Privacy Policy

Who this covers

This policy covers the hosted service at artifactbin.dev, operated by MinusX, Inc., a Delaware corporation.

artifactbin is open-source software under Apache-2.0. If you or your company run your own instance, we operate nothing, receive nothing, and this policy does not apply to it — the operator of that instance is the one responsible for the data on it.

What we collect

• ·Account: your email address. It is the only credential — we sign you in with a one-time code, so there is no password to store, leak, or reset. We also assign you a username, which you can change.
• ·What you publish: the documents, datasets and images you or your agent publish, every version of them, comments left on them, and who you shared them with.
• ·Agent tokens: stored only as a SHA-256 hash. The token itself is shown once, at creation, and we cannot recover it.
• ·Usage: one analytics row per view, holding the event, the document, your account id if you were signed in, and a guess at whether the reader was a browser or an agent, taken from the user-agent string.
• ·A visitor mark: a salted hash that rotates every day, used to count one person once. We do not store raw IP addresses or user-agent strings against your views, and the mark cannot be reversed or followed across days.
• ·Correspondence: what you send us at our contact addresses.
• ·Payment information: none. The hosted service is free and we collect no card or bank details.

How we use it

• ·To run the service: store your documents and serve them to the people you shared them with.
• ·To sign you in: send the one-time code to your email address.
• ·To show you your own numbers: the view counts and sparklines on your dashboard.
• ·To keep the service up: rate limits, abuse prevention, and debugging from server logs.
• ·To improve the product: aggregate usage patterns, in Mixpanel.
• ·To answer you when you write to us.

Your content and AI models

We do not use your content to train models, and neither do the providers below under our agreements with them.

If you bring your own agent, artifactbin only stores and serves what it publishes. The agent runs on your machine or on your provider, under their terms and their privacy policy, not ours. What your agent reads before it publishes, and what it sends where, is between you and whoever makes it.

If you use the hosted pi agent, the messages you send it and the documents it works on are sent to Fireworks AI, which runs the model, and the agent’s code runs in a sandbox on Modal. Both receive only what the agent needs for that session, and neither trains on it.

What is public, and what is not

Every document carries a visibility that you control, and it decides who can read it:

• ·Private — you, and the email addresses you invite. The default for a document published under an account.
• ·Unlisted — anyone who has the link. Listed nowhere.
• ·Public — anyone who has the link, and listed on your public profile page.
• ·A public or unlisted address is readable by anyone who has it, including search engines that find it. Treat anything you publish as something that can leave your hands, and do not put in it what you would not put on the open web.

Cookies and local storage

We use cookies to keep you signed in and nothing else. There are no advertising cookies, no ad network, and no cross-site tracking on this service.

• ·A session cookie, httpOnly, that identifies your signed-in account.
• ·An agent-session cookie holding token identifiers — never the token secret itself — so a browser that minted a token can find its own drafts.
• ·Your theme choice and a few interface preferences, in your browser’s local storage. These never reach our servers.
• ·We honor Do Not Track: with that signal set, we do not load product analytics.

Who else sees it

We share personal information only with the service providers that make the product work:

• ·Resend — receives your email address in order to deliver your login code.
• ·Mixpanel — receives product analytics events, including your account id and email if you are signed in.
• ·Fireworks AI — runs the language model behind the hosted pi agent, and receives the prompts and documents that agent works on.
• ·Modal — runs the sandboxes the hosted pi agent executes in, and holds the files the agent is working on for the length of a session.
• ·Our cloud host and an S3-compatible object store — hold the bytes of your documents, datasets and images.
• ·We may disclose information when a court order, subpoena, or law requires it; to enforce our Terms; or to protect the rights, property or safety of our users or the public.
• ·If the company is acquired or merged, information may transfer as part of that transaction, with notice to you beforehand.
• ·We do not sell, rent or trade personal information, to anyone, for any purpose.

How long we keep it

• ·Your account and its content: while your account exists.
• ·A document you delete: removed along with its stored versions.
• ·Analytics rows: kept in de-identified form. The visitor mark rotates daily and is not reversible, so old rows cannot be tied back to a person.
• ·Ask us to delete your account at privacy@minusx.ai and we remove the account and the content it owns, except where we are required to keep something by law.

How we protect it

Traffic is served over TLS. Tokens are stored as hashes and shown once. Login codes are stored hashed, are single-use, expire, and are capped at five guesses — and they are never returned to the caller by any endpoint. There are no passwords in the system to be leaked. Object storage credentials are scoped to this application’s own prefix. Access by our staff is limited to people who need it to operate the service.

No transmission or storage on the internet is completely secure, and we cannot guarantee that someone will not defeat these measures. If we become aware of a breach affecting your personal information, we will notify you by email or in the product within 72 hours of becoming aware of it.

Where your data is held

We are based in the United States, and your information is stored and processed there. If you use the service from the European Economic Area, the United Kingdom, Canada or Brazil, you are consenting to that transfer, which we make under appropriate safeguards where the law requires them.

Your rights

Wherever you live, you can write to privacy@minusx.ai and ask us to show you what we hold, correct it, delete it, restrict what we do with it, object to a use, or hand it to you in a portable form. We will not treat you differently for asking.

If you are in the EEA or the UK, we process your information on these lawful bases: your consent, performance of our agreement with you, compliance with a legal obligation, and our legitimate interest in operating and improving the service. You may withdraw consent at any time.

If you are in California, we do not sell your personal information as that term is defined in the CCPA, and you may exercise your rights to know, delete, and not be discriminated against by writing to the same address.

If you are in Canada or Brazil, the rights PIPEDA and the LGPD give you are exercised the same way, at the same address.

Children

The service is not for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, write to privacy@minusx.ai and we will delete it.

Changes to this policy

We may update this policy. When we make a material change we will say so by email or in the product before it takes effect, and the date above will change. Continuing to use the service after that means you accept the updated policy.

Contact

Privacy Officer, MinusX, Inc. — privacy@minusx.ai