shown to you once.
Usage and diagnostics: request counts, latency, cost, the verdict mix, and for MCP calls the client name and version and the directory link you came from. These never include the text you sent. We also record page views with a random first-party visitor cookie. That record holds no IP address and does no cross-site tracking.
Payments are handled by Stripe. We receive the plan, status and a customer id, never your card number.
Referrals: if you arrive through an affiliate link, a cookie records which one, so the affiliate can be credited.

Vercel (hosting) and Supabase (database and sign-in), in the United States.
AI model providers, which receive the text needed to answer or check a request, under API terms that exclude training on it: Anthropic for Verify; for the multi-model chat, the providers shown on each answer (such as Anthropic, OpenAI, Google, xAI, Perplexity and DeepSeek).
Stripe (payments) and Resend (transactional email).

We share data with no one else, except where the law requires it.

Revoke API keys at any time on your account’s API keys page.
Ask for a copy of your data, a correction, or deletion of your account and everything tied to it by emailing support@xyntherium.com from the address on the account. We answer within 30 days.
Cancel a subscription from Billing in your account.

Text is encrypted at rest and never written to logs, keys are hashed, and the ledger lets you check records yourself. Details on /security.

Xyntherium is not meant for anyone under 16, and we do not knowingly collect their data.

If this policy changes in a way that matters, we will update the date above and, for account holders, say so by email before the change applies.

support@xyntherium.com