Security Profile & Data Handling Guarantees

1. Zero-Telemetry Cloud Compilations

For users running Deep AI Compiles using Auxo Cloud credits:

• In-Memory Processing: Workspace outlines are processed transiently in-memory on our edge compiler nodes. No compilation payload is logged or written to disk.
• Immediate Purging: Requests are deleted from edge runtime memory immediately after the LLM returns the structured response.
• Authorised Access: Auth sessions and credit counts are queried securely from Supabase using PostgreSQL Row-Level Security (RLS) policies.

2. Bring Your Own Key (BYOK) Security

When configuring personal API keys (OpenAI, Anthropic, or Gemini):

• Client-Side Encryption: Keys are obfuscated in browser memory using a symmetric XOR-based mask array combined with Base64 encoding before writing to `localStorage` (SEC-08), preventing cleartext cookie-scraping.
• Transient Payloads: Decrypted keys are sent strictly over TLS-encrypted HTTPS connections within the body of compile request payloads. Keys are never saved or cached by our backend.
• Routing Bypass: BYOK compilation requests completely bypass credits checks, payment verification, and cloud database operations.

3. Ephemeral Synchronisation Channels

Real-time typing updates and editor synchronisation run over transient Supabase Broadcast and Presence WebSocket channels. Keystrokes are mirrored in-memory between active collaborators and are never persisted to a database.

4. LocalStorage & Local Exporter

Scratchpad data is mirrored in your browser's `localStorage` (keyed by Room UUID) to prevent accidental loss from browser crashes. Zipping is handled entirely in-memory on the client browser using JSZip.

5. Google API Services User Data Policy

When you sign in to Auxo using your Google Account (Google OAuth credentials), or utilise Google services (such as Gemini in BYOK mode), we handle your data in strict compliance with the Google API Services User Data Policy:

• Data Accessed: Through Google OAuth, we access your basic profile information (specifically: your email address, full name, and profile picture avatar URL). If you configure your personal Google Gemini API key (BYOK mode), your key is processed strictly in-memory to execute the compilation request to Googles API endpoints. We do not store, log, or save your API key on our servers, and we do not access any other Google account data or services.
• Data Usage: We process your Google profile data solely to authenticate your identity, create your unique user account on Auxo, secure collaborative rooms you belong to, and associate your cloud compilation credit balances with your identity. We do not use this data for any advertising, marketing, or profile-building activities.
• Data Sharing: We do not sell, trade, or share your Google user data with any third parties except for our core infrastructure database provider (Supabase) to securely host your profile record, and our payment processor (Stripe) to map credit purchases to your email. We do not share Google user data with any AI model providers.
• Data Storage & Protection: Your profile data is stored in our database hosted on Supabase, protected by Row-Level Security (RLS) policies. Access is strictly encrypted via SSL/TLS. Any user-supplied API keys (including Gemini API keys) are XOR-obfuscated and stored exclusively in your local browser storage, never sent to or stored on our servers.
• Data Retention & Deletion: We retain your profile data as long as your account remains active. You can request the permanent deletion of your account and all associated Google user data at any time by contacting our support team at woo9ine@gmail.com. We will process and fulfill all deletion requests within 30 days of receipt, in compliance with GDPR and other data protection regulations.

6. Your Rights Under GDPR

If you reside in the European Economic Area (EEA), the United Kingdom, or jurisdictions with similar privacy laws, you possess the following rights regarding your personal data under the General Data Protection Regulation (GDPR):

• Right of Access & Portability: You have the right to request copies of the personal data we hold about you and request its transfer to another service.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data.
• Right to Erasure (Deletion): You can request that we erase your personal data. As stated above, we will fulfill erasure requests within 30 days of receipt.
• Right to Restrict or Object: You have the right to object to, or request that we restrict, the processing of your personal data under certain conditions.

7. Children's Privacy

Auxo is a utility tool designed strictly for developers and is not directed at children under the age of 13 (or under the age of 16 in the European Union). We do not knowingly collect or solicit personal data from children. If we discover we have collected data from a child under these limits, we will delete it immediately.

8. International Data Transfers

We store and process your data using trusted third-party providers (Supabase and Stripe) whose servers may be located outside of your home country, including in the United States. Where personal data is transferred internationally, we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place with our processors to protect your information.

9. Contact & Controller Identity

The data controller for Auxo is Auxo Intellectual Property Labs. If you have any questions about these specifications, or wish to exercise any of your data protection rights, please contact us at woo9ine@gmail.com. We will update the "Published" date at the top of this document whenever updates are made to our privacy practices.