Privacy policy
What Trendwright stores, who it is sent to, and how long it is kept. This describes what the software actually does; it is derived from the database schema and the code, not from a template.
Last updated 7 September 2026
Who we are
Trendwright is operated by Arbalest Apps. For anything in this policy, write to garr3ttlc@gmail.com and we will respond within 30 days. You do not need to write to us to delete your account — that is self-service, and covered below.
What we collect
Only what the product needs to run. There is no analytics tracker, no advertising pixel, and no third-party session recorder anywhere in the application.
| Category | What it is | Why |
|---|---|---|
| Account | Email address, display name, the identifier from the identity provider you signed in with, plan, credit balances and billing period. | To identify the account, meter usage and bill it. |
| Site profiles | The URL you give us and everything derived from it: the site's name and a short description, the subject vocabulary its trends are read against, the countries, news queries and assistant topics you set. | This is the product. Every trend pull is read against it. |
| API keys | A name, the visible prefix, a SHA-256 hash of the token, and the spend cap. | To authenticate calls and enforce your caps. The token itself is shown once and never stored. |
| Connected applications | For each application you approve over OAuth: its registered name and redirect URIs, and SHA-256 hashes of the tokens it holds. | To let you see what is connected and revoke it. |
| Usage and call records | Per call: the tool, the site, credits charged and which balance they came from, the outcome, duration and our inference cost. | To bill accurately, and to show you where credits went. |
| Payments | A Stripe customer identifier and the identifiers of webhook events already processed. | To grant credits once and only once. |
What we do not collect
- Card numbers or any payment instrument. Checkout happens on Stripe's own pages and card details never reach our servers.
- Your password. Sign-in is delegated to GitHub or Google through Neon Auth; we never see a credential.
- The full text of any API key, OAuth token or authorization code. Only a SHA-256 hash is written down, so a copy of our database yields nothing usable.
- The trend lists we return. They are sent to the caller and not retained — only the metadata in the table above.
- Anything about visitors to your published site. Trendwright never runs on your site.
Who we send it to
Each of these receives only what its job requires. None of them is paid to profile you, and we sell data to nobody.
| Processor | What it receives | When |
|---|---|---|
| Neon | Everything in the table above. Databases are hosted in the United States (AWS us-east-2). | Always — it is the database. |
| Neon Auth (Stack Auth) | Your email, display name and the identifier from GitHub or Google. | When you sign in. |
| OpenAI | The text of the pages we read from your site. Not your email, account id or billing data. | When a site profile is created or refreshed. |
| Stripe | Your email and what you bought. | When you subscribe or buy credits. |
| Vercel | Ordinary request metadata — IP address, user agent, path — in server logs. | Always — it is the host. |
| Perplexity | Search-style probe queries derived from your site's assistant topics. No account identifier. | On a trend pull, and only if we have configured a key. |
| Public Trends and News RSS feeds are fetched for your chosen countries and news queries. Nothing about you is sent. | On a trend pull. | |
| Your own website | We fetch the URL you give us, as any visitor would. | When a site profile is created or refreshed. |
How long we keep it
We do not run an automatic deletion schedule, and we would rather say so than imply one. What happens is this:
| Record | Retention |
|---|---|
| Authorization codes | Deleted the moment they are redeemed, and unusable after 60 seconds either way. |
| OAuth access tokens | Stop working one hour after issue. Refresh tokens stop working after 30 days, or immediately on use, because they rotate. |
| Revoked API keys and revoked grants | The row is kept and marked revoked rather than deleted, so a key that appears in an old usage record can still be named. |
| Site profiles | Kept until you delete the site. |
| Usage and call records | Kept after a site is deleted, with the link to the site removed. They are the billing history, and deleting a site should not rewrite what it cost. |
| Account | Kept until you delete it. You can do that yourself, from Account in the console, at any time. |
Deleting the account is self-service and immediate. Open Account in the console, type your email address to confirm, and the account is removed along with everything in the table above — site profiles, API keys, connected applications, usage and billing history. Any active subscription is cancelled first, so nothing can keep charging an account that no longer exists, and your sign-in identity is removed too. Nothing is archived and none of it can be restored.
What survives is held by Stripe, not by us: the record of payments already taken, which we are obliged to keep for tax and accounting. If you would rather we did the deletion for you, or you want a copy of your data first, write to garr3ttlc@gmail.com.
Your choices
- Revoke a connected application at any time from API keys in the console. Every token it holds stops working immediately.
- Revoke an API key from the same page, with the same effect.
- Delete a site profile from its page in the console.
- Delete the whole account from Account in the console. It happens immediately and cannot be undone.
- Ask for a copy of your data by writing to us.
Security
- Everything is served over HTTPS, and the database connection is TLS-only.
- Secrets are never stored in a form we can read back: API keys, OAuth tokens and authorization codes are stored as SHA-256 hashes.
- OAuth uses authorization code flow with PKCE and S256 only. There are no client secrets to leak, redirect URIs are matched exactly, and authorization codes are single use.
- Stripe webhooks are verified against the raw request body before a single field is trusted.
Children
Trendwright is a tool for businesses and is not directed at anyone under 16.
Changes
When the software changes what it stores or who it sends it to, this page changes with it and the date at the top moves. Material changes are emailed to account holders before they take effect.
Contact
garr3ttlc@gmail.com — for access requests, deletion requests, or anything else in this policy.