Privacy Policy

Overview

Preuve AI ("we", "our", "us") respects your privacy. This policy explains what data we collect, why, and how we protect it.

We collect the minimum data needed to provide our service. We don't sell your data. Ever.

What We Collect

Data you provide

• Your startup idea description (required to generate analysis)
• Email address (if you create an account)
• Payment information (processed by our payment processor, we don't store card details)

Data collected automatically

• Usage analytics (page views, feature usage)
• Device type, browser, approximate location (country level)

How We Use Your Data

• Idea analysis: Your idea is processed by AI services and market research tools to generate validation reports. This includes searching publicly available sources for market data, trends, and competitor information.
• Real-time research: We query public data sources (social media, forums, news, review sites, trend data) to provide current market insights.
• Account management: Authentication runs on our own authentication service (self-hosted on Cloudflare Workers) using passwordless magic links and one-time codes. We never store, transmit, or hash passwords because we never collect them.
• Data storage: Reports and user data are stored in Cloudflare D1, and generated files in Cloudflare R2. Every query is scoped server-side to the signed-in account, so you only ever access your own data.
• Payments: Processed by Stripe (PCI DSS Level 1) for new purchases. Legacy DodoPayments purchases remain with their original processor. Paddle, a former processor, no longer handles any payments; we retain only historical transaction records. We never see or store card details.
• Analytics: We track product usage to improve the service. This data is used internally and not shared.
• Product improvement: Aggregated, anonymized usage data helps us improve the product.
• Public benchmarks: We may publish aggregate statistics like score distributions ("27% of fintech ideas score 70+"), pass-rate trends, and average competitor counts on our blog and marketing pages. We never publish your idea text, name, email, or any field that could identify an individual user. Datasets must reach at least 50 anonymous ideas before publication.

Third-Party Services

We use trusted third-party services to operate:

• AI analysis services: Google (Gemini), Anthropic (Claude), OpenAI (GPT), and xAI (Grok) process your idea to generate insights under enterprise API terms that prohibit model training. Requests may be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies.
• Market research services: Third-party data providers for trends, traffic estimates, and competitive intelligence. These never receive your idea or any personal data, only broad market and category terms.
• Database and file storage (Cloudflare): Cloudflare D1 for the database and Cloudflare R2 for generated files. Data is stored on Cloudflare infrastructure with primary storage in the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and Cloudflare’s Data Processing Addendum incorporating the EU Standard Contractual Clauses applies to our use of its services.
• Authentication (self-hosted): Passwordless magic-link / OTP sign-in, run by our own service on Cloudflare Workers. Sign-in emails are sent by our email provider. No passwords are ever set, stored, or transmitted, and no third-party identity provider holds your session.
• Payments (Stripe, Dodo): Stripe (PCI DSS Level 1) handles new purchases. Legacy DodoPayments purchases continue on their original processor; records from our former processor Paddle are retained for accounting only. Card details never touch our servers.
• Analytics (PostHog): Product usage tracking and session replay. PostHog runs on its US cloud and applies content masking to sensitive form fields.
• Analytics (Microsoft Clarity): Anonymized heatmaps and session replay used to find usability problems. Clarity masks text content by default and Microsoft does not use the data for advertising targeting.
• Hosting (Vercel): SOC 2 Type II edge network with automatic HTTPS and DDoS protection.

These services process data as needed to provide our service. We do not sell your data to any third party.

Data Retention

• Ideas and reports: Stored until you delete them or your account.
• Account data: Retained while your account is active.
• Analytics: Aggregated data retained indefinitely, individual session data for 30 days.

Your Rights

You can:

• Access your data (view your reports in the app)
• Delete your data (delete individual reports or your entire account)
• Opt out of analytics (use browser Do Not Track)

For data requests (access, deletion, portability, rectification), email privacy@preuve.ai. We respond within 30 days as required by GDPR Article 12.

Authentication

Preuve uses passwordless authentication only. You sign in by clicking a link or entering a one-time code we email you. There are no passwords to set, store, leak, or reuse.

This eliminates entire categories of attack:

• No credential stuffing risk (no password to stuff)
• No password-reuse exposure from other breaches
• No brute-force surface against your account
• No password-leak risk if our database were ever breached

Session tokens are opaque, issued by our own authentication service, and checked against the database on every authenticated API request. The frontend never sends a user ID to the API; the server resolves your identity from the session itself.

Security

We protect your data with:

• TLS 1.3 (256-bit) for all data in transit
• Encryption at rest with AES-256 on Cloudflare D1 and R2, per Cloudflare's published documentation
• Infrastructure providers that each maintain a SOC 2 Type II attestation at the company level (Cloudflare, Vercel, Stripe); Cloudflare's report is available from Cloudflare under NDA
• Access enforced server-side: every database query is scoped to the authenticated account at the API layer, and report data is only returned through authorization-checked endpoints
• Server-side rate limiting on every public API endpoint, with stricter limits on authentication endpoints
• IP-based abuse defenses (manual blocklist, automatic blocking after repeated abuse alerts, IPv6-aware to prevent rotation evasion)
• Disposable / throwaway email detection on signup
• Prompt-injection detection and input sanitization on every report submission
• Server-side paywall enforcement: locked report sections never leave the server in any API response
• CORS allowlist hardcoded to our production domains (no wildcard origins)
• Audit log on every API handler (authentication events, writes, security-relevant errors)

Cookies & Local Storage

We use the minimum browser storage required for the service to work. No advertising cookies. No cross-site tracking. The full list, by name:

Strictly necessary

• sb-base-auth-token - session token in localStorage. Holds the opaque token used to identify you on authenticated API calls. The name is historical and no longer refers to any third-party provider. Cleared on sign-out.
• __Secure-better-auth.session_token - HttpOnly session cookie set by our own authentication service. Not readable by JavaScript. Cleared on sign-out.
• better-auth.state / better-auth.pkce_code_verifier - short-lived HttpOnly cookies used only during a social sign-in redirect, to protect against request forgery. Discarded once sign-in completes.
• pending_upgrade_idea - localStorage. Preserves an in-progress idea draft across the checkout redirect so you don't lose work mid-purchase. Cleared after the checkout returns.
• CSRF and rate-limit cookies set by Cloudflare / Vercel as strictly necessary infrastructure cookies.

Functional

• user-plan-cache - localStorage. Caches your plan tier so the UI doesn't flicker on each navigation.
• theme_mode - localStorage. Your light/dark theme preference.
• vocabulary_mode / has_viewed_report - localStorage. Founder vocabulary preference and report-viewed flag.
• onboarding_tour_completed_v2 - localStorage. Whether you've completed the in-app product tour.
• tyi_auth_event - localStorage. Cross-tab broadcast of authentication state changes (sign-in / sign-out).
• Agency dashboard local cache keys (only set if you use the agency dashboard).

Attribution

• referral_via + referral_via_ts - localStorage. When someone visits via a referral link (?via=CODE), we store the 6-character code for up to 60 days so we can credit the referrer if you sign up. No cross-site tracking.
• Landing-attribution storage - first-touch source for marketing attribution, kept for the duration of the visit window.

Analytics

• PostHog cookies and localStorage flags - product analytics, feature flags, and session identifiers. Hosted on PostHog's US cloud. Disabled if you opt out.
• Microsoft Clarity cookies (_clck, _clsk) - heatmaps and anonymized session replay, used to find usability problems.

We do not use advertising cookies and do not share storage with ad networks.