Privacy Policy

Enforcee is operated by the individual publishing it at enforcee.vercel.app, based in Hungary, in the European Union. For the purposes of the UK and EU General Data Protection Regulation we are the controller of the personal data described here.

Contact for anything in this document, including any request to exercise your rights: 7patriksz@gmail.com. We answer within 30 days, and usually far sooner.

This is not a courtesy. It is how the product is built.

• The command-line tool. It makes zero network calls unless you explicitly pass a flag asking it to use the judged layer. There is no telemetry, no usage ping, no update check, and nothing to switch off, because there is nothing there.
• The guard. It runs inside your editor session, reads a policy file from your own project, and writes its decisions to a log file on your own disk. It never contacts us.
• Session transcripts. When you drop a session file onto the website it is parsed entirely in your browser using local JavaScript. The file is never uploaded, never stored, and never seen by us.
• Anything you audit without an account. If you are not signed in, nothing you paste is written to our database. It is processed to produce your result and discarded.

We do not use analytics, advertising pixels, session recording, fingerprinting, or third-party trackers of any kind. There is no cookie banner because the only cookies we set are the ones that keep you signed in.

Most of an audit is decided on our own servers with no external service involved. A minority of rules cannot be settled that way, and for those the rule text and the text you are auditing are sent to our model provider, Anthropic, over an encrypted connection, and a verdict comes back.

• This only happens when you ask for a full audit. A deterministic audit never sends anything to a model.
• We send only what is needed to answer the question: the rules being judged, and the output under audit. Not your email, not your account, not your other rulesets.
• Our commercial agreement with the provider does not permit your inputs or outputs to be used to train their models.
• On the free tier you may use your own key instead, in which case the request is between you and the provider and never touches our infrastructure.

We use a small number of processors. Each is bound by a data-processing agreement, and each is listed here so you can check them yourself rather than take our word for it.

• Vercel — hosting and delivery of the website and its API.
• Supabase — database and authentication. Our project is hosted in Frankfurt, Germany.
• Anthropic — the judged layer described above.
• Stripe — subscription payments. Card details go directly to Stripe and never reach us; we store only a customer reference and a subscription status.

Some of these operate infrastructure outside the European Economic Area. Where personal data is transferred out of the EEA it is covered by the European Commission's Standard Contractual Clauses. We do not sell personal data, and we do not share it with anyone not listed above.

• Every row in our database carries row-level security, applied from the first migration rather than added later. One account cannot read another account's rows, and the key used by the browser cannot bypass it.
• Administrative tables are locked entirely to public keys and reachable only through a server-side allowlist.
• Payment webhooks are cryptographically verified before anything is acted on.
• All traffic is encrypted in transit. Data is encrypted at rest by our infrastructure providers.
• Secrets are held as server-side environment variables and are never exposed to the browser.

No system is perfect. If you believe you have found a vulnerability, write to 7patriksz@gmail.com before disclosing it publicly, and we will work with you and credit you if you would like.

If you do so accidentally, delete the audit from your history and rotate the credential. Deleting an audit removes it and its per-rule results immediately and permanently.

Under the GDPR you may, at any time, ask us to:

• Access a copy of everything we hold about you.
• Correct anything inaccurate.
• Delete your account and its contents. We action this within 30 days, and backups age out within a further 7.
• Export your data in a portable, machine-readable form. Receipts are already JSON you can download yourself at any time.
• Restrict or object to processing carried out on the basis of legitimate interests.
• Withdraw consent where we relied on it, without affecting anything done beforehand.

None of these cost anything and none of them require a reason. If you think we have handled your data badly, you may complain to your national supervisory authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

We set one category of cookie: the session cookies that keep you signed in after you click a sign-in link. They are strictly necessary for the service to work and are exempt from consent requirements. They are removed when you sign out. We set no analytics, advertising or profiling cookies at all.

Enforcee is a developer tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

If we change this policy in a way that affects you, we will change the date at the top and email anyone with an account before the change takes effect. We will not quietly widen what we collect and hope nobody reads the diff.