Privacy Policy

Last updated: [DATE — set on publication]. Controller: LandveX AB, organisation number 559141-7042, Åvägen 9, 135 49 Tyresö, Sweden. Contact: [support@metastance.app — do not publish until the mailbox is monitored].

Metastance is built to know as little about you as possible. This policy describes exactly what we process, why, and what we never do.

What we store

| Data | Purpose | Kept until | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | Email address | Your account | Account deletion | | A hash of your password | Signing you in | Account deletion | | When you last signed in, and whether you have confirmed your address | Answering "was this account used since?" if a credential is ever compromised | Account deletion | | Subscription status (free/active) | Unlocking Premium | Account deletion | | Message counters and their reset date | Free-tier limits and abuse prevention | Account deletion | | A count of completed free analyses | Knowing when the free tier is used up | Account deletion | | Your saved conversations | Letting you return to them | 365 days after the last message, or when you delete them | | Your preferences: what you told us brings you here, how familiar you are with the method, how you like to be worked with, and anything you asked us to steer away from | Calibrating how the tutor talks with you. Shown in full on your settings page; that page is the whole of what it remembers | Until you clear them, or account deletion | | Your saved insights: the sentences you chose to keep from a conversation | Letting you return to them | Until you delete them, or account deletion | | A random device identifier (guests only) | Letting you chat before creating an account | 90 days after your last message | | Your signed-in sessions, and the browser or app name each was created from | Letting you sign out, and letting you recognise a session that is not yours | 7 days after the session ends | | Single-use links for confirming your address or resetting your password | Account recovery | 7 days after the link is used or expires | | Counts of recent requests, against a one-way hash of your network address or email | Stopping abuse, and stopping someone using this product to send you mail | 2 hours | | Which App Store or Google Play subscription belongs to your account: the store's identifier for it, never your payment details | Making sure a subscription you paid for unlocks your account and nobody else's | Until account deletion | | A record of account and subscription changes: what happened, when, to which account, what the status was before and after, and which version of our software was running | Answering "when did this change, and what changed it" if something goes wrong with an account or a payment | 400 days, and the link to your account is removed the moment you delete it | | Your learning record: which lessons you opened and finished, and which version of each you studied | Letting you pick up where you left off, and answering "what did this lesson say when I learned it" after it is rewritten | Until account deletion | | Your answers: for each question, which one it was, whether you got it right, how hard it was, how long you took, and which misunderstanding a wrong option pointed at. Not what you wrote — an open answer is stored as a mark, never as text | Deciding what to teach next, what to bring back for review, and which misunderstanding to address | Until account deletion | | What the product concluded from those answers: a score per concept, when it falls due for review, and which misunderstandings are still open | Scheduling review before you forget, rather than at random | Until account deletion | | Your diagnostic, exam and readiness results: the placement a diagnostic produced, the score and verdict of each exam, and a readiness snapshot over time | Placing you in the curriculum and showing you movement across months | Until account deletion | | Reports you send about a question: which question, what kind of problem, and anything you wrote about it | Fixing the material. Every question is a draft and you are the first person likely to notice a broken one | Until account deletion | | Your practice on a case: which case, how many of its targets your reading met, and when. Not what you wrote — what you type on a case reaches the tutor to be coached on and is stored nowhere; there is no column for it | Letting you read a case again after a lesson and see what you notice the second time | Until account deletion | | A one-way hash of a retry key you send when buying, with the answer we gave | Making sure a purchase that is retried is not charged or opened twice | 24 hours | | Your saved simulations: the assumptions you entered, any names, notes and sources you wrote on them, and the summary results of each run | Letting you return to a model you built and compare it against a later version | 365 days after you last changed one, or when you delete them |

The record of account changes never contains anything you wrote. It holds the fact that something happened — an account was created, a password was reset, a subscription went from free to active — and never a message, a conversation title, or an email. When you delete your account, the rows stay but stop naming you: what remains is that a deletion happened on a date, with nothing that points back to you.

That is the complete list. We do not collect names, birthdays, locations, contacts, photos, advertising identifiers, or analytics profiles.

Two of those rows are new and worth being explicit about, because we own the sign-in now rather than delegating it:

• We never store your password. What is stored is a slow one-way hash of it. Nobody at Metastance can read your password, and a copy of our database would not give anyone your password either.
• We never store a working session token or a working reset link. Only their hashes. Signing out revokes the session on our side rather than just forgetting it in your browser, so a token somebody copied stops working.

Your conversations

This is the part worth reading closely, because it changed.

• Signed in, your conversations are saved. That is what makes history, reopening and renaming possible. They are stored so you can come back to them, and for no other purpose.
• As a guest, they are not. If you have not signed in, nothing you type is written to our servers — it stays in your browser and is gone when you close the tab. Signing in is the moment your conversations start being kept.
• A saved conversation is deleted 365 days after its last message. You can delete any conversation yourself at any time, which removes it immediately.
• To generate each reply, the conversation is sent over encrypted connections through Vercel's AI Gateway to Anthropic, the company whose AI model writes the reply. Both act as data processors. Our requests are pinned to Anthropic itself, so no other AI company receives them, and they are sent with prompt training refused: your conversations are not used to train AI models.
• We never use your conversations for advertising, profiling, or training of any kind, and no human at Metastance reads them as a matter of course.
• Error logs and usage logs never contain message content. We record that a reply happened, which model produced it, how long it took and how many tokens it cost — never what was said.

Your simulations

Metastance includes a tool for modelling an uncertain decision: you describe what you are unsure about as ranges rather than single numbers, and it runs the arithmetic thousands of times to show the spread of outcomes.

• A saved simulation is deleted 365 days after you last changed it. You can delete one yourself at any time, which removes it and all of its results immediately.
• What is stored is your assumptions and the summary of each run — the averages, the percentiles, the chart data. The individual simulated outcomes, of which there can be millions, are never written down; they are computed, summarised and discarded.
• A simulation is arithmetic, and none of it is sent to an AI provider. It runs entirely on our own servers.
• The record of account changes notes that a simulation was created or run, along with which model, how many iterations and which random seed — never the names, notes or sources you wrote on it.

Payments

Purchases are handled entirely by Apple (App Store), Google (Google Play) or Stripe (on the web). We never see your card details — only confirmation of payment and your resulting subscription status.

Who processes data for us

These companies process personal data on our behalf, only to provide the service, under their data processing terms:

| Provider | What for | Where | | ----------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------- | | Vercel Inc. | Hosting the website and running our backend; the AI Gateway (see above) | Our backend runs in Frankfurt, Germany; Vercel is in the United States | | Neon (Databricks, Inc.) | The database | Frankfurt, Germany | | Anthropic PBC | Writing replies in conversations and practice coaching, reached through Vercel | United States | | Resend (Plus Five Five, Inc.) | Sending account email (address confirmation, password reset) | Sent from Resend's EU region (Ireland); Resend is in the United States |

Apple, Google and Stripe handle payments as described above.

All four are US companies. Where they process personal data outside the EU and EEA, the transfer is covered by the EU Standard Contractual Clauses in their data processing agreements and, where the provider is certified, by the EU–US Data Privacy Framework. The agreements are Vercel's (vercel.com/legal/dpa), Neon's (neon.com/pdf/DPA.pdf) and Resend's (resend.com/legal/dpa). Anthropic is reached through Vercel's AI Gateway, so Vercel's agreement covers that step.

Legal bases (GDPR)

• Performance of contract — providing the service you signed up for, including saving your conversations so you can return to them.
• Legitimate interest — preventing abuse of the free tier.

Your rights

You can access, correct, export, or erase your data at any time.

• Export — Account → Export my data returns everything in the table above, including the full text of your saved conversations, as a single file.
• Delete a conversation — removes it and its messages immediately.
• Sign out everywhere — changing your password ends every session on the account, including any you did not recognise. That is the point of doing it.
• Delete your account — Account → Delete account permanently removes everything in the table above, conversations included. The one exception is the record of account changes, described above: those rows stay, and stop naming you. We keep the fact that a deletion happened; we do not keep who.

Cancel an active subscription in your App Store, Google Play or Stripe settings — deleting the account does not cancel the subscription. For anything else, contact [support@metastance.app]. You may also lodge a complaint with your supervisory authority (in Sweden: IMY).

Security

All traffic is encrypted (HTTPS). Authentication is our own: passwords are hashed with scrypt, deliberately slowly, and sessions are random tokens stored only as hashes and revocable the moment you sign out. The database is hosted by Neon in Frankfurt, in the EU. It accepts only encrypted connections (TLS), authenticated with a long random password that only our backend holds.

Stored data is encrypted at rest with AES-256 by our database provider, Neon.

Being precise about what that protects: encryption at rest protects the stored data and its backups from anyone who obtains the underlying disks or snapshots. It does not make your conversations unreadable to us. We could read them; we do not, and nothing in the product is built to.

Changes

If this policy changes materially, we will tell you before the change takes effect. The move from not storing conversations to storing them was such a change.