What happens to what you paste.
Short version: it goes to the model provider for one run, comes back as a report, and is not kept by us. No account, no tracking, no training on your text.
The flow, step by step
One run · one request · nothing written on our sideYou paste text and press Run
Your browser sends the text, the optional context line and the page language to riftveil.ai/api/challenge, over HTTPS.
Our function forwards it to the model provider
The endpoint runs on Cloudflare’s edge. It attaches the Riftveil Protocol as the system prompt and sends your text to Anthropic’s Messages API, under Anthropic’s commercial terms, under which API inputs and outputs are not used to train their models.
The report streams back
Nothing is written to a database, a log file or a queue on our side. When the response ends, the text is gone from our infrastructure. The provider’s own API retention then applies: Anthropic may retain API inputs and outputs for a limited period for trust-and-safety purposes under its privacy policy and commercial terms, unless a zero-retention arrangement applies. We do not control that retention; check the provider’s current policy for the period in force.
The report lives in your browser tab
Copy it if you want to keep it. Reload the page and it is gone.
What we store, and what we do not
A counter, nothing elseWhat we store
- A counter per hashed IP address, to enforce the five free runs per day. It holds a number and a timestamp, in Cloudflare KV, and expires after 24 hours. The IP is stored as a hash, never in clear, and the counter contains none of your text.
- A pseudonymous identifier derived from the same hash is passed to the model provider’s abuse tooling with each request. It is not the IP address.
- An email address, only if you give us one. The "Get the decision-record template and protocol updates" form under the tool, and the Pro Kit checkout, are the only two places on this site that ask for an email. Neither is required to run Riftveil.
- Nothing else from the tool itself. No accounts, no cookies set by us, no third-party analytics or tracking scripts of any kind.
What we do not do
- We do not store, read or review the outputs you paste or the reports you receive.
- We do not use your text to train anything, and the provider’s commercial terms exclude training on API inputs and outputs.
- We do not sell or share data with anyone. There is no data to sell.
Bot protection and sensible caution
Turnstile · confidential materialBot protection
If abuse makes it necessary, the tool may show a Cloudflare Turnstile check before a run. Turnstile does not set tracking cookies and is not used for advertising. Its privacy terms are Cloudflare’s.
Sensible caution
Riftveil is built for the text you were about to act on, not for secrets. If the output contains patient data, personal data, or material your organisation classifies as confidential, run the protocol inside your organisation’s own approved AI tools instead of here. That is one of the reasons it is open source.
The email form, and analytics
Optional · off by defaultThe email form
"Get the decision-record template and protocol updates," under the tool, is a plain HTML form that posts your address directly to a third-party newsletter provider (Buttondown or Formspree). It is entirely optional: leave it blank and the tool works exactly the same. We use the address only to send the decision-record template once and occasional protocol updates after that. Every message carries an unsubscribe link, and we never add an address collected at checkout to this list, or vice versa, without your say-so.
Analytics
No analytics scripts run on this site today. If we turn on Cloudflare's Web Analytics, it is cookieless, does not fingerprint or track you across sites, and sets no client-side script that reads or stores personal data — it counts page views at the edge. It would be off by default and, if ever switched on, this page would say so first, with a link to Cloudflare's own description of it.
Legal basis, your rights, transfers
GDPR · Art. 6 · Art. 13 · Chapter VLegal basis
- The free run. Processing the text you paste, the hashed-IP counter and the pseudonymous abuse identifier rests on our legitimate interest (GDPR Art. 6(1)(f)): providing the tool you asked for and keeping it available by limiting abuse. The processing lasts one request; no profile is built.
- Email. Any email address you give us — for Pro Kit updates or support — is processed on the basis of your consent (Art. 6(1)(a)) and, for delivering a purchase, the contract (Art. 6(1)(b)). You can withdraw consent at any time by writing to hello@riftveil.ai.
- Personal data in the text you paste. You are responsible for what you paste. Do not paste personal data, patient data or confidential material; see “Sensible caution” above.
Transfers outside the EU
The model provider, Anthropic, processes API requests in the United States. The transfer is covered by the safeguards in the provider’s data processing agreement — the EU-US Data Privacy Framework or the EU Standard Contractual Clauses, per the provider’s DPA in force at the time of the request. Cloudflare, which runs the endpoint and the counter, is bound by its own data processing addendum on the same terms.
Your rights
Under the GDPR you may ask for access to, rectification or erasure of your personal data, restriction of or objection to its processing, and portability of the data you provided (Art. 15–21). Because the tool stores no text and no account, the only personal data we can act on is the hashed-IP counter (which expires within 24 hours) and any email you gave us. Write to hello@riftveil.ai; we answer within one month.
Supervisory authority
You have the right to lodge a complaint with a supervisory authority. The controller is established in Belgium; the competent authority is the Belgian Data Protection Authority — Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA), Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be. You may also contact the authority of your own Member State.
Pro Kit purchases and contact
Checkout provider · deletion on requestPurchases are handled by a third-party checkout provider that collects the email and billing details needed to issue an invoice and deliver the files. We receive your email and order details, and use them only to deliver updates and to answer support requests. You can ask for deletion at any time.
Questions about any of this: hello@riftveil.ai. Controller: Olivier Laurent, Belgium. Last updated September 2026.