Privacy Policy.

01What we collect

• Account email. When you sign up, we collect your email address. You authenticate either with a magic link sent to that email or by signing in with Google (OAuth), in which case Google shares your email and basic profile with us. Authentication and your account record are handled by Supabase, our auth and database provider.
• Prompts & conversation content. When you talk to the crew, the prompts and context you send are transmitted to the AI model providers to generate a response (see “Third parties” below). We do not use your prompts or outputs to train any model.
• Usage metadata. For each request we log metadata needed for billing and reliability: the model used, token counts (input, output, cache), computed cost, status, latency, and a timestamp. This is tied to your account so we can meter credits and show you your activity.
• Payment data. Subscriptions are processed by Whop. Whop handles your card and billing details directly. Rax does not receive or store your card information — we only receive confirmation events (e.g. a subscription activated or an invoice paid) so we can credit your balance.

02How we use your data

• To create and secure your account and authenticate you.
• To fulfill your requests by routing prompts to the AI providers.
• To meter usage, deposit subscription credits, and show you your balance and request history.
• To operate, maintain, debug, and protect the Service, and to enforce our Terms and fair-use limits.
• To contact you about your account, billing, or material changes to the Service.

03Third parties we share with

We share only what is necessary for the Service to work, with the following providers:

• Anthropic — receives the prompts you send to Claude models in order to generate responses.
• Moonshot AI (Kimi) — receives the prompts you send to Kimi models (including the free “Rax Default” tier) in order to generate responses.
• Whop — processes subscription payments and handles your card data.
• Supabase — hosts our database and manages authentication, including your account email and usage metadata.
• Vercel — hosts the website and the API that powers the Service.

Your prompts to the model providers are sent to fulfill your requests. Those providers process the data under their own terms and privacy policies. We do not sell or rent your prompts to anyone.

04We do not sell your personal data

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing. The only sharing that happens is with the service providers listed above, strictly to operate the Service.

05Cookies

Rax uses cookies for one purpose: keeping you signed in. The website sets a session cookie so that, once you authenticate, you stay logged in across pages. We do not use advertising, tracking, or third-party analytics cookies. If you block the session cookie, you will not be able to stay signed in.

06Data retention

We keep your account data for as long as your account exists. Usage metadata is retained to support billing, your activity history, and our records. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records (for example, to meet legal or accounting obligations).

07Your rights

You can access the email on file and your recent request history from your dashboard at any time. Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights — including deleting your account and associated data — email us at support@rax-ai.com and we’ll take care of it.

08Security

We use industry-standard measures to protect your data, including encryption in transit, scoped access controls, and row-level security on our database so accounts can only read their own records. No method of transmission or storage is perfectly secure, but we work to keep your information safe and to respond promptly if something goes wrong.

09Children

Rax is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

10Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll revise the “Last updated” date above and, for material changes, make a reasonable effort to notify you.

11Contact

Questions, requests, or concerns about your privacy? Email us at support@rax-ai.com.