Data Handling & Retention Policy
What data PsiGuard holds, where it lives, who it is shared with, how long it is kept, and how it is deleted, with retention enforced by the service itself.
1. Principle
PsiGuard keeps the minimum data needed to run the service and show customers their own activity, keeps it only as long as it is useful, and deletes it automatically when that time is up. Retention periods are fixed in the service's code, so they do not depend on anyone remembering to clean up.
2. Data inventory
| Data | What it is | Where it lives | Kept for |
|---|---|---|---|
| Account identity | Email, sign-in method, account identifier; plan and billing status. | Firebase Authentication; Firestore | Life of the account |
| API turn records | For each guarded API call: the prompt, the answer delivered, the key prefix used, timing, and the plain-language readings shown on the Activity page. | Firestore, plus a backup file on the application's persistent disk | 90 days, then deleted automatically |
| Playground history | Turns a signed-in user runs in the browser Playground, so the page can rebuild their session. | Firestore, plus the backup file | Until the user deletes a turn or clears a thread, or the account is deleted |
| PsiGuard API keys | SHA-256 fingerprint and display prefix only (never the key). | Firestore | Until revoked; purged on account deletion |
| Provider keys | A customer's own AI-provider key, if connected. | Firestore, encrypted at rest | Until the customer removes it or deletes the account |
| Payment data | Card details and invoices. | Stripe only | Per Stripe; PsiGuard never holds card numbers |
| Internal monitoring signals | PsiGuard's own structural measurements for each turn. | Our servers only | With the turn record; never exposed externally |
| Operational logs | Server events with account identifiers; a session log of delivered answers and their readings on the application server. | Hosting provider logs; application filesystem | Application-server logs are cleared on each deploy; purged for an account on deletion |
3. Sharing and sub-processors
- To produce a guarded answer, the prompt and conversation context are sent to the AI model provider configured for the account (OpenAI, Anthropic, Google, DeepSeek, xAI, or the customer's own connected model). That provider's terms govern its handling of the request.
- PsiGuard does not use customer prompts or answers to train models, and does not sell or share them with anyone other than the providers needed to run the service.
- The full provider list is maintained on the Security page and in the Privacy Policy. See SEC-01 §6 for how it changes.
4. Retention enforcement
- Every API turn record is stamped with an expiry date 90 days after the turn. A daily sweep in the service deletes expired records from both the database and the backup file; list views additionally hide anything past its expiry even if the sweep has not yet run.
- List views (Activity, admin counts) read only short summaries (a 200-character prompt preview, timing and outcome), never the full record.
- Playground history is under the user's control: individual turns and whole threads can be deleted from the Playground, and deletion removes them from both stores.
5. Account deletion
A customer can delete their account from the Account page by typing a confirmation word. Deletion, in order: cancels any Stripe subscription, deletes all API keys, deletes the account profile, deletes all turn records (API and Playground) from both stores, purges the account's lines from application-server logs, and finally deletes the Firebase identity. If any step fails, the identity is kept so the request can be retried, and the customer is told to contact admin@psiguard.net so it can be completed by hand.
6. Protection in transit and at rest
- All traffic uses HTTPS with HSTS; TLS is terminated at Cloudflare in front of the application.
- Firestore and Firebase Authentication data is encrypted at rest by Google as a platform default.
- Customer provider keys carry an additional layer of application-level encryption (SEC-02 §4).
- The backup file resides on the application's persistent disk inside Render's environment; access is limited to the running application and the Founder's hosting account (SEC-02 §6).
7. Data requests
Customers can see their own API activity on the Activity page and their Playground history in the Playground at any time. Requests to export or erase data beyond the self-service tools, or questions about what is held, go to admin@psiguard.net and are answered by the Founder within 30 days.
PsiGuard is operated by PsiCo, LLC. Questions about this policy: admin@psiguard.net.