Privacy Policy

Information we collect

We collect only what we need to operate the site and the features you use.

Account information

If you create an account, our authentication provider (Clerk) collects and stores your email address, the name and profile image you provide, and a unique account identifier. If you sign in with Google or Slack, Clerk also receives the basic profile information those providers return (typically name, email, and profile image). We do not see or store your password.

Subscription and payment information

If you subscribe to a paid plan, payment is processed by Stripe. Stripe collects and handles your payment details directly under Stripe’s privacy policy. We never see or store your card number. We do store a Stripe customer identifier, a subscription identifier, the subscription status, and the current billing period end so we can determine whether your account is active.

AI chat content

When you use the “Ask AI” feature, we store your conversations — the questions you send, the assistant’s responses, and the source citations retrieved for each response — so you can come back and read prior threads. Your messages are sent to our AI providers (Anthropic for the language model, Voyage AI for embeddings) for processing. Those providers receive the message content needed to answer your question; they do not receive your account email or other identity information from us.

Site analytics

We use Umami, a privacy-focused analytics tool that we self-host at analytics.chapter32.com. Umami records pageviews, referring sites, the type of device and browser you use, and an approximate country derived from your IP address. It does not set tracking cookies, does not assign a persistent identifier across visits, and does not share data with third parties. We use this information to understand which pages are useful and where the site has gaps.

Logs

Like nearly every web service, our servers and our hosting provider produce short-lived request logs that may include IP addresses and user-agent strings. We use these only to keep the site running and to investigate abuse or errors.

How we use information

• To operate the site and provide the features you ask for.
• To authenticate you and keep your account secure.
• To process subscription payments and determine whether your account has access to paid features.
• To answer your AI questions and to display your prior conversations back to you.
• To understand site usage in aggregate so we can improve content and fix problems.
• To respond to you when you contact us.
• To comply with the law and enforce our Terms of Use.

We do not sell your personal information, and we do not use your account information or chat content to send marketing emails.

Service providers

We rely on a small number of trusted vendors to run the site. Each one only receives the information it needs to do its job:

• Clerk— account creation, sign-in, and session management.
• Stripe— subscription billing and payment processing.
• Anthropic— the language model that generates AI chat responses.
• Voyage AI— embeddings used to retrieve relevant source material for the AI chat.
• Google— only if you choose to sign in with Google.
• Slack— only if you choose to sign in with Slack.
• DigitalOcean— the hosting provider that runs the application and database.

These providers operate under their own privacy policies and security commitments. We do not give them more information than necessary.

Cookies and similar technologies

We use cookies that are required to run the site. Clerk sets cookies to keep you signed in across pages, and Next.js may set short-lived cookies for routing and session handling. These cookies are essential; the site cannot function without them. We do not use advertising cookies or cross-site tracking cookies. Umami analytics does not set cookies.

Data retention

We keep account information for as long as your account exists. Chat conversations are kept until you delete them or close your account. Subscription records are kept for as long as required for tax and accounting purposes. Aggregate analytics data is kept indefinitely in non-identifying form. Server logs are kept for a short period (days to weeks) and then rotated out.

Account deletion grace period.When you request that your account be deleted, we cancel your subscription immediately and lock the account so it can't be used. The data itself is retained for seven days during which you can sign in and restore the account. After seven days a scheduled job permanently deletes your saved pages, private notes, chat history, and the account itself; correction submissions are deleted and roadmap requests are anonymized. Copies in routine database backups persist on the normal backup rotation (which expires snapshots within thirty days) and are not separately accessible.

Security

We use HTTPS for all traffic, store data on managed infrastructure, and limit administrative access to the operator. No system is perfectly secure; we encourage you not to share sensitive personal information — including details about specific members of a retirement system — in chat messages.

Your choices and rights

You can:

• View and edit your account profile from the Account page.
• Delete individual chat conversations at any time.
• Cancel a paid subscription from the Account page.
• Request that we delete your account and the data associated with it by emailing ken@kenb.dev.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the EU General Data Protection Regulation, including the right to access, correct, or receive a copy of your personal information. Contact us at the address above and we will respond.

Children

Chapter 32 Wiki is intended for adult users — principally people who work with Massachusetts public retirement systems. The site is not directed to children under 13, and we do not knowingly collect personal information from children.

Changes to this policy

When we make material changes to this policy, we will update the “Last updated” date at the top of this page and, for significant changes, give notice on the site. Continued use of the site after a change means you accept the updated policy.

Contact

Questions about this policy or about your information can be sent to ken@kenb.dev.