Privacy Policy

Weir is operated by Tarun Khatri, India (“we”, “us”). We are the controller of the personal data described in this policy, except where we say otherwise. You can reach us about anything in it at support@weirapp.io.

This policy covers weirapp.io, the dashboard, the API, the MCP server, and our documentation. It should be read with our Terms of Service.

• Account information. Your name, email address, and — if you sign in with Google or GitHub — the profile picture address that provider shares. If you sign in with an email and password, the password is stored only as a hash by our authentication provider, which also records sign-in events, including the IP address used, to protect your account. We also keep your workspaces, their members and roles, and invitations you send (the invitee's email and a hash of the invitation link).
• API keys and agent connections. We store a hash of each key, never the key itself, along with its name, permissions, expiry, and when it was last used. When you connect an agent through OAuth we record which client it is and the permissions you granted.
• Request logs. For each API call: the method and path, status code, latency, credits charged, the API key used, a request identifier, the client's user agent, and a one-way hash of the IP address and of the search query. The path can contain the identifiers you asked about, such as a post id or a public username.
• Monitors and webhooks. The searches and targets you set up, the results they find, your webhook endpoint addresses, signing secrets (encrypted), and a record of each delivery attempt and its response code.
• Billing records. Dodo Payments collects your payment details as Merchant of Record. We receive a record of each purchase — amount, credits, status, and Dodo's reference — but never your full card number.
• Support messages you send us, and our replies.
• Error reports. If something breaks in your browser or on our servers, an error report is sent to our monitoring provider. Query strings, request bodies, cookies, and headers are removed before it leaves, and session replay is switched off.

The Service retrieves publicly available posts, comments, and profiles from third-party platforms when our customers request them. That content can include personal data about the people who wrote it, such as usernames, display names, and what they posted. We retrieve it only in response to a customer's request; we do not build profiles of individuals, enrich the content with data from other sources, or sell it as a dataset.

Retrieved content passes through our systems to the customer who asked for it. It may be cached briefly so identical requests are not repeated, and it is stored as monitor results when a customer sets up a monitor. Each customer is responsible for their own lawful use of what they retrieve. If content about you is held by us and you want it removed, contact us — we will delete what we hold, although the original remains on the platform where it was published.

• To provide the Service: authenticate you, run your requests and monitors, deliver webhooks, and meter and bill usage — because it is necessary to perform our contract with you.
• To keep the Service secure and fair: detect abuse, enforce rate limits and the Acceptable Use Policy, and investigate incidents — in our legitimate interest in protecting the Service and its users.
• To support you and send messages about your account and the Service, such as security notices and changes to these terms — to perform our contract and in our legitimate interest.
• To understand, in aggregate, how the Service is used so we can improve it — in our legitimate interest. This uses de-identified, aggregated figures.
• To meet legal, tax, and accounting obligations.

We do not sell personal data, share it for cross-context advertising, or use advertising trackers. To count visits to our sites we use Umami, a cookieless analytics tool. It records which page was viewed, the site that linked to it, and the visitor's country, browser and device type, only in aggregate. It sets no cookies and does not store IP addresses or anything that identifies you. Invite links and other addresses that could carry a secret are never sent to it.

We use a small number of service providers, each bound to protect the data they handle:

• Supabase — our database and authentication. Your data is stored in Supabase's Tokyo, Japan region.
• Dodo Payments — payment processing, invoicing, and sales tax, as Merchant of Record. Dodo Payments processes payment data under its own privacy policy.
• Our cloud hosting providers — which run the website, API, and background workers.
• Sentry — error monitoring, receiving the scrubbed error reports described above.
• Umami — cookieless visitor counts for our websites, as described above.
• Our email delivery provider — for sign-in links, confirmations, and service messages.
• Google and GitHub — only if you choose to sign in with them.

When we retrieve content from a platform on a customer's behalf, the platform receives the request needed to fetch it, but not the customer's identity or account details. Webhook deliveries go to the addresses our customers configure. We may also disclose data when required by law, to protect the rights and safety of others, or as part of a merger or sale of the business, in which case this policy continues to apply.

Our primary database is in Japan. Some of our providers process data in other countries, including the United States. Where data leaves the European Economic Area, the United Kingdom, or another region that restricts transfers, we rely on adequacy decisions or on standard contractual clauses with the provider.

• API request logs: 30 to 60 days. Logs are deleted in monthly batches, so a record is kept for at least 30 days and never more than 60.
• Logs of our requests to source platforms: 14 to 44 days, for the same reason.
• Monitor results: until you delete the monitor or the workspace.
• Webhook delivery records: 30 days.
• Account and workspace data: for as long as the account or workspace exists. Deleting a workspace deletes its keys, monitors, results, webhooks, and usage history.
• Billing records: for as long as tax and accounting law requires.
• Cached content: briefly, until the cache entry expires.

Deleted data may persist in encrypted backups until those backups expire.

Connections are encrypted in transit. API keys and invitation links are stored only as one-way hashes, as are IP addresses and search text in our request logs, and webhook signing secrets are encrypted at rest. Access to each workspace's data is enforced in the database itself, so one customer's session cannot read another's. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive it in a portable format, to object to or restrict how we use it, and to withdraw consent where we rely on it. You can update your name in the dashboard and delete a workspace from its settings; for anything else, email support@weirapp.io. We will verify the request comes from you and respond within 30 days.

You also have the right to complain to your local data protection authority, although we would appreciate the chance to resolve your concern first.

We use only what the Service needs to work, and nothing for advertising; our visitor analytics stores nothing in your browser:

• Session cookies that keep you signed in.
• A cookie that remembers which workspace you last opened.
• Local storage that remembers your light or dark theme.
• Session storage that holds an API key you paste into the dashboard console, on your device only, until you close the tab.

The Service is not directed to children, and you must be an adult to create an account. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy as the Service changes. If a change is material, we will tell you by email or in the dashboard before it takes effect. The date at the top shows when it was last changed.

Email support@weirapp.io, or write to Tarun Khatri, India.