Privacy policy

We collect the fields needed to operate your account, such as email, display identity, profile details, interface preferences, and the notification settings you choose.

Inside the workspace, the system may store metadata such as connections, saved queries, activity history, dashboards, ERD workspaces, and AI settings that you explicitly create. When you save query results as a dashboard widget, up to 200 displayed rows are also retained as a snapshot until the widget or dashboard is deleted.

Account data is used to authenticate users, maintain sessions, personalize the interface, and support collaboration, history, and billing-related flows when enabled.

• Protect account sessions and detect unusual sign-ins.
• Restore workspace state, drafts, and usage history when you return.
• Deliver AI experiences through the provider or model choices you configured.
• By default, AI context contains only schema, table, column, and relationship metadata; the system does not read or send row values.

Passwords, SSH private keys, and AI provider API keys you provide are encrypted with AES-256-GCM before storage and are decrypted only for the moment a connection is established at your request.

We never display these secrets again after they are saved, never write them to logs, and never share them with third parties. Deleting a connection permanently deletes its credentials.

Data Explorer runs on cloud infrastructure and relies on a small set of support services. These parties only receive the minimum data needed to perform their function:

• AI providers (OpenRouter, Google, Groq, ...) only receive schema metadata and prompts you deliberately send; row values are not included unless you paste them into a chat yourself.
• An email delivery service used for verification codes and account notifications.
• Hosting and CDN infrastructure that serves the application.

We use a single encrypted httpOnly cookie to keep you signed in, plus localStorage for interface state (open tabs, theme, language). We do not use advertising or third-party tracking cookies.

We use authentication controls, permission boundaries, and application-level guardrails to reduce unauthorized access. Data is kept only as long as reasonably required to operate the service and support legitimate product workflows.

You can request access to, correction of, or deletion of your account data through supported product flows or through the legal contact channel.

You can export or delete all of your connections, saved queries, and workspaces at any time directly in the product — no need to contact us.

If we make material changes to this policy, we will notify you by email or in-app notice before the change takes effect. The effective date at the top of this document always reflects the latest version.