Reflux Student Privacy Policy

Version 2026-09-16. DRAFT for review before launch. Timelines Social Ltd., a corporation incorporated under the laws of Canada and doing business as Reflux, is the organisation responsible for the personal information described here, under Canada's PIPEDA and applicable provincial law.

What we collect

• Account: your email address, invite code, subscription status and billing period, and your licence key. Payment details are collected and held by Stripe, not by Reflux.
• Sign-in: when you ask for a sign-in link on the account page we send a one-time link to the email address on your account; it expires after 15 minutes. Signing in sets the session cookie described under Cookies.
• Consent record: when you accept the Terms we record the time, the terms version, your IP address and browser identifier, so that acceptance can be shown later.
• Usage metadata: for every AI model call made through the service we record the time, the model, token counts and the resulting cost against your allowance. We do not store the content of your requests or the model's replies on our servers beyond what is needed to complete the call.
• On your computer: the software keeps a local log and a local history of your sessions in its own folder. That data stays on your machine unless you send it to us for support.
• Website statistics: pages on this site count visits without cookies: a random identifier kept by your browser, the page, the time, the site that referred you, the approximate city and country your visit came from, the organisation the network belongs to, and which steps of signing up were reached. A link we sent you may carry a code identifying you, and if you sign up we associate your email address with that browser's earlier visits. Your IP address is not stored alongside these records. This detail is kept for thirty days; the counts made from it are kept longer.

Why we use it

To run and bill the service, to meter your allowance, to keep the service secure, to answer support requests, and to meet legal and accounting obligations. We do not sell personal information and do not use your content to train models.

Who processes it for us

• Stripe (payments and subscriptions).
• Anthropic (the AI model). Requests are sent to Anthropic's API under Reflux's commercial agreement; Anthropic does not use API content to train its models.
• Vercel (hosting of the website and the service, and its cookieless web analytics) and Upstash (the usage database).
• Resend (delivery of sign-in emails).

These providers operate in the United States and other countries, so your information may be processed outside Canada and be subject to the laws there.

How long we keep it

Account and consent records for the life of your subscription and for seven years afterwards where needed for tax and legal purposes; usage metadata for 24 months. You can ask us to delete your account earlier; we keep only what the law requires.

Your rights

You can ask to see, correct or delete the personal information we hold about you, or withdraw consent (which may end the service), by emailing nathan@reflux.sh. You can also complain to the Office of the Privacy Commissioner of Canada.

Cookies

The student pages use no advertising or tracking cookies. When you sign in to the account page by email, your browser keeps one cookie, reflux_student_session, which identifies your account for 30 days and is removed when you sign out. The account page may also remember your licence key in your own browser's storage so you do not have to paste it again. Clearing site data removes both.

Changes

We will post updates here and, for material changes, email you before they take effect.