Privacy Policy

Who we are

DRAFT: The service operator is intended to be EduInvestment Holdings LLC, which the owner describes as a Delaware limited liability company (not independently checked against a company registry). The company’s legal address, as stated by the owner (not proof of registration and not stated to be an address for legal notices): 16192 Coastal Highway, Lewes, DE 19958, United States. Separate mailing address, not stated to be a registered office or an address for legal notices: 8 Hudson Avenue, Eastleigh Ridge, Edenvale, GP 1609, South Africa. Where applicable privacy law uses the concept of a data controller, the controller is intended to be the service operator, to be confirmed by a lawyer. Privacy contact: support@solomulti.com.

The short version

You need an account to search the catalog and use chat. We store the account, sign-in, subscription, security-counter, usage and related technical records described below. DRAFT: Our application is not designed to store your searches, filters or chat transcripts as history. It does store what you choose to save: named saved lists of projects (with a snapshot of the catalog information and signals shown when you saved them), an optional project note if you are on Premium and switch on server sync, your skill level and reply language if you choose them, and an optional email-alert preference (see Saved lists, project note and alerts below). If you use Ask Ossy, the text you type, your search text and relevant public catalog context when you ask about current results, and your project note and preference instructions if you have set them, may be sent to xAI, which may retain requests under terms we have not confirmed for our production account (see below). Payment card details are collected by Stripe and are not stored by our application. The current application is not designed to use advertising or analytics cookies.

Account and sign-in data

Email and password: your email address and a salted scrypt hash of your password, not the password itself. A new sign-up is held, with its password hash, until you open the verification link we email you (the link works for 24 hours). We also store single-use verification and password-reset tokens as hashes (reset links work for 1 hour).

Google, GitHub or GitLab sign-in: we receive and store your email address (for GitHub and GitLab only an address the provider reports as verified or confirmed), usually your name and a profile picture URL as the provider supplies them, and the provider’s account id. The configured provider access is limited to sign-in and profile information: GitHub "read:user user:email", GitLab "read_user", and Google’s default sign-in scopes (openid, email and profile). Our application uses the provider’s access token during sign-in to read that profile, and we do not use it to post to or change anything in your provider account. For newly linked provider accounts, our application is designed not to keep the provider access, refresh or id tokens after linking. Accounts linked before this change may still have stored provider tokens until a production clean-up is completed.

Your account id is derived from your email address, so sign-in methods that provide the same email address may be treated as the same account. If that is unexpected, contact support@solomulti.com.

Sign-in protection: to limit guessing we count failed attempts and email requests per email address and per network address. These counters are stored under a keyed hash, not the raw email or IP, and are cleaned up periodically after they expire. When an account is created we may store a consent record with the terms and privacy version shown and how it was accepted; accounts created before this record was added may not have one.

Sessions are encrypted cookies (no session list is kept on the server). Resetting or changing your password is designed to invalidate existing sessions.

Emails (verification, reset and sign-in links) are sent through an SMTP email provider. The provider, and how long it keeps delivery logs, have not been confirmed yet: [EMAIL (SMTP) PROVIDER - TO BE CONFIRMED]. We do not state a retention period for it in this draft.

Searching the catalog

The catalog and its API are available to signed-in users. DRAFT: Our application is not designed to store your searches or filters as search history, and it does not save search results on its own: a project is stored only when you add it to a saved list. The catalog service logs the request path, status and duration only, not the query; hosting-provider logs are addressed below. Your last search is kept in your browser tab (sessionStorage) so the "Back to search" link works; our application does not send that browser-tab copy anywhere by itself. Requests are rate-limited using your IP address in memory.

Our hosting providers (see Providers) keep their own technical request logs under their own terms; we have not reviewed their retention periods.

Saved lists, project note and alerts

DRAFT: Saved lists. Signed-in users can keep named lists of catalog projects. For each project we store the repository id and name, the date you added it, and a snapshot of the public catalog information and signals shown at that time (for example license, maintenance, maturity and adoption bands, archived status). The snapshot is made on our server from our catalog, not from what your browser sends, and is refreshed only when you add the project again. Lists belong to your account and are not shared with other users. The Free plan currently allows up to 2 lists of up to 10 projects each and Premium up to 20 lists of up to 50 projects each; these numbers are provisional and may change. A plan change does not delete existing lists; the limits apply when you create a list or add projects.

DRAFT: Project note ("About my project"). The optional project note for Ask Ossy (up to 400 characters, for example what you build, whether it is commercial, your stack and license preferences) is kept in your browser (localStorage) by default and is not stored in our application database. On the Premium plan you can switch on "keep my project note on my account", and then the note is stored on our server with your preferences until you switch it off, which deletes the copy in our application database, or until you delete your account; the Free plan keeps the note in the browser only (plan limits are provisional). You can view, edit and delete the note on your account page and in Ask Ossy, and, if server sync is on, that server copy is part of your data download (a note kept only in your browser is not available to our account export). When you use Ask Ossy, the note is processed by our server and sent to xAI with your message as background about your project, labelled as untrusted user text with an instruction not to follow it, although an AI model can still be influenced by text you give it (see Ask Ossy below). Do not put personal or confidential information in it.

DRAFT: Skill level and reply language. If you choose a skill level (Beginner, Intermediate or Experienced) or a reply language for Ask Ossy on your account page, we store that choice with your preferences until you change it or delete your account. It only changes how much explanation and which language Ask Ossy and the pages use; it is part of your data download. When you use Ask Ossy, a short instruction reflecting the level and language is sent to xAI with your message.

DRAFT: Email alerts. Email alerts are an optional feature that is not switched on yet. When it is, you can opt in on the Saved lists page (off by default). If you opt in once alerts are launched, the feature is intended to compare, about once a week, the projects in your own saved lists with our current catalog and, if one has become inactive on our maintenance signal, is now archived, or has a different license than the one in your snapshot, to send you one digest email. The email is addressed only to the verified email address of your account, covers only your own lists, and is intended to contain a one-click unsubscribe link that works without signing in and switches alerts off. We store your alert preference, the date you opted in, the dates of the last check and the last email, and a small record per saved project of which change we already told you about, so that we do not repeat it. Our application does not keep a copy of the digest email; the email provider delivers it under its own terms, may keep delivery, bounce or server logs, and we have not confirmed its retention periods. Alerts are based on automatically collected public data that can be wrong or out of date, they are for discovery only and are not legal advice.

DRAFT: Feedback. The "Was this helpful?" and "Report an issue" controls are optional and are not available until we switch the feature on. If you use one, we store which part of the service it was about (evaluation guide, Ossy answers or catalog), whether you chose helpful, not helpful or issue, an optional short comment (up to 500 characters), the project name when you sent it from a project’s evaluation guide, the time, and your account id so that we can include it in your data download and delete it with your account. We do not store the text of the Ossy answer, your chat messages or your email address with it, and we ask you not to write personal or confidential information. We try to remove obvious email addresses, phone numbers and tokens from the comment before saving it, but that filter is not complete. Feedback is read by the service operator to improve the service. We have not implemented an automatic deletion period for feedback: it is kept until you delete your account or we delete it after a request. Do not send feedback that you need an answer to; it is not a support channel (use support@solomulti.com for support).

DRAFT: Compare view. The compare view shows 2 projects side by side on the Free plan and up to 4 on Premium. A comparison is computed in your browser from the results you selected and is not saved by our application unless you add those projects to a saved list.

Billing

Premium is billed by Stripe. Stripe collects and holds your payment details and billing information; payment card details are not stored by our application. We store your Stripe customer id, subscription id, status, price id, current period end and whether it is set to cancel at period end, plus the ids and types of Stripe webhook events we have processed. When you subscribe we send Stripe your email address and our internal account id.

Ask Ossy (xAI)

Ask Ossy is available to signed-in users. When you send a message, we send xAI (our AI provider) over the API: a fixed instruction text; the conversation so far (up to 30 turns, each up to 4,000 characters, exactly as you typed it, plus Ossy’s earlier replies); the search text you used and up to 50 result rows of public catalog information (names, descriptions, links, popularity numbers, license fields, tags) when you ask about the current results; and the results of catalog lookups that Ask Ossy runs. While GitLab public suppression is enabled, records hosted on GitLab are intended not to be displayed publicly; this has not been re-checked live for this draft.

We do not intentionally include your name, email address, account id, IP address, session information, Stripe information or sign-in data in the request body we send to xAI. But anything you type is sent as written, including personal data if you type it. Do not enter personal or confidential information.

DRAFT: If you have written a project note, it (up to 400 characters, shortened and cleaned of markup characters) is also sent to xAI with each message, whether the note is kept only in your browser or on your account.

We have not confirmed whether xAI’s Zero Data Retention option is enabled for our production account, or which xAI agreement, retention terms, training-use terms, contracting entity or settings govern our production account: [XAI GOVERNING AGREEMENT AND ITS RETENTION TERMS - TO BE CONFIRMED]. Until this is confirmed, you should not assume that Zero Data Retention, a 30-day retention period, non-training use or any other specific xAI retention or training term applies to requests from this service, and you should not enter personal or confidential information.

DRAFT: Attachments (optional; may not be available to you yet). If attachments are switched on and you attach a file or paste text to an Ask Ossy message, the text of that one attachment is sent to xAI with that message, after our server has tried to remove some obvious secrets and common personal-data patterns from it automatically. That filter is not complete: it can miss secrets and personal data, so check the preview and do not attach anything confidential or personal, including keys, passwords, other people’s data or private source code. If attachments are switched on, only plain text, README and license files are intended to be accepted for Ask Ossy; the size limit depends on your plan and is provisional. The attachment is read in memory to prepare the request; our application is not designed to save the file or its text in its database or chat history, or to write it to its logs on purpose, but it travels through our hosting infrastructure, and we have not confirmed whether any provider log can contain request bodies. It applies to that one message only, so attach it again if you want to ask more. It is labelled as untrusted text with an instruction not to follow anything written in it, but an AI model can still be influenced by text you give it. Like the rest of your message, it may be kept by xAI under terms and settings that we have not confirmed for our production account, as described above. The provider’s current public pages name the company SpaceX Super Intelligence LLC (SpaceXSI); the contracting entity for our production account has not been confirmed.

DRAFT: Dependency check. If you upload package.json, package-lock.json, yarn.lock or requirements.txt for the dependency and license check, our server reads the file in memory, extracts only the package names and versions, and looks them up in the catalog. The file itself is not intentionally sent to xAI and our application is not designed to save it, but it travels through our hosting infrastructure, which may process technical request data under its own terms. If you then choose "Ask Ossy about this result", only the package names, versions and the catalog license information are sent to xAI as your message. Package names can be private (for example internal package names), so do not use the check on files whose package names are confidential.

Our application is not designed to save chat transcripts in its database as chat history; your messages may exist in your browser tab, in transit, in xAI systems under retention terms and settings we have not confirmed for our production account, and in logs kept by providers under their own terms. We store a per-account daily message count (an account id, the UTC day and a number) to enforce the daily limit, a per-account and per-network daily request counter for catalog search and Ossy (a subject, the UTC day and two numbers; a network is stored only as a salted one-way hash, not as an IP address) to enforce fair-use limits, and a separate usage log with one row per chat message: time, plan, model name, token counts, number of model and tool calls, outcome and duration. The usage log has no account id, IP, email, message text or catalog data and is not designed to identify you, but it is technical usage data and we cannot promise that re-identification is impossible. Usage-log rows older than 180 days are deleted.

Providers and other recipients

The service uses these providers to run the service. They may receive or process data for the service or under their own terms; we have not confirmed every contracting account holder or provider agreement for this draft:

• Vercel: hosts the web application and keeps platform request logs.
• Turso: hosts the application database (accounts, subscription state, counters; DRAFT: and your saved lists, optional project note and alert preference).
• Fly.io: runs the catalog data service in the US-East (iad) region. The catalog dataset is public catalog data; Fly.io may also keep platform request logs under its own terms.
• Stripe: payments and billing.
• xAI: AI answers in Ask Ossy, as described above.
• Google, GitHub and GitLab: optional sign-in providers. You deal with them directly under their own terms.
• Email (SMTP) provider: sign-in, verification and reset emails, DRAFT: and alert digest emails if you opt in once alerts are switched on; the provider may keep delivery or bounce logs under its own terms. The email provider and its log retention period have not been confirmed yet ([EMAIL (SMTP) PROVIDER - TO BE CONFIRMED]); this draft does not state a retention period for it.

Retention

Per-account daily chat counts: 30 days, then deleted automatically, or at once when you delete your account. Per-account and per-network daily request counters: 30 days, then deleted automatically; the account rows are deleted at once when you delete your account. After an account is deleted, a sign-out marker may remain for up to 31 days so that existing cookie sessions stop working. Chat usage log rows: 180 days, then deleted automatically. Sign-in protection counters, verification links and reset links: kept until they expire, then cleaned up automatically. DRAFT: Saved lists and their snapshots, and the alert record per saved project: kept until you delete the list or project, or delete your account; there is no automatic expiry. The optional server copy of your project note: kept until you switch the setting off (the copy in our application database is then deleted) or delete your account. Your skill level and reply language: kept until you change them or delete your account. Your alert preference and its dates: kept until you delete your account. Attachments and dependency files: our application is not designed to store the file or its extracted text (they are read in memory only); we keep hashed per-account and site-wide daily attachment counters to enforce limits, which expire within 24 hours. A text attachment sent with an Ask Ossy message goes to xAI with that message, and xAI may retain it under terms we have not confirmed; a dependency file is not sent to xAI, but package names and results taken from it may be sent if you then ask Ossy about them. Hosting and AI providers handle request data under their own terms. Chat transcripts: not stored in our application database; xAI may retain API requests and responses under terms and settings that we have not confirmed for our production account, as described in the Ask Ossy section.

Account records: we have not implemented an automatic deletion period for these. They are kept unless and until you delete your account, we delete them after a request, or another retention rule is implemented (see Data deletion and export). Stripe keeps its own records under its own terms. Based on the current database schema, subscription records may remain after an account is deleted, with the account link removed.

Your rights and requests

Where the GDPR, UK GDPR or a similar privacy law applies, the summary below is a draft working summary of processing purposes and possible legal-basis issues only and must be confirmed by a lawyer before this Privacy Policy is published as final: [LEGAL BASES AND RIGHTS UNDER THE APPLICABLE LAW - TO BE DRAFTED BY A LAWYER].

Draft processing-purpose summary, to be confirmed: we may process account and sign-in data to provide the service, authenticate you and keep your account secure. We may process security counters, rate-limit data and technical logs to protect the service and prevent abuse. We may process billing and subscription data to provide Premium, manage subscriptions and handle payments through Stripe. We may process chat messages and related catalog context to provide Ask Ossy and to measure usage limits. We may send verification, reset and sign-in emails to operate your account. We may keep records and respond to requests where needed to comply with applicable law or to protect rights and safety. The final legal basis for each purpose, including whether consent is required for any purpose, is still to be confirmed by a lawyer.

Depending on the law that applies to you, you may have rights over your personal data, including rights to access it, correct it, delete it, restrict how it is used, object to certain uses, receive a portable copy, withdraw consent where processing is based on consent, and complain to a supervisory authority. These rights may be limited by applicable law.

Signed-in users can download the account data included in the export and delete their account from the Account page. To ask for anything else, or if you cannot use those tools (access, correction, export, deletion, restriction, objection, portability, or withdrawal of consent where applicable), email support@solomulti.com. See the Data deletion and export page for what exists today. We intend to reply to general requests within 5 business days. These are targets we intend to meet, not guarantees, and they do not override any period that applicable law sets. Deletion and export requests are covered on the Data deletion page.

International transfers: we use the providers listed above: Vercel, Turso, Fly.io, Stripe, xAI, Google, GitHub, GitLab and the email provider. The only provider region stated on this page is that Fly.io runs the catalog data service in the US-East (iad) region. We have not confirmed all provider processing regions or the final transfer mechanism. Where international-transfer rules apply, the mechanism is: [INTERNATIONAL DATA TRANSFER MECHANISM - TO BE CONFIRMED].

Children

DRAFT proposal, for a lawyer to confirm: you must be at least 18 years old to use SoloMulti. SoloMulti is a business and developer tool and is not directed at children. If you believe that a child below that age, or below any minimum age required by applicable law, has created an account or sent us personal data, email support@solomulti.com.

Cookies and browser storage

We use the following cookies and browser storage for sign-in, security and core site functions. The current application is not designed to use advertising or analytics cookies or analytics scripts, and the page font is served from our own site.

• Session cookie (authjs.session-token): keeps you signed in; up to 24 hours if you did not choose "Remember me", or up to 30 days if you chose "Remember me".
• CSRF protection cookie (Auth.js): protects sign-in forms.
• Auth.js callback-URL cookie: may be set by Auth.js to remember where to send you after sign-in; this was not separately verified in a browser for this draft.
• Remember-choice cookie (osc-remember): carries the "Remember me" choice during sign-in; is designed to last up to 24 hours for emailed-link sign-in and 15 minutes for Google, GitHub or GitLab sign-in, and is removed when sign-in completes.
• Browser storage: your last search (sessionStorage, this tab only), DRAFT: your optional project note for Ask Ossy and a flag that you dismissed the welcome card (localStorage, this browser, until you clear it), and a short-lived sign-in notification between your tabs (localStorage/BroadcastChannel, no personal data).