Privacy Policy

Effective Date: March 20, 2026 · Last Updated: March 20, 2026

ExClarity (“we,” “us,” or “our”) operates the website ex-clarity.com and provides AI-powered relationship analysis tools (the “Service”). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

We do not use cookies for tracking or advertising. We do not use Google Analytics or any third-party behavioral tracking tools.

1.3 Information from Payment Processor

Payments are handled by Lemon Squeezy (Merchant of Record). We receive your email address and order details from Lemon Squeezy. We do not receive, process, or store your credit card number, billing address, or other payment credentials. Please refer to Lemon Squeezy’s Privacy Policy for details on how they handle payment information.

2. How We Use Your Information

• Deliver the Service: Process your submitted messages through AI models, generate reports, and deliver rewrite results.
• Anonymized Community Feed: Display a short, AI-anonymized snippet of your submitted message on the public Live Feed. All personally identifiable information (names, phone numbers, locations, emails) is stripped by AI before display. You can opt out of the feed at submission time.
• Order Fulfillment: Associate purchases with your email, deliver reports, manage Credits balance.
• Abuse Prevention: Rate limiting via IP address, browser fingerprint, and Cloudflare Turnstile to prevent automated abuse.
• AI Quality & Debugging: Log AI model inputs and outputs (including your submitted messages) for error debugging and service improvement. These logs are stored server-side and are not publicly accessible.

3. Data Anonymization & the Live Feed

When you submit a message for analysis, the AI simultaneously generates an anonymized snippet (maximum 120 characters) with all personally identifiable information replaced:

• Full names → [Name]
• Phone numbers → [Phone]
• Email addresses → [Email]
• Specific locations → [Location]
• Usernames → [User]

Only this anonymized snippet (along with emotional tags) may appear on the public Live Feed. Your original message text (input_text) is never displayed publicly.

You can opt out of the Live Feed by unchecking the “Share anonymized analysis to community feed” checkbox before submitting.

4. Data Storage & Retention

• Database: All data is stored in a Supabase-hosted PostgreSQL database. Supabase infrastructure is hosted on AWS with encryption at rest and in transit.
• Original messages (input_text) are retained to enable report regeneration and for debugging purposes. They are accessible only server-side and are never exposed to other users.
• AI call logs (prompts and outputs) are retained for debugging and quality monitoring.
• Browser fingerprints are stored only in server memory for rate-limiting purposes and are not persisted to the database. They are cleared when the server restarts.
• Retention period: We retain your data for as long as your account (email) is active or as needed to provide the Service. You may request deletion at any time (see Section 7).

5. Third-Party Services

We share data with the following third-party services, solely for the purposes described:

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

6. Data Security

• All data in transit is encrypted via TLS/HTTPS.
• Database access is restricted to server-side code using service-role credentials that are never exposed to the client.
• Webhook signatures are verified using HMAC-SHA256 with timing-safe comparison.
• Authentication tokens are signed with HMAC-SHA256 and expire after 7 days.
• API endpoints are protected by rate limiting (IP, fingerprint, and Turnstile).

While we implement industry-standard security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Deletion: Request deletion of your personal data, including submitted messages, reports, rewrite history, and AI logs.
• Opt-Out of Live Feed: Uncheck the sharing checkbox before submission, or contact us to remove an existing entry.
• Data Portability: Request your data in a machine-readable format.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

7.2 European Economic Area (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing:
  • Contract performance: Processing your messages to deliver the analysis you requested.
  • Legitimate interest: Rate limiting, abuse prevention, and service improvement.
  • Consent: Sharing anonymized snippets on the Live Feed (opt-in by default, opt-out available).
• Right to Restrict Processing: You may request that we limit the processing of your data.
• Right to Object: You may object to processing based on legitimate interests.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority.
• Data Transfers: Your data is processed and stored in the United States. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses (SCCs) where applicable.

7.3 California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise these rights, contact us at [email protected]. We may verify your identity by confirming the email address associated with your purchases.

8. Children’s Privacy

ExClarity is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.

9. Local Storage

ExClarity uses your browser’s localStorage to store:

• Your email address (for seamless access across pages)
• An authentication token (HMAC-signed, expires after 7 days)

This data is stored locally on your device and is not transmitted to any third party. You can clear it at any time via your browser’s developer tools or settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page and update the “Last Updated” date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us at:

Email: [email protected]
General Support: [email protected]
Website: ex-clarity.com

By using ExClarity, you acknowledge that you have read, understood, and agree to this Privacy Policy and our Terms of Service.