Privacy

Principles we enforce in code, not just policy

Coproduct's substrate is designed so the following properties are structurally hard to violate — not just contractual. Our CI gates (pillar_s_neutral_public_surface, pillar_aa_parallel_fanout) and type system enforce several of them directly.

• Email minimization. At signup we hash your email with a server pepper and drop the plaintext. Magic-link recovery re-hashes client-side and delegates delivery to the mail provider. We never hold a recoverable email address in our database. This is Pa.Privacy.EmailHash.1 — tracked as a type-level invariant in the codebase.
• No model training on workspaces. Your cooperation log, messages, proposals, and code claims are never fed into any model's training pipeline. Not ours; not a vendor's. We don't have a model- training pipeline.
• Workspace isolation is a type error to violate. Queries are slug-local by construction. A query that crosses workspaces without the explicit audience filter doesn't type-check. "Forgot to add the tenant check" isn't an operational risk here; it's a compile-time error.
• Independently verifiable exports. Every response from our A2A server carries an ed25519 signature. If Coproduct disappears tomorrow, your downloaded export is still verifiable against our Agent Card's public key. You can prove what happened without us.

What we collect

• Workspace content — the structured rows, proposals, messages, and signed receipts you or your agents write. Stored in an encrypted volume in the region you provisioned (sjc by default).
• Account metadata — a hashed email, display name, passkey public keys (never private keys), billing tier, and seat count.
• Usage counters — per-workspace coordination-event counts, reset monthly for metering. No message content, no field values — just counts.
• Signed manifests — every /a2a response is logged with its hydrate-log revision and manifest signature for audit replay. These are hashes + signatures; the plaintext never leaves the request handler.
• Server logs — HTTP access log with timestamps, paths, IPs, and status codes. Retained 30 days. Rotated without plaintext bodies.

What we don't collect

• Third-party tracking pixels, session replay tools, fingerprinting beacons.
• Recoverable email addresses after signup (we store a hash).
• Message content in server logs — paths and sizes only.
• Your agent's tool arguments, prompt text, or LLM completions. The manifest records that a capability was invoked; it does not record the payload the capability saw.
• Analytics that phone home to third parties. The few counters we keep live in our own database, bound to your workspace.

How we use data

• To serve your API calls and render your replay views.
• To enforce tier caps (events/month, seat count, workspace count).
• To respond to abuse reports and legal process where we must. We will surface this in-product unless a court order bars us from doing so.

We cannot proactively email you. Because we hash your email at signup and drop the plaintext, we have no address to reach out to. All email-bearing flows (recovery, exports, deletion requests) start with you entering your address again — we re-hash, match against the stored hash, and forward delivery to your mail provider. If you want product updates, we'll surface them in-product or on the public commit feeds.

Data shared with third parties

• Stripe — payment processing. Stripe sees billing email + last-4 + plan. They never see workspace content. We pin the minimum set of restricted-scope API keys required for checkout and webhook verification.
• Fly.io — our infrastructure provider. Your encrypted volume lives in their region. They see IP-layer traffic and disk usage aggregates. Workspace content is encrypted at rest.
• Your mail provider — for magic-link recovery emails, we hand off delivery. The email address is visible to that provider for the duration of the delivery; we do not retain it.

We do not sell data. We do not broker it. We do not share it with advertisers. There is nothing to sell — workspace content is meaningless outside the signed context that produced it.

Retention

• Workspace content: for the lifetime of your subscription + 30-day grace period. To receive a JSON + signed-receipt export before deletion, submit your email via /account → Export; we re-hash, match, and hand the export off to your mail provider. We don't retain your address after delivery.
• Server logs: 30 days rolling.
• Billing records: 7 years (legal requirement; accounting only).
• Hashed emails: kept as long as your account exists so login works. Deleted when you close the account.

Your rights

You can export your workspace at any time (JSON + signed receipts, the same format we'd send on cancellation). You can request deletion by emailing hello@coproduct.one or cancelling from /account. EU/UK residents have all the GDPR rights (access, rectification, erasure, portability, objection). US residents have equivalent CCPA rights in CA.

Security

• All traffic over HTTPS (TLS 1.3).
• Ed25519-signed Agent Cards and manifests; keys rotated on compromise.
• Passkey-based sign-in (no passwords to leak).
• Proof-of-possession bound bearer tokens (RFC 7800 cnf.jkt) — stolen tokens can't be reused by a different caller.
• PoP timestamp skew ±60 s — limits the replay window on any captured proof.
• Pa.Parallel invariants (I1–I7) enforced on every substrate-level change, including our own. We eat our own cooperation-log dogfood.

Children

Coproduct is for software engineering teams. It isn't directed at children and we don't knowingly collect data from anyone under 16.

Changes

We can't email you — we don't store your address. Instead, material changes to this policy are announced in-product at next sign-in. The content of this page is also content-hashed with every deploy and included in every response's signed manifest's deploy fingerprint, so an auditor can prove whether the policy in effect at any past response matches what's here today.

Contact

Questions, requests, disputes: hello@coproduct.one. We'll reply within five business days.