your data
stays yours.

“scrub” (the api), “scrub labs” (the team), and this website are operated by Chisick Enterprises, a company registered in the united states. when this policy says we or us, that's who.

questions, requests, or complaints about this policy go to privacy@getscrub.dev.

• waitlist email.the address you give us, plus the optional “what are you building” note. that's it for now — we're pre-launch.
• content you send to the api. once the api ships: the message text you submit for moderation. we process it, return a decision, and don't keep the raw content beyond what's described in §04.
• basic request logs. server-side request metadata (ip, user agent, path, timestamp) handled by our host. retained on our host's default rolling window.

• we do not train on your content. not now, not later, not “in aggregate,” not “anonymized.”
• we do not sell your data. to anyone. for any reason.
• we do not share content with third parties except infrastructure providers strictly required to deliver the service (see §06).
• we do not use trackers or ad pixels on the marketing site.

waitlist emailis kept until you ask us to remove it, or until ~30 days after public launch when the waitlist is closed and we delete what we don't need.

once the api ships: message text you send to the api is held in memory only for the duration of the request and is not written to disk. request metadata (ip, ua, path, timestamp) follows our host's default rolling retention.

regardless of where you live, you can:

• see what we have on you · email privacy@getscrub.dev.
• correctanything that's wrong · same.
• deleteyour account and all associated data · we honor this within 30 days, with a note about what's retained for legal/billing reasons.
• export a machine-readable copy of your usage history.

residents of the eu/uk/california have additional rights under gdpr/ccpa (object, restrict, complain to a regulator). exercise them via the same email and we'll respond within the statutory window.

just enough vendors to run the service. each one is contractually bound to confidentiality and data-protection terms at least as strong as this policy. as of today, that list is short:

• vercel · hosting and edge runtime for the marketing site, the waitlist form, and the api once it ships.
• convex · the database where your waitlist signup lives.

that's the entire list. if it grows — for example a payment processor when we open billing post-ga — we'll add it here and email anyone affected before it goes live.

tls everywhere. encrypted at rest. keys hashed. principle of least privilege internally — engineers cannot read api content in production. we run vulnerability scans continuously and ship patches the same day where reasonable. soc 2 type ii audit window opens in q4 2026; report on request thereafter.

deeper specifics live on the security page.

the marketing site doesn't set any cookies right now. no analytics cookies, no tracking pixels, no consent banner needed because there's nothing to consent to. when we build the dashboard, the only cookie will be a session id — set after you log in, deleted when you log out.

scrub is a b2b tool sold to companies, not consumers. we do not knowingly collect data from anyone under 16. if we learn we have, we delete it.

we're hosted in the us. if you use scrub from the eu/uk, your data crosses the atlantic. we rely on standard contractual clauses for that transfer. eu/apac residency is on the roadmap (q4 2026).

we'll update this page when something material changes and email anyone affected. the “last updated” stamp at the top will reflect it. previous versions available on request.

privacy questions · privacy@getscrub.dev
everything else · hi@getscrub.dev