# PatentRef Privacy Policy (free beta)

Effective: 2026-11-09. Version: beta-4. Posted: 2026-10-26; until the effective date, version beta-3 applies. Controller: Aaron Baker, Tucson, Arizona, United States (the "Operator", "we"). Contact: privacy@patentref.io (until that mailbox is live: hello@patentref.io).

What is new in beta-4: a waitlist you can join at patentref.io/waitlist/ (section 1, Waitlist, and section 5), which is in our nightly backups for up to 45 days after an address leaves it (section 5); weekly counts of visits per page and per referring site, taken from the web server's access log, which this version says also records the referring page (section 1, Website visits); a weekly count of sign-ups per campaign code, which is not stored with your account (the same paragraph); a correction: beta-3 called the copy of our backups on Google Drive encrypted, but we do not encrypt our backups ourselves (section 6 says how they are copied and protected); and hello@patentref.io as the contact address until our own mailboxes are live.

This policy says what personal data the PatentRef service (patentref.io) collects, why, where it goes, how long it stays and what you can ask us to do with it. It is written to be read, not skimmed. If something here is unclear, write to us.

## 1. What we collect and why

Account data. When you sign up we receive your email address and a user id from Supabase Auth, the sign-in provider. We store your email, your user id, your API key records (the key's prefix and a hash of the key, never the key itself after it is shown to you once), the plan the key is on, and when each was created, rotated or revoked. Purpose: to run your account, mint and check your key and contact you about the Service. Legal basis where one is required: performance of the agreement with you.

Password. We never receive or store your password. Supabase Auth holds it (hashed) under its own terms. If you use a sign-in provider such as GitHub or Google through Supabase, that provider's policy applies to what it shares.

Usage data. For every API request we record the time, the key prefix, the request path and method, the response status, the time the request took, and the client IP address. Purpose: metering your monthly allowance, enforcing per-minute and per-address limits, abuse prevention, the public status figures (aggregated, never per user) and fixing faults. Legal basis: performance of the agreement and our legitimate interest in running a stable, fair service.

Query content. The query parameters you send (q, f, s, o) are not stored with your identity beyond the ordinary web server access log, which is kept for operations and rotated as described in section 5. We do not build profiles from your queries and we do not publish query logs.

Email. We send transactional email: sign-up confirmation (sent by Supabase Auth), key and account notices, and notices required by the terms. The only other email is the waitlist mail described below, sent only to an address that asked for it. No other marketing email. Sign-up, sign-in and password email and account notices required by law or by the terms carry no unsubscribe link and cannot be unsubscribed from while the account is open; any other email we send carries a one-click unsubscribe link.

Registry submissions (when the registry opens). The text, files, names and metadata you submit to the disclosure registry are published under the license in the terms, with the inventor names and submitter name you enter. The proof bundle (hash, timestamps, transparency-log entry) is public and permanent. A sealed submission is stored encrypted and shown only as its hash until you release it.

Website visits. The status page, the sign-up page and the waitlist page set no tracking cookies and load no analytics scripts. The sign-up page loads the Supabase client library from a content delivery network (cdn.jsdelivr.net), which sees your IP address when the page loads. The web server keeps an access log (IP address, time, path, status, user agent, referring page) for operations. Once a week we count, from that log, the visits to each page and the visits from each referring site; the weekly counts keep no IP address, user agent or time of a visit. If the link you used to reach the sign-up page carries a campaign code, we add one to a weekly count of sign-ups for that code when you create your key. The code is not stored with your account or your key.

Waitlist. If you join the waitlist at patentref.io/waitlist/, we keep your email address, the boxes you ticked (Lapse alerts and lists, Rules updates, Registry opening), when you signed up and when you confirmed, and which of our waitlist notices we have sent you. Purpose: to tell you when what you chose opens. Legal basis where one is required: your consent, which you give by confirming the link we mail you and can withdraw at any time with the one-click link in every waitlist mail. We send a confirmation mail, one notice when each thing you chose opens, and at most one other notice; nothing else, and nothing more until you confirm. Resend delivers the mail (section 3). The list is kept apart from accounts and API keys and is used for nothing else. To stop abuse, the form counts sign-ups per IP address for an hour and per email domain for a day, and deletes those counts within a day after that.

## 2. What we do not do

We do not sell personal data. We do not share it with advertisers. We do not use it to train models. We do not run tracking pixels or third-party analytics. We do not read your queries to profile you.

## 3. Processors and where data goes

Data is processed by these providers under their data processing terms (data processing agreements listed at patentref.io/docs/legal/processors as they are accepted):

- Hetzner Online GmbH (Germany): the server that runs the API and stores the account database, the waitlist, usage logs and snapshots, located in Helsinki, Finland (EU), and the Storage Box in Germany that holds a nightly copy of the backups.
- Supabase, Inc. (United States; its data processing addendum is with Supabase Pte. Ltd.; project hosted in the Central EU (Frankfurt) region, eu-central-1): sign-in, email confirmation and, when the registry opens, the registry database and file storage.
- Google LLC (United States): Google Workspace for our mailboxes, and Google Drive for a nightly copy of the backup of the account database and the waitlist.
- GitHub, Inc. (United States): the public uptime probe runs on GitHub Actions and records only whether the health route answered; no personal data.
- Resend (Plus Five Five, Inc., United States): delivery of the account email that Supabase Auth sends and of the waitlist mail (both from noreply@mail.patentref.io), and the bounce and complaint reports that stop mail to an address that cannot receive it.
- A payment provider (Stripe) only when paid plans start, under its own terms, and never before you choose to pay.

Transfers. The API and its data live in the EU (Finland). Supabase stores the sign-in data and the registry's database and files in its Central EU (Frankfurt) region, eu-central-1, with their backups; Supabase's support and operations staff, Supabase, Inc. in the United States among them, may access that data when support or a security incident needs it, under Supabase's data processing addendum (https://supabase.com/legal/privacy-resources/data-residency-and-transfers-faq). Google processes data in the United States. For personal data of people in the EU, the UK or Switzerland that reaches a US processor, the transfer basis is the processor's standard contractual clauses as incorporated in its data processing agreement, and, where the processor is certified, the EU-US Data Privacy Framework. The Operator is in the United States; your account data is accessible to the Operator there.

## 4. Your rights and how to use them

Wherever you are, you can ask us to: tell you what personal data we hold about you; correct it; export it in a machine-readable form; delete it; restrict or object to a use of it. Write to privacy@patentref.io from the email on the account. We answer within 30 days. There is no charge.

Self-service: the account page shows your email, key records and usage; the key can be rotated there. Account export and deletion from the page itself are not built yet; until they are, they are handled by email within the same 30 days.

Deletion and the registry. Deleting an account removes the email, key records and usage rows tied to it. A registry record's hash, proof bundle and DOI are permanent by design and cannot be deleted; the content behind a record can be removed and the record is then shown as a hash tombstone, and the DOI metadata is updated to say the content was withdrawn. Inventor names in a published record are part of that public record; a request to remove them is handled as a content removal.

If you are in the EU or UK you also have the right to complain to your supervisory authority. If you are a California resident, the rights above cover the rights the CCPA gives you; we do not sell or share personal data as those terms are defined there.

## 5. Retention

- Account data: for the life of the account and 30 days after deletion, then removed from the live database; nightly backups that contain it are overwritten on their own schedule (the app database backup is kept for 14 days on the server, 45 days on Google Drive and 30 days on the Hetzner Storage Box).
- Per-request usage rows (time, status, latency, key prefix, path): 35 days in the status page's log; monthly counters: the current month and the previous twelve.
- Web server access logs: 30 days.
- Waitlist: an address that is not confirmed, 7 days; a confirmed address, until 30 days after the last thing you chose opens, or until you leave the list, which deletes it at once; and in our backups for up to 45 days after that.
- Weekly page counts and weekly sign-up counts per campaign code: kept, as they hold no personal data.
- Bounce, complaint and unsubscribe records (the address, the reason and the date): kept as long as they are needed to stop mail to that address, also after the account is deleted.
- Registry proof bundles, hashes and DOI metadata: permanent. Registry content: until removed by you or by a takedown.
- Email: as held by the mail provider; we do not keep separate copies of transactional email.

## 6. Security

The API opens the patent snapshot read-only. The account database is a separate store on the server, backed up nightly with hashes. We do not encrypt the nightly backup of the account database and the waitlist ourselves: it is copied to the Hetzner Storage Box over SSH and to Google Drive over HTTPS, and Google encrypts files in Drive at rest. Secrets live only in the server's environment file and are never in the code repository. Access to the server is by one SSH key with password login disabled. If a breach affects your personal data we will tell you and, where required, the supervisory authority within 72 hours of learning of it, with what happened, what data was involved and what we are doing about it.

## 7. Children

The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.

## 8. Changes

We may update this policy. The version and effective date at the top change when we do; material changes are announced on the status page and by email at least 14 days before they take effect. The current version is always at patentref.io/docs/legal/privacy, and earlier versions are kept and sent on request.

## 9. Contact

Controller: Aaron Baker, Tucson, Arizona, United States. Email: privacy@patentref.io (until the mailbox is live: hello@patentref.io). A representative in the EU or UK is appointed only if the Service comes to need one under Article 27 GDPR; the Service does not target people in the EU or UK and this is reviewed when the registry opens.