Privacy

Privacy policy

Last updated July 13, 2026.

outfra.ai is operated by Quant-H2 LLC, a California limited liability company ("we", "us"). This policy covers the marketing site on Cloudflare Pages, the alpha account system (Supabase Auth), workbench access, and contact or run-request email. This page is a working draft for an early-stage product. It is not legal advice. Have counsel review it before you rely on it for production sales or EU traffic.

What we collect

What we collect depends on how you use the site:

If you just browse — routine edge and origin access logs (IP address, user agent, URL, timestamp, and similar request metadata), kept for security, abuse prevention, and reliability. We do not use browse-only logs to build advertising profiles.
If you create an account — your email address. If you sign in with Google or GitHub, we receive the name, email, and avatar those providers share. If you use email and password, Supabase stores a password hash. We never see your password in plain text.
If you're granted alpha access — an access-status flag on your account (app_metadata.status), optional admin role (app_metadata.role), and build or configuration data you create in the workbench so you can return to it.
If you send a run request or email us — your email address and whatever you include (workload, power budget, form factor, environment, or other message content).
Bot and abuse checks — when Cloudflare Turnstile or bot products are enabled, Cloudflare may process short-lived challenge signals needed to tell humans from automated clients.
Product analytics — first-party only. We record which pages and steps you reach, when a design run starts, completes, or fails, and whether you view the 3D model or export a bill of materials. Each record carries a session id that lives only until you close the tab, your account id when you are signed in, an id for the design run, the page path, and the version of our code and parts catalog that produced the result. No third-party analytics script is loaded — not PostHog, not Google Analytics, not Cloudflare Web Analytics — and none of this leaves our own infrastructure. We do not set an analytics cookie and we do not track you across sites or between visits. You can turn it off; see Cookies and local storage.
Optional hardware benchmark bundle — if you opt in, you run documented local commands on your machine and may upload a JSON file you produced. The MVP collects inventory and an optional live usage snapshot. We do not mine a month of OS history after the fact. Without a forward sample, any personalized scores use that snapshot plus a disclosed population-average baseline. See docs / runbook user-benchmark-bundle in the repo. Nothing leaves your machine until you choose to share the file.

How we use it

We use this information to operate accounts and alpha access, respond to run requests and email, keep the site secure and available, enforce invite and admin gates, and improve the product. If we add paid hardware or software checkout, we will use order information to fulfill and support that order, and we will update this policy before that goes live.

Processors and service providers

We do not sell your personal information. We use processors that only see what they need to provide their service:

Cloudflare, Inc. — CDN, DNS, DDoS and bot protection, Pages hosting, and optional Turnstile. May set strictly necessary security cookies such as __cf_bm or cf_clearance. See Cloudflare's cookie documentation.
Supabase — authentication (GoTrue), account records, and related session storage for signed-in users.
Amazon Web Services (AWS) — backend API, jobs, and data stores used by the platform when those services are enabled for your environment.
Google / GitHub — OAuth sign-in when you choose those providers. We only receive the profile fields noted above.
Email delivery — transactional mail (for example confirmation or invite messages) when SMTP is configured. Owner-alert mail from the edge Worker is sent via Amazon SES. Auth confirmation/reset mail uses whatever SMTP is configured on Supabase Auth for that environment (moving to SES; see the auth-email runbook in the repo). We do not use email for marketing.
A future payment processor — not in use yet. Before checkout goes live, we will name the processor and describe what it sees.

We may also disclose information if required by law, or to protect the security of the site and our users.

Cookies and local storage

We don't run a cookie-preference banner, and our product analytics is why that is still honest rather than convenient. It sets no cookie and creates no durable identifier: the only id in your browser is a random session id held in sessionStorage, which the browser discards when you close the tab, so we cannot recognise you on a later visit. Nothing is sent to a third party. If we ever add a durable identifier or a third-party analytics tag, we will introduce a consent mechanism before it loads and describe it here.

When you create an account you accept our Terms, which cover analytics tied to that account. If we materially change those terms, we will email you and make it straightforward to review and accept the new version.

Categories today:

Strictly necessary — always on. Auth session, edge access cookie, Cloudflare security cookies, related local storage, and error reports (a page that breaks has to be reportable, or we cannot fix it).
Product analytics — on, first-party, no cookie, no cross-site or cross-visit tracking. To turn it off: enable Global Privacy Control in your browser (we honour it), or use the analytics toggle in Settings. Turning it off stops product measurement; error reports still run, since those are what tell us the site is broken.

First-party storage the site sets:

Name	Type	Purpose	Duration
outfra_at	Cookie	Signed-in access token for edge gates on workbench and admin paths.	Matches session; cleared on sign-out.
outfra.cid	sessionStorage	Random session id used to group your activity within one visit, and to match an error report to the request that caused it. Not a cookie, and never linked across visits.	Until you close the tab.
outfra.analytics.optout	localStorage	Set to `1` when you turn product analytics off, so the choice persists.	Until you turn it back on or clear site data.
outfra.sb_session	localStorage	Supabase access and refresh tokens when live auth is configured.	Until sign-out or revoke.
outfra.session	localStorage	Local stub session when Supabase keys are not configured.	Until sign-out.
outfra.alpha_approved	localStorage	Client cache of alpha approval for UI gating.	Until access status changes.
outfra.returning	localStorage	Remembers a prior sign-in on this browser for login copy.	Until site data is cleared.
outfra.auth_error	sessionStorage	One-shot sign-in error across a redirect.	Cleared after display or tab close.
outfra.login_draft_email	sessionStorage	Email draft on the login form. Passwords are never stored.	Cleared after email sign-in or tab close.
outfra.revealed	sessionStorage	Tracks which page sections already animated this session.	Cleared when the tab closes.

Cloudflare may also set processor cookies such as __cf_bm (bot management, typically about 30 minutes) and cf_clearance (after a challenge). Those are security cookies set by Cloudflare, not advertising cookies. Details: Cloudflare cookies.

Retention

Account data is kept while the account is active and for a reasonable period after closure for security, dispute, and legal compliance. Contact and run-request email is kept as long as needed to respond and for ordinary business records. Edge and security logs are retained according to Cloudflare and AWS defaults for the environment, typically on the order of days to weeks unless a longer window is required for an incident. Workbench project data is kept until you delete it or we close the alpha program and notify you. Product-analytics records are kept for up to 400 days — a full year plus a month, so one period can be compared against the same period a year earlier. Deleting your account removes your account id from those records, leaving them anonymous rather than linked to you. When data is no longer needed, we delete or anonymize it.

Your rights and regional notices

outfra.ai is intended for users in the United States and Canada. We are not currently structured to serve the EU or UK under GDPR or ePrivacy. If you are outside the US or Canada, do not create an account until we expand this policy.

Self-serve export and deletion

If you have an account, the fastest way to review or remove your data is to do it yourself. Sign in and open the Data & privacy section of account settings, where you can:

Download your data — a full export of what we hold on you: your identity record, account metadata, and the build and configuration data you created in the workbench.
Delete your account — removes your account and the data tied to it, subject to the retention notes above (for example security logs on their normal schedule).

If you can't sign in — say you've lost access to your email or OAuth provider — email contact@outfra.ai from an address you can verify and we will handle the request manually.

California residents (CCPA/CPRA)

Depending on revenue and data volume, California's privacy law may or may not formally apply yet. We still offer these rights. California residents may ask us to disclose, delete, or correct personal information we hold. The self-serve tools above cover disclosure (the export) and deletion directly. For corrections, or if you can't sign in, email contact@outfra.ai. We do not sell or share personal information for cross-context behavioral advertising today, so a "Do Not Sell or Share" link is not required for that purpose. If that changes, we will add the link and honor Global Privacy Control where required.

Canada (PIPEDA)

For users in Canada, we collect and use personal information for the purposes in this policy, with consent shown by creating an account or contacting us. You may see what we hold or delete it yourself with the self-serve tools above, or email us below if you can't sign in.

Children's privacy

outfra.ai is not directed at children under 13. We do not knowingly collect personal information from them. If you believe a child has created an account or sent us information, email us and we will delete it.

Security

We use HTTPS, processor access controls, and least-privilege service roles where configured. No method of storage or transmission is completely secure. We cannot guarantee absolute security.

Changes to this policy

If collection changes materially (analytics going live, checkout, new processors), we will update this page in plain language and refresh the date at the top before that change ships.

Questions

Email contact@outfra.ai.