Privacy policy
Draft, pending legal review. Last updated 2026-09-24. Bracketed items are still to be filled in.
Who we are
Reliquary is run by Red Mage (Andrés): [to be filled: legal name], [to be filled: legal form], registered in [to be filled: country] under [to be filled: registration number], VAT [to be filled: VAT ID], [to be filled: address]. Contact: andres@redmage.cc.
For your account (your email and sign-in), we are the controller. For what you and your team put in a vault, the vault's owner is the controller and we are their processor under the data processing terms.
What we hold
- Account: your email address and an account id, and the vaults you belong to with your role.
- Vault content: files and their versions, proposals, approvals, comments and notes, which can include personal data your team writes.
- Variables: names and encrypted values, and who may use them.
- Activity: the vault's activity log and the variables access log: who (and which agent or client) did what, when. These are part of the product and you can see them.
- Connections: the AI tools and tokens you authorised, when they were last used, and the client's name.
- Technical logs: our server logs the method, path and response status of each request, never tokens, codes or content. Our hosting provider keeps request logs, including IP addresses, for [to be filled: host log retention].
What we don't do
- No analytics, advertising or tracking cookies, and no third-party scripts.
- We don't train models on your data, sell it or share it beyond the listed sub-processors.
- Nobody at Red Mage reads your content unless you ask us to (for support) or the law requires it.
Why, and on what basis
- To run the service you signed up for: performance of a contract.
- To keep it secure and fix faults (server logs, access logs, refused attempts): our legitimate interest in a secure service.
- To tell you about changes that affect you: contract and legitimate interest. No marketing email without your consent.
Cookies
Only cookies the service needs to work, so no consent banner:
| Cookie | What it's for, and for how long |
|---|---|
rlq_at, rlq_rt | Your signed-in session (an access token and a refresh token). Up to 30 days. |
rlq_pre | Protects the sign-in form while you sign in. One hour. |
rlq_flash | Carries a one-line message to the next page. Five minutes at most. |
rlq_theme | Your light or dark choice, if you made one. One year. |
Where it's stored, and who processes it
The database is in the EU (Frankfurt), and the app runs in Frankfurt. Some providers are US companies whose networks and logs are global; the sub-processor list names each one, what it does and where.
AI tools you connect (Claude, ChatGPT, Cursor and others) receive what their agent reads through your account. They are not our sub-processors: you choose them, and they process that data under your agreement with them.
How long we keep it
- Account data: while you have an account, and deleted when you ask us to close it.
- Vault content: until an owner erases it or deletes the vault. Erasing a file blanks every version at once; deleting a vault removes everything in it at once, keeping only who deleted it, when, and counts.
- The activity log is append-only: it keeps the fact that something happened, but erased content is gone from it.
- Database backups keep deleted data until they age out, after Supabase keeps daily backups for 7 days; the operator also keeps up to 14 off-site copies, in which variable values exist only as ciphertext.
Your rights
You can ask for access to, correction of, or deletion of your personal data, ask us to restrict or stop processing it, and take it with you (vault owners can export a vault themselves). Email andres@redmage.cc. For data in a vault, we'll pass your request to the vault's owner, who decides as controller. You can also complain to a data protection authority; ours is [to be filled: supervisory authority].
Security and breaches
See the security page. If a breach affects your personal data, we'll tell the vault owners and, where required, the authority within 72 hours of becoming aware of it.
Children
Reliquary is a work tool, not meant for anyone under [to be filled: minimum age].
Changes
We'll post changes here with a new date, and email account holders about significant ones.