Privacy

• Your email, for magic-link sign-in.
• API key metadata: a one-way hash, the prefix, and the last four characters. We never store the full key.
• Per-call usage events: the tool, status, cost, latency, and timestamp. We do not store request bodies beyond the product reference needed to serve and cache the result.

When you arrive from a link that carries campaign tags (the utm parameters in a link we sent or listed), or from an MCP directory that lists Legibility, we keep a first-party cookie called lg_touch for 30 days. It holds only those tags, the name of the site that sent you (never the page or anything after it), the directory, and the time you arrived. It never holds your email, your IP address or anything you type.

If you then create an account or an API key, we record the same details against it, and the name of the software that first uses the key (for example curl), so we know which channel brought you. We use this only to understand which of our own invitations and listings work.

We also measure how the site is used with Google Analytics and PostHog. The sign-up events we send them carry only the campaign tag and the channel name, never your email, IP address, product inputs or keys.

If you leave your email on the home page after a free check, PostHog links that email to your earlier visits on this site, so we can follow up on the check you ran.

When you run the test on the Founding 200 page, we keep the product URL or barcode you entered, what you told us you are building, how you will call Legibility and which stores matter to you, with the result of the read. We use them to show you the report and, if you create an account, to attach them to it. We count runs against daily limits using a one-way hash of your IP address; the address itself is not stored. The product URL or barcode you entered is never shared outside Legibility.

We cache the typed product objects we extract, keyed on public references (a URL or a GTIN). The cache holds factual, publicly available product data. It contains no buyer or end-user personal data. Entries expire on a TTL and can be purged on request.

We use the above only to operate, secure, meter, and bill the API, and to provide support. We do not sell personal data.

• Supabase: database and authentication.
• Vercel: application hosting.
• Stripe: subscription billing (we never see full card numbers).
• Google Analytics and PostHog: measuring how the site is used.
• Cloudflare Turnstile: checking that a test run on the Founding 200 page comes from a person.
• The public sources we extract from on your behalf, plus search and barcode providers used to resolve a query.

Usage events are retained for at least 90 days for billing and abuse prevention. Cache entries follow their TTL (a few days by default, shorter for volatile fields like price). Account data is kept while your account is active.

Where you came from, a Founding 200 test linked to your account and any trial on it are kept with your account and deleted when it is deleted. A Founding 200 test that never becomes an account, the hashed IP counts behind the daily limits, and the record of each x402 payment (which holds no wallet address) are kept, and nothing deletes them automatically yet. Contact us to have a test you ran deleted.

Contact us to access or delete your account data. Rights holders can request removal of cached product data via the takedown form, which purges matching entries promptly.

Keys are stored only as hashes. Row-level security isolates each account's data, and all traffic is over TLS.