Draft. A placeholder written in plain words, not yet reviewed by a lawyer. It will be replaced before the hosted service launches.

Privacy

Last updated 5 October 2026

This website

This site is a set of static pages. It sets no cookies, loads no tracking pixels and runs no analytics. Our hosting provider may keep standard request logs, such as IP address and browser, for security and operations.

On your machine

Quis ut Deus, the quis command and its integrations, judges prompts on your own hardware. Nothing about those prompts is sent to us, unless you turn on the hosted gate (remote or hybrid mode). Obfuscation maps, originals and raw prompts stay in process memory for the session and are never written to disk, logs or telemetry.

The hosted service

The hosted service has not launched yet. This is how it is built to work.

• Your account is handled by Clerk (sign-in and email verification) and your billing by Stripe. We do not see or store your card details.
• Prompts you send to the API are judged in memory and discarded once the verdict is returned. Prompt text is never stored or logged, under any setting or plan, and we keep no hash or fingerprint of it either.
• Every verdict is counted, in hourly totals. For each hour we keep, per policy and verdict, how many prompts were judged, how long judging took and their risk scores; how often each signal fired; and a running total of your account's usage this billing period. Allowed requests are only counted, nothing more.
• Only flagged verdicts keep a record of their own: metadata such as the time, the policy, the verdict and the signals that fired, deleted after 30 days. A flagged verdict is one that was rejected, censored, redacted or obfuscated. Its record holds the time, your account, the policy and its version, the verdict and its risk score, the signals that fired with their scores and positions in the text, the engine and rule-pack versions, and how long judging took. Backups that hold these records are planned to expire within 35 days.
• Once telemetry is built, each request will send one event with that metadata, never prompt text. Its retention will be stated here before then.
• Bulk judging streams prompts through the same in-memory path. Nothing is queued or kept for later.
• Obfuscation maps are returned to you in the response and never stored or logged.

Questions

Contact details will be published here before the hosted service launches.