Legal

Privacy Policy

Last updated 9 October 2026

This policy covers the website at provenrail.com and its subdomains. It is written to be read, not to hide behind. The short version: the Provenrail software is self-hosted, so the records it produces never reach us, and the website itself collects only what it needs to run.

The software does not send us your records

Provenrail is distributed as open-source software that you run on your own infrastructure. The audit records your agents produce go to a sink you operate. We do not receive, store, or have any access to those records or their contents. When you self-host, you are the data controller for your own data; we are not a processor of it.

The phone remote sends question text to the service you choose

This applies only if you set up the phone remote yourself with pr remote setup. Messages are then sent from your machine to Telegram, through a bot you created, or to the ntfy server you chose (ntfy.sh or your own). A message is sent when a tool call needs a human, when a call is refused, and in reply to a status, stop or resume command you send. It contains the rule id and its reason, the tool name, the agent host, the name of the project folder and, by default, up to 600 characters of the shell command, or the file path or URL for other tools. With pr remote config --detail shape a shell command is reduced to its verb and flags; file paths and URLs are still sent. Your machine also polls that service for your answers and commands. Provenrail operates no server in that path and receives none of it.

You choose that service and use it under its own terms and privacy policy. Telegram and ntfy are not our processors or sub-processors; we have no contract with them on your behalf, and for anything personal in those messages you are the controller. Messages are not end-to-end encrypted: the service operator can read them, and ntfy servers hold messages for a period so a phone can catch up. On ntfy the topic name is the only secret, so anyone who learns it can read questions and answer them. Run your own ntfy server, or use the shape setting, if a command may contain something sensitive.

The 14-day evaluation is counted from a date stored in ~/.provenrail/remote.json on your machine, and a licence key is verified on your machine against a public key shipped in the package. Neither contacts us.

Checkpoints, file lanes, loop state and the stop file are stored locally under ~/.provenrail and are never transmitted.

Anchoring

Only if you run pr anchor-push. We receive a stream label you chose, a 32-byte fingerprint and a record count, authenticated by your licence key, which is linked to your account. We store them with an RFC 3161 timestamp from a public authority (or, if that authority is unreachable, a self-signed receipt that is marked as such) and publish the label, fingerprint, count and time at a public URL that anyone holding the anchor id can read. Do not put personal data in a stream label. No record content is sent.

What the website collects

• Server logs. Like any website, our host records standard request metadata (IP address, user agent, timestamp, requested URL) to operate the site, prevent abuse, and diagnose problems. These logs are retained for a short period and then discarded.
• The verifier. The /verify page runs entirely in your browser. Your bundle is never transmitted to our servers; verification is computed locally on your device, and we never receive or store it.
• No advertising trackers. We do not sell personal data and do not embed third-party advertising or cross-site tracking pixels.

When you create an account

If you sign in at /account, we create an account so you can manage a subscription and your commercial license key. For this we store your email address and your plan and subscription status. We do not store passwords: you sign in with GitHub, Google, or a one-time email link. If you choose GitHub or Google, that provider confirms your identity and shares your email address with us; we do not receive your password or post on your behalf. We never store, receive, or have access to the audit records your agents produce. Those remain on infrastructure you operate.

Who processes this data for us

• Supabase hosts authentication and the account database (your email, plan, subscription status, license key). Data is stored in the EU (Frankfurt). Supabase acts as our processor under a data processing agreement.
• GitHub and Google are optional sign-in providers. If you use one, it authenticates you and returns your email address and a unique identifier so we can match your account. We request only your basic profile and email.
• Brevo (Sendinblue, France) delivers the emails our account system sends you: the sign-in link and the address-confirmation message. It processes your email address for that delivery. Brevo also counts opens and clicks on these emails, using a tracking pixel and by routing the link through a Brevo domain before it reaches us. We have set that counting to anonymous, so it is not linked to you as an individual, and Brevo offers no way to switch it off entirely on this kind of email. We are moving these messages to a provider that does, and will update this page when that is done. In the meantime, signing in with GitHub or Google sends no email at all.
• Polar handles payments and subscriptions as the Merchant of Record. When you subscribe, Polar is the seller and processes your billing details and applicable tax; we never see or store your card data. Polar shares back only your subscription status and a customer reference.
• Cloudflare serves this website and is the edge network referred to below. As the host it necessarily handles the connection itself, including your IP address, to deliver the page; we do not receive or store that address. It is also what tells us the two-letter country recorded with a page view, and nothing more precise than that.

We do not use this data for advertising and do not sell it.

Cookies and local storage

This site sets no cookies, and uses no advertising or cross-site tracking. When you sign in on the account page, your session is kept in your browser's local storage for the single purpose of keeping you signed in. It is never sent to advertisers or third parties, and it is cleared when you sign out. Because we use only this strictly necessary mechanism and no tracking, no cookie consent banner is required.

Site analytics

We count page views and clicks on our own buttons so we can tell which pages are useful. This is first-party and deliberately minimal. For each view we store only: the page path (without any query string), the host of the referring site (never the full referring URL), a utm_source value if one is present in the link you followed, your country as reported by our edge network, whether your screen is phone-sized or larger, and the time.

We do not store your IP address, do not set any cookie or local-storage value for analytics, and do not create any device fingerprint, visitor identifier, or cross-site identifier. There is nothing in this data that identifies you or links two of your visits together, so it does not constitute personal data and no consent banner is required for it. The data is stored on our own infrastructure in the EU and is never sold or shared. We use no third-party analytics provider.

Loading a page on this site makes no request to any third party. Fonts, styles, scripts and images are all served from our own domain: there is no font host, no script CDN and no tag manager, so your IP address is never disclosed to one. The only network calls a page makes beyond fetching itself go to our own backend, which is the Supabase infrastructure listed above, for the account page and for the pageview count described here.

Email you send us

If you email us, we keep that correspondence to reply and for our records. We do not add you to a marketing list without your consent.

Your rights

If you are in the EU/EEA or UK, you have rights to access, correct, or erase personal data we hold about you, and to object to or restrict its processing. To exercise them, email [email protected]. We respond to legitimate requests within the statutory timeframe.

The data controller is the operator of Provenrail, a sole trader registered under individual activity (individuali veikla) in Lithuania. For any data-protection matter, including a request to identify the controller, contact [email protected]. This policy is governed by the laws of the Republic of Lithuania. Your GDPR (or UK GDPR) rights above apply regardless, and you may lodge a complaint with your local data protection authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt.

Changes

If this policy changes materially, we will update the date above and, where appropriate, note the change on this page.

Contact

Questions about privacy: [email protected].