Privacy policy

What we collect

• Account details. Your email address, and your name and profile picture if you sign in with Google. Passwords are handled by our sign-in provider, Supabase. You can also add a handle, a bio and a public contact email.
• What you give us to work with. Prompts, instructions, feedback, comments, files and data you upload (such as HTML, spreadsheets, images, audio and video), and data sources you connect (such as a Google Sheet).
• What iterFact makes for you. Generated artifacts, their versions and sections, templates you build, and settings such as tags, pages and displays.
• Payments. Card payments go through Stripe Checkout. We never see your full card number. We keep your Stripe customer id, what you bought, amounts, credits and invoice or subscription status.
• Usage. Pages you visit on iterfact.com, the referring page, browser, device and operating system type, campaign tags, and the actions you take. When someone views a hosted page we record the page, country, referrer, browser type and a hashed (not raw) IP address.
• Connections and tokens. API tokens you create, MCP clients you authorize, and connections you link, such as Google Sheets or a Cloudflare account for a custom domain.
• Logs and errors. Error reports from the site (message, page and technical details) and the request logs our hosting providers keep, which include IP addresses.
• The iterfact command-line tool. Unless you turn it off, the Python package sends a random install id it keeps on your machine, its version, your Python version and operating system, and which command ran, at most once a day per command. It never sends prompts, files, artifact content or credentials. Set ITERFACT_NO_TELEMETRY=1 to turn it off.

Why we use it

To run the product: sign you in, generate and host your artifacts, publish them when you ask, bill you, and support you. We also use it to keep the service secure (for example rate limits and abuse review), to fix bugs, and to understand how the product is used.

We do not sell your personal information and we do not show ads. We do not use your private content to train our own AI models; it is only processed to do what you ask.

Who processes it for us

• Supabase: database and sign-in. Sign-up and password emails are sent through Supabase.
• Cloudflare: runs iterfact.com and the hosted artifact pages, stores artifact files, and routes custom domains.
• Railway: runs the iterFact generation and MCP server.
• Anthropic: the AI models that write and revise artifacts. Your prompts, uploaded content and data needed for a request are sent to Anthropic to produce it. Some features may use other AI providers, such as OpenAI for images.
• Stripe: payments.
• Google: only if you sign in with Google or connect a Google data source.
• Impact: affiliate link measurement. Its script loads on iterfact.com pages and receives your browser, device and page information and your clicks on affiliate links. Some privacy laws treat this as sharing personal information.
• PostHog: limited product analytics for a few specific actions. It does not record page views or IP addresses.

These providers may process data in the United States and other countries.

What is private and what is public

One exception comes first: when you run a template on iterfact.com, the result is published straight away at its public URL. Anything you would not publish should not go into a template run.

Other new artifacts and uploads are private. They are visible to you, to people you share them with inside iterFact, and to iterFact staff when needed for support, security or abuse review. A private artifact's link does not work for anyone else. When you open a private artifact, iterFact may give your browser a short-lived access link; anyone you give that link to can view the artifact until it expires.

Publishing makes the artifact page public at its URL. Anyone can view it, search engines may index it, and it may appear in our sitemap. Pages under your handle can be public or unlisted: an unlisted page is not listed by us, but anyone with the link can open it. The rules for public pages are in the terms of service and the content policy.

Unpublishing stops iterFact serving the artifact's own page. Pages you placed under your handle and published Atlas entries are not removed by it yet; remove those separately. Copies other people saved, search engine caches and our network caches (up to 7 days) may remain for a while. Removing an artifact from your Library removes it from your list; it does not delete its stored files or unpublish its pages.

Cookies and similar storage

We use cookies and browser storage to keep you signed in, remember a referral, count visits to iterfact.com (a first-party session id), keep anonymous previews and hosted-site sign-ins working, for the limited PostHog analytics above, and for Impact affiliate measurement. Your browser settings can block or clear these, though some features may then stop working.

How long we keep it, and deletion

We keep your account, content and billing records while your account exists. We have not set fixed retention periods for most data. Previews made before you sign in stop working when they expire.

You can edit your profile, unpublish pages, remove artifacts from your Library, revoke API tokens and disconnect connected accounts in the product. There is no self-serve account deletion yet: to delete your account or permanently delete your content, email paul@iterfact.com from your account email with the subject "Data deletion request". Say whether you want the whole account deleted or only certain artifacts (include their links), and we will do it by hand. Never send passwords, API tokens or card details. If you can't use your account email, say so and we will find another way to confirm it is you. Copies in provider backups and logs can take longer to disappear, and we may keep billing records we are required to keep.

You can also email us to ask for a copy of your data or to correct it. Depending on where you live, you may have other privacy rights; contact us and we will help.

Security

We limit who can read private data and use encrypted connections. No system is perfectly secure. If you think your account or data is at risk, email us.

Children

iterFact is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.

Changes

We will post changes to this policy on this page and update the date at the top.

Contact

For privacy questions or requests, email paul@iterfact.com. To report a hosted page, use the content policy or the DMCA and takedown process.