Privacy Policy

1. Introduction

This Privacy Policy describes how DolphinQ ("Service", "we", "us", "our") collects, uses, and protects your information when you use our platform.

By using DolphinQ, you consent to the data practices described in this policy.

2. Information We Collect

Account information:

• Email address
• Display name
• Password (stored as a hash, never in plain text)

Workspace content:

• Projects, stories, traces, and attachments you create
• Comments, assessments, and execution logs
• API keys you generate (stored as hashes, never in plain text)

Automatically collected by infrastructure providers:

• Authentication session tokens (managed by Supabase)
• IP address and browser metadata (collected by Cloudflare and Supabase as part of infrastructure operations, not by DolphinQ directly)

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process workspace operations and store your content
• Improve the Service and develop new features
• Ensure security and prevent abuse
• Communicate service updates, including changes to terms
• Process payments when applicable (via Stripe)

4. AI & Data Training

DolphinQ integrates with third-party AI agents (such as Claude by Anthropic) through MCP. Your workspace data is processed by these agents only when you initiate an interaction.

We may use anonymized, aggregated usage data (not your content) to improve the Service. We do not sell personal data to advertisers or any third party.

5. Third-Party Processors

We share data with the following service providers, solely to operate the Service:

We do not sell, rent, or trade your personal information to third parties.

6. Cookies & Local Storage

DolphinQ uses browser local storage (not traditional cookies) to:

• Store authentication tokens for session management
• Persist user preferences (e.g., theme, sidebar state)

Cloudflare Turnstile may set cookies for CAPTCHA verification during sign-in.

We do not use advertising or tracking cookies.

7. Data Retention

We retain your account information and workspace content for as long as your account is active.

Upon account deletion:

• Your data will be retained for 30 days to allow for account recovery
• After 30 days, all personal data and workspace content will be permanently deleted
• Anonymized, aggregated data may be retained indefinitely for analytics

8. Security

We implement reasonable administrative and technical safeguards to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (database-level)
• Row-Level Security (RLS) policies on all database tables
• API key hashing (keys are never stored in plain text)
• Session management with automatic expiry

No system is perfectly secure. We cannot guarantee absolute security, particularly during the beta period.

9. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — request corrections to inaccurate data
• Deletion — request deletion of your account and data
• Export — request an export of your workspace data
• Withdraw consent — stop using the Service at any time

To exercise any of these rights, contact us at support@dolphin-q.com.

10. Children's Privacy

DolphinQ is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a user is under 18, we will promptly delete their account and data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

For questions or requests regarding this Privacy Policy, contact us at: