Privacy policy
Who we are
Reliquary is run by Red Mage (Andrés): Memento Vivre Fine Arts LLC, doing business as Red Mage, a single-member limited liability company registered in Colorado, United States under ID 20238181121, 1500 N Grant St, Ste R, Denver, CO 80203, United States. Contact: andres@redmage.cc.
For your account (your email and sign-in), we are the controller. For what you and your team put in a vault, the vault's owner is the controller and we are their processor under the data processing terms.
What we hold
- Account: your email address and an account id, the vaults you belong to with your role, and which version of these terms and this policy you accepted at sign-in, and when.
- Access requests: the email address, name, country and note you send with Request access. The service emails them to us and doesn't store them; we keep the email while we arrange your access.
- Vault content: files and their versions, proposals, approvals, comments and notes, which can include personal data your team writes.
- Variables: names and encrypted values, and who may use them.
- Activity: the vault's activity log and the variables access log: who (and which agent or client) did what, when. These are part of the product and you can see them.
- Connections: the AI tools and tokens you authorised, when they were last used, and the client's name.
- Technical logs: our server logs the method, path and response status of each request, never tokens, codes or content. Our hosting provider keeps request logs, including IP addresses, for as long as Netlify’s own privacy policy allows (it publishes no fixed period).
What we don't do
- No analytics, advertising or tracking cookies, and no third-party scripts.
- We don't train models on your data, sell it or share it beyond the listed sub-processors, except as Requests from authorities says. We don't share personal information with anyone for their direct marketing.
- Nobody at Red Mage looks at your content except in the cases the terms list: to help you when you ask, to investigate a security problem, abuse or a legal notice, to fix a fault, or when the law requires it.
- We don't track you across sites, so a Do Not Track or Global Privacy Control signal changes nothing here. If your browser sends one, we treat it as a request not to sell or share your data, which we never do anyway.
Requests from authorities
We give data to the authorities only when a valid US legal order compels us, or in an emergency involving a risk to someone's life, and we tell the vault's owners first unless the law forbids it. If Reliquary is ever transferred to another company, this policy keeps applying to your data.
Why we use it
- To run the service you signed up for.
- To answer an access request.
- To keep it secure and fix faults (server logs, access logs, refused attempts).
- To tell you about changes that affect you. No marketing email without your consent.
Cookies
Only cookies the service needs to work, so no consent banner:
| Cookie | What it's for, and for how long |
|---|---|
rlq_at, rlq_rt | Your signed-in session (an access token and a refresh token). Up to 30 days. |
rlq_pre | Protects the sign-in form while you sign in. One hour. |
rlq_flash | Carries a one-line message to the next page. Five minutes at most. |
rlq_theme | Your light or dark choice, if you made one. One year. |
Where it's stored, and who processes it
The database is in the EU (Frankfurt). The app itself runs in the United States (Netlify), so your requests and what they carry are processed there. Some providers are US companies whose networks and logs are global; the sub-processor list names each one, what it does and where.
Email (sign-in codes and links, account notices, vault invitations and access requests) is sent through Resend, a US company: it receives the recipient's address and the message, sends it from the EU, and keeps delivery records in the US for 30 days.
AI tools you connect (Claude, ChatGPT, Cursor and others) receive what their agent reads through your account. They are not our sub-processors: you choose them, and they process that data under your agreement with them.
How long we keep it
- Account data: while you have an account. Deleting your account (on Account settings, or by asking us) deletes your email address, display name, plan, sign-in and record of accepting the terms at once. The logs of vaults you were in keep a random account id, shown as "a deleted account", never your address.
- Vault content: until an owner erases it or deletes the vault. Erasing a file blanks every version at once; deleting a vault removes everything in it at once, keeping only who deleted it, when, and counts.
- The activity log is append-only: it keeps the fact that something happened, but erased content is gone from it.
- Sent email: our email provider keeps each message's record (address, subject, delivery status) for 30 days.
- Access requests: we delete the email within 90 days of arranging or turning down your access.
- Our own server logs: our hosting provider deletes them within 7 days.
- Database backups keep deleted data until they age out, after Supabase keeps daily backups for 7 days; the operator also keeps up to 14 off-site copies, in which variable values exist only as ciphertext.
Your rights
You can change your email address and delete your account yourself, on Account settings. You can also ask for access to, correction of, or deletion of your personal data, ask us to restrict or stop processing it, and take it with you (vault owners can export a vault themselves). Email andres@redmage.cc. For data in a vault, we'll pass your request to the vault's owner, who decides as controller.
US state privacy rights
Residents of California, Colorado, Virginia, Connecticut and other states with privacy laws have these rights, and we give them to everyone:
- We don't sell your personal information, share it for cross-context behavioral advertising, or use it for profiling that has legal or similar effects.
- What we collect, by category: identifiers (email address, account id, IP address in host logs), internet activity (the request and access logs above), and what you write in vaults. Sources: you, your team, and the AI tools you connect. Who receives it: the sub-processors, for the purposes above.
- You can ask to know, access, correct or delete your personal information, and get a copy you can take with you. Email andres@redmage.cc; we answer within 45 days (or tell you within that time if we need 45 more) and confirm who you are by your account's email address. Someone you authorise can ask for you.
- We won't treat you differently for using these rights. If we turn a request down, reply to say so and we'll review it again; if that doesn't settle it, you can contact your state's attorney general.
Security and breaches
See the security page. If a breach affects your personal data, we'll tell the vault owners without undue delay, and tell you and the authorities as the law where you live requires, within 30 days at most.
Children
Reliquary is a work tool for people 18 and over. If we learn an account belongs to someone younger, we close it and delete its personal data. We don't knowingly collect personal information from children under 13; if you believe we have, email andres@redmage.cc and we'll delete it.
If you're in the EU, EEA, UK or Switzerland
The alpha is offered in the United States and outside Europe first. We're not yet set up for people in the EU, EEA, UK or Switzerland, so please request access rather than signing up, and we'll tell you when we are. What follows is what will apply then.
- Controller: Red Mage, as above. For vault content, the vault's owner is the controller and we are their processor (data processing terms).
- Legal bases: running the service and answering an access request, performance of a contract (or steps you asked for before one); security, fault-fixing and telling you about changes, our legitimate interest; marketing email, only your consent.
- Your rights under the GDPR: access, correction, erasure, restriction, objection and portability, as in Your rights above, and to withdraw consent at any time.
- Representatives (Article 27): we'll appoint one in the EU and one in the UK, and name them here, before Reliquary is offered there.
- Data protection authority: you can complain to the authority where you live or work.
- Transfers: the database is in the EU; the app and some sub-processors are in the United States. Before Reliquary is offered there, this names the safeguard each transfer relies on.
- Breaches: we'll tell the authority within 72 hours of becoming aware of one that affects you, where the GDPR requires it.
Changes
This policy took effect on 2026-10-18. We'll post changes here with a new date, and email account holders about significant ones at least 30 days before they take effect.