1. What this policy covers
This Privacy Policy explains what ReverseMask does and does not do with data that passes through or is collected by reversemask.com. ReverseMask is a stateless masking and firewall layer. The important fact is that we do not store the content you process.
2. What we do NOT store
When you call /mask, /unmask, /guard, or /v1/chat/completions, the following are processed in memory only and discarded when the HTTP response is returned. They are never written to disk and never logged:
- The message text payloads you submit.
- Your known_pii values and allowlist.
- The masked token mappings and the encrypted vault bundle.
Our application code does not log request bodies. We cannot recover this data after the fact, and we do not retain it.
3. What we DO store
We keep a small amount of aggregate, non-content data in a SQLite database:
- Compliance counters: agency_id, client_sub_account, week_start, messages_processed, pii_fields_shielded, injections_blocked, created_at, updated_at. These are integer totals and label strings, not the content of your messages.
- License metadata: order_id, customer_email, customer_name, product_id, a hash of your API key (never the plaintext), and status.
4. Publicly readable slugs
The compliance portal (/portal/{client}) and badge (/badge/{client}.svg) are reachable by anyone who knows the client slug. They show only the aggregate counters above, never message content. Choose slugs that are not guessable if you want to keep the counters private.
5. Our infrastructure sub-processors
- Render: hosts the application and keeps standard access logs (IP address, request path, timestamp).
- Cloudflare: provides DNS and edge routing and keeps standard edge logs.
- Polar.sh: is the Merchant of Record and handles payments, taxes, invoices, and license order metadata.
- Resend: sends transactional email such as license key delivery and compliance reports.
Our application also writes operational log lines to standard output (for example, that an order was fulfilled and to which email address). Render retains these logs.
6. Your data rights
If you are in a jurisdiction with data rights (for example GDPR or CCPA), you may request access to or deletion of the records we hold about you. Counter rows contain only aggregate integers and labels, not personal data, but we will delete any row we hold that is associated with your account on request. Email [email protected].
7. Cookies and local storage
reversemask.com sets no tracking cookies and uses no browser local storage for tracking. See the Cookie Notice.
8. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from children under 13.
9. Changes
We may update this policy. The version posted here is current.