Privacy Policy

We collect as little as we can. When you sign in, we keep your name, email and account ID from Tendril Terminal. Every request runs on our own AI provider keys, which never reach your browser. We never ask for your own key or store one. If you use the free trial (without an active subscription), we count your uses against your internet address and forget them after 90 days. The code, notes and drafts you put into the tools go to Anthropic or OpenAI to be processed and are not stored by us. We set one cookie, to keep you signed in. We do not run analytics, we do not advertise, we do not sell or share your data for marketing, and we do not train AI models on your content.

The rest of this page says the same thing in full.

1. Who We Are

The Dino Detective Agency (the "Service") is run by Aurelia Intelligence Corporation, trading as Aurelia Intelligence Co., a corporation registered in Wyoming, United States ("we", "us"). For the purposes of the EU and UK General Data Protection Regulation, we are the controller of the personal data described on this page.

Contact for anything on this page: aureliaintelligencecorp@gmail.com.

2. What We Collect, and Why

We collect different things depending on how you use the Service.

If you use the free trial

• Your internet address (IP address), a count of the spins you have used on our key (a spin is one answer from a dino), and the time of your first and latest request. Subscribers have full access and are not counted; anyone else, signed in or not, is. Why: to give everyone without a subscription the same number of free spins and to prevent abuse of the trial. People who share an internet address, such as an office or a household, share one trial. Legal basis (EU/UK): our legitimate interest in running a fair, affordable trial and protecting the Service from abuse.

If you sign in with a DinoPass

Signing in happens at Tendril Terminal, a separate service run by Aurelia Intelligence Corporation under its own privacy policy. When you sign in, Tendril Terminal tells us:

• Your Tendril Terminal account ID, your name and your email address. Your name and email are shown to you on your Settings page. Why: to create your account with us, keep your settings and recognise you when you return. Legal basis: performance of our contract with you (the Terms of Service).
• Whether your subscription is active. We check this each time you sign in and keep the answer only in your session for that visit. Why: to give subscribers full access and everyone else the free trial. Legal basis: performance of our contract with you.

When you open a tool while signed in, we also create a sign-in code: a random, single-use code that carries your sign-in into the tool. It lasts at most five minutes and is deleted once used or expired. Legal basis: performance of our contract with you.

Everyone

• One session cookie. See section 9. Legal basis: strictly necessary to provide the Service; no consent is needed for essential cookies.
• Server and hosting logs. Our hosting provider records each request (internet address, time, page requested, browser type) for a short period to keep the Service running and secure. Legal basis: our legitimate interest in security and operation.
• Email you send us. If you write to us, we keep the correspondence for as long as needed to answer you and keep a record. Legal basis: our legitimate interest in responding to you.

The content you put into the tools

The code, files, notes, drafts and voice instructions you enter into Diffasaurus, Analysaurus or Notosaurus (your "Content") are sent to our AI provider, Anthropic or OpenAI, to be processed, and the result is sent back to your browser. We do not store your Content on our servers. It passes through our server on its way to the provider and is not written to our database or logs. Files you save, download or export from the tools go to your own computer. When Analysaurus builds a PDF or Markdown file for you, the analysis passes through our server to be formatted and is not kept.

Your Content may include personal data about other people (a customer list in a file, names in your notes). You are responsible for having the right to process that data; see the Terms of Service.

3. What Stays on Your Device

Some things are kept only in your own browser, never on our servers:

• Voices you save in Notosaurus.
• When you send code from Diffasaurus to Analysaurus, a copy kept in that browser tab so the second tool can open it. It is gone when you close the tab.

None of this is sent to us. You can remove it at any time: delete voices in Notosaurus, or clear your browser's data for this site. Because this storage is something you ask for and the features need it to work, we do not ask for separate consent.

4. What We Do Not Do

• No analytics, no tracking. There are no analytics scripts, tracking pixels, fingerprinting or advertising trackers on any page.
• No advertising. We show no ads and give no data to advertisers.
• No selling or sharing for marketing. We have never sold personal data and do not share it for cross-context behavioural advertising. Under US state privacy laws, we do not "sell" or "share" personal data.
• No AI training on your Content. We do not train models on anything you enter. Under their published API terms, neither OpenAI nor Anthropic uses API inputs or outputs to train their models either.
• No profiling and no automated decisions with legal or similarly significant effects. The only automated rules are the free-trial counter and the check of whether your subscription is active, which together decide how many free spins you have and nothing else.
• No marketing email. We only email you if you email us first or if we must tell you something about your account or this policy.

5. Who We Share Personal Data With

We share personal data only with the service providers below, each of which processes it on our instructions or under its own terms as described.

• OpenAI (OpenAI, L.L.C.), United States. Your Content, to generate the responses you ask for, sent under our account.
• Anthropic (Anthropic, PBC), United States. The same as OpenAI, for requests Anthropic answers.
• Heroku (Salesforce, Inc.), United States. Everything we store, and request logs, to host our application and database.
• Tendril Terminal (Aurelia Intelligence Corporation), United States. Your sign-in, to sign you in and tell us whether your subscription is active. Tendril Terminal never receives your usage or your Content.
• Content delivery networks your browser uses: Tailwind (cdn.tailwindcss.com), cdnjs (Cloudflare) and Google Fonts (fonts.googleapis.com, fonts.gstatic.com), in the United States and worldwide. They receive your internet address and browser details when your browser fetches a script, font or icon.

The content delivery networks are a normal part of how a web page loads, but they do mean those companies see your internet address. We intend to serve fonts from our own server in a future release so that Google Fonts is no longer loaded.

We may also disclose personal data if the law requires it, to protect the rights and safety of users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply to the data until you are told otherwise.

6. International Transfers

We are in the United States and the Service is hosted there. If you use it from the European Economic Area, the United Kingdom, Switzerland or elsewhere, your personal data is transferred to and processed in the United States, where privacy law differs from your own.

Where we transfer personal data from the EEA, UK or Switzerland to our providers, we rely on their certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) where they hold it, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with the technical measures in section 8.

7. How Long We Keep Things

• Free-trial usage (internet address, count, times): 90 days from your latest request, then deleted, usually within a day of that.
• Account (ID, name, email): while your account exists. Deleted within 30 days of your request.
• Sign-in codes: five minutes at most.
• API keys: we never ask for or store yours.
• Session cookie and session record (who is signed in, and whether your subscription is active): 24 hours, or until you sign out.
• Hosting and request logs: a short rolling period set by our host, typically days to a few weeks.
• Your Content: not stored by us. Providers may retain API data briefly for abuse monitoring under their own policies.
• Email correspondence: as long as needed to answer you and keep a reasonable record.

8. Security

Our own provider keys are kept in our host's encrypted configuration, never in our code, our logs or your browser. The session cookie is marked HttpOnly and Secure and is restricted to same-site requests. All traffic between your browser and the Service uses HTTPS. Database access is scoped so that each account can only reach its own rows.

No system is perfectly secure. If we learn of a breach affecting your personal data, we will tell you and any regulator we are required to notify without undue delay.

9. Cookies

We set one cookie, a session identifier, so that you stay signed in as you move between pages. It is strictly necessary for the Service, lasts 24 hours or until you sign out, and contains no personal data itself. We set no analytics, advertising or third-party cookies. Because the only cookie is essential, there is no cookie banner and nothing to opt out of. What we keep in your browser's own storage is described in section 3.

10. Your Rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you and receive a copy;
• Correct it if it is wrong;
• Delete it (your account and your trial usage);
• Restrict or object to how we use it, where we rely on legitimate interest;
• Receive it in a portable format where we process it by automated means under our contract with you.

How to exercise them. Email aureliaintelligencecorp@gmail.com from the address on your account (or, for trial usage, tell us the internet address concerned). We answer within 30 days, and within the shorter period your local law requires if that applies. We may ask for enough information to be sure the request is yours. Exercising your rights costs nothing, and we will not treat you differently for doing so.

If you are in the EEA, UK or Switzerland. You also have the right to withdraw consent at any time where we rely on it (we currently do not), and to lodge a complaint with your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority in your member state. We would rather hear from you first, but you do not have to come to us before you go to them.

If you are in California or another US state with a privacy law. You have the rights above under that law, plus the right to know that we do not sell or share personal data and do not use sensitive personal information for anything beyond providing the Service. We honour these rights for every US resident, whether or not a state law obliges us to. You may appoint an authorised agent to make a request for you; we will ask for proof of the authorisation.

Providing personal data is voluntary, except that we cannot sign you in without the account details Tendril Terminal sends.

11. Children

The Service is not directed at children. We do not knowingly collect personal data from anyone under 13, or under 16 where you live in the EEA or the UK. If you believe a child has given us personal data, email us and we will delete it.

12. Changes to This Policy

If we change this policy, we will post the new version here with a new effective date. If the change materially affects how we use your personal data, we will also email account holders before it takes effect. Continued use of the Service after the effective date means the new policy applies.

13. Contact

Aurelia Intelligence Corporation
Wyoming, United States
aureliaintelligencecorp@gmail.com

We read every message and reply as quickly as we can.