Privacy Policy

What We Collect

• Information you provide. Account and authentication details (email/identifier via AWS Cognito, including the Google identifier if you use "Sign in with Google"), site settings (domains, and the per-attribute collection basket you choose for each site), API keys (stored hashed), and preferences. Billing is handled by Stripe; we retain payment metadata (customer ID, payment method token/last4, status) but not full card numbers. If you contact us (email, social, Calendly) we receive the information you include. Content you submit to our AI prompt tool — your prompt text, the enhanced and image prompts we derive from it, and any image generated for you — is stored so we can process, return, and re-display your results. We also keep a per-account usage record (which tool actions you ran and when) to enforce credit balances and free-tier limits.
• Cookieless analytics & events. Our tracking collects page path, event name, timestamp, and a session identifier kept in sessionStorage (resets when the browser session ends), plus event properties for affiliate/CTA clicks and, on authenticated tool pages, the subscription tier and price associated with an event. On the first page view in a session we also collect referrer domain (the site you arrived from, reduced to its domain), UTM campaign tags, a five-bucket viewport size bin (xs/sm/md/lg/xl, never exact pixel dimensions), device class, browser family, OS family, and the visitor's country as reported by a CloudFront edge header. We do not collect city, region, timezone, browser or OS version numbers, or any per-visitor identifier. On ocdevel.com we also record: an impression event when an affiliate link is displayed, carrying the same link identifier its click event carries; a warn: event family around the buy-warning interstitial; and a compare: event family on the spec-comparison surface. Custom event properties are filtered for obvious PII keys; referrer domains may occasionally reveal the site you came from. We do not store raw IPs in analytics tables, and session IDs do not persist across sessions. CloudFront/API Gateway headers (including IP/user agent) appear in access and transit logs, and in the S3 error bucket that holds events our pipeline could not process, to ensure delivery and support debugging — see Retention for how long each is kept.
• Security/operations. Web server, API Gateway, and CloudFront logs include IP address, user agent, and error details for debugging, abuse prevention, and fraud monitoring. The rate limiter uses IP in memory only.
• Advertising/third-party tracking. We do not serve ads on ocdevel.com and do not use AdSense, Google Analytics, or ad pixels. If we add ad/analytics networks in the future, they may set their own cookies/identifiers; we will update this notice and present any required consent/opt-outs at that time. Affiliate destinations may set their own cookies when you click through.

How We Use Information & Legal Basis

• Provide and improve our site, analytics dashboards, and tools (including generating the enhanced prompts and images you request).
• Measure traffic, attribution, and product performance using our cookieless analytics; detect bots/abuse and prevent fraud.
• Operate accounts, API keys, credits, and billing (via Stripe); send service communications you request.
• Respond to support inquiries and maintain platform security and integrity.
• Comply with legal obligations and enforce our agreements.

Legal bases (EU/UK): contract (when you create an account or use the service), legitimate interests (site analytics, security, product improvement, communicating with existing users), and consent where required (e.g., optional marketing or if future ad/analytics cookies are introduced). When you use our analytics script on your own site, you are the controller for your visitors and should disclose that lawful basis to them; we process data on your instructions and collect only the attributes in the basket you selected for that site.

Tracking, Cookies, and Controls

• Our analytics relies on sessionStorage plus an opt-out flag in localStorage; we do not set tracking cookies for our own analytics or use persistent identifiers across browser sessions. Writing that tab-scoped session key, and reading UTM tags from the URL, are both operations the ePrivacy Directive's Article 5(3) reaches. Our own tool classifies this configuration as exemption-resting, and we use that word deliberately: we do not claim ocdevel.com is banner-free by construction. It rests on the audience-measurement exemptions that several national regulators apply to first-party analytics, subject to their conditions. The tool also offers a zero-footprint configuration, which retains neither the session key nor the campaign tags — the tracker still writes the same tab-scoped sessionStorage id, it is simply discarded on arrival — and this site does not use it.
• On authenticated pages, AWS Cognito stores your session JWT in browser localStorage to keep you signed in. On pages with checkout entry points, Stripe.js sets its own fraud-prevention cookies (__stripe_mid, __stripe_sid); these are functional/security cookies, not advertising trackers.
• Opt out on ocdevel.com by visiting any page with ?notrack=1 (or setting localStorage.setItem('notrack','true')). Remove that key to re-enable tracking. You can also block requests to https://events.ocdevel.com or disable JavaScript.
• Third-party services you choose to use (e.g., Calendly, Stripe checkout, affiliate destinations, or future ad networks) may set their own cookies or identifiers; their policies govern that processing.

Sharing and Processors

• Hosting and infrastructure with AWS (including Cognito for logins, CloudFront, API Gateway, Aurora/RDS, S3, Firehose, Athena, and SES for our own service email).
• Payments with Stripe (cards handled by Stripe; we store only limited payment metadata).
• AI processing with Google (Gemini) to enhance prompts and generate images from the content you submit. If you use "Sign in with Google," Google also handles that sign-in.
• Email and scheduling tools (e.g., standard email providers, Calendly) when you contact or book with us.
• Affiliate partners receive standard referral parameters when you click their links.

We do not sell personal data or share it for cross-context behavioral advertising. We may disclose information if required by law, to protect rights, or during a business transaction.

Retention

• Analytics events are stored in our S3-based analytics tables (Apache Iceberg). We are activating a scheduled job that purges analytics events older than 13 months on a rolling basis; until that job is live no expiry is applied, and we will remove this qualifier once it is. Per-site aggregate counters live in our database for as long as the site does. Events our pipeline cannot process are held in an S3 error bucket, also without a fixed expiry today.
• Function logs for analytics ingestion/processing are kept 7 days. CDN access logs, which include IP address and user agent, are kept 90 days. Rate-limit data is held in memory only.
• Account, billing, prompts, and generated images are retained while your account is active and as needed for legal/accounting purposes. You may delete assets in the product where supported or contact us for help; minimal billing records may remain to meet legal duties. Superseded versions of stored files are purged 60 days after they are replaced.
• Separately, we hold cold-storage snapshot copies of stored files taken before a September 2025 infrastructure rebuild. These are kept indefinitely as recovery evidence, are served to no one, and are not reached by the self-serve account deletion below; email us and we will purge yours from them too.

Security

Data is encrypted in transit and at rest within our providers, and access is limited to operational needs. Our analytics stores no per-visitor identifier at all. Custom event properties are filtered for obvious PII keys. No method is 100% secure; please use strong, unique credentials and contact us if you suspect an issue.

International Transfers

We primarily use U.S.-based infrastructure and service providers. Data may be transferred to other countries where our providers (AWS, Stripe, Google, etc.) operate. We rely on their transfer safeguards (e.g., standard contractual clauses) where applicable.

Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your data, and to object or restrict certain processing. You can:

• Use the analytics opt-out noted above for ocdevel.com.
• Visit your account settings to download a copy of your sites, API key metadata, prompts, and usage records, or to delete your account. Deleting erases your stored files and generated images, your database records, and your Cognito login, and detaches any saved card at Stripe. It does not reach the cold-storage snapshots noted under Retention, short-lived operational and CDN logs, or website analytics events — those are recorded against a site and a session, not against your account identifier. Email us for anything the self-serve flow does not cover.
• If your data was collected via our analytics script on a third-party site, contact that site first; we will support them as a processor.

For California residents: we do not sell or share personal information for cross-context behavioral advertising. You may request to know, delete, or correct personal information and to limit sensitive data use (we do not collect sensitive categories for our analytics).

Children

Our services are not directed to children under 16. If you believe a child provided us information, contact us and we will delete it.

Changes

We may update this policy to reflect product or legal changes. We will revise the "Last updated" date and, if changes are significant, provide additional notice.

Contact

For questions or requests, email tylerrenelle@gmail.com.