Privacy Policy

This policy covers Distill at distill.jeromebadour.com: the app, your account, guest sessions and the public admin demo.

Distill is run by Jerome Badour, an individual, who decides what is collected and why. Contact: privacy@jeromebadour.com.

It sits alongside the Terms of Use. Where this policy describes your data and the terms describe the agreement, both apply.

Your account: your name, username, email address and a password hash (Argon2id). We never store your password itself, and we cannot read it.

Email confirmation and password resets: the codes and links we email you are stored only as a one-way hash, work once, and run out after 24 hours (confirming an email) or 30 minutes (a new password). A new email address waits, unused, until you confirm it.

Guests: a guest session has a generated name such as Guest 31, and no email or password.

Your summaries: the text you paste, the summary Claude writes for it, the sentences each point links to and the figure checks. They are saved to your account so you can find them in Saved.

Usage records: for every summary, when it ran, its length, the number of words and tokens and what it cost. Never the text itself. They power your hourly and daily limits and the app's spend caps.

Devices: for each signed-in device, the browser and system name and when it was last used, so you can see and sign out your devices on your Profile.

Your preferences: theme, motion, default length, avatar colour, how links to the source are shown, how a summary is laid out, and when you finished or skipped the first-time tour.

To write a summary, your text is sent to Anthropic's Claude API, which processes it for Distill. How long Anthropic keeps API inputs and outputs, and when it keeps them longer, is set out in its own data retention policy for the API.

Your text is saved only in your own account. Distill gives no one, its owner included, a way to view it: the admin console shows counts, lengths, times and costs, never what anyone pasted or got back, and no screen or tool shows another person's text.

To be exact about what that means: your text is stored in the app's database on our server, protected by the database's access rules but not separately encrypted. Someone with full control of that server could therefore reach it. We don't, except where the law requires it, and you can delete a summary, or your whole account, at any time.

Do not paste anything you are not allowed to share with a service like this, such as another person's private data or confidential documents you have no right to process.

To run the app: to sign you in, write and save your summaries, and show them back to you.

To keep it fair and affordable: limits per hour and per day, and spend caps, are counted from the usage records.

To keep it safe: sign-in attempts, confirmed emails, password resets, staff actions and errors are recorded so problems and abuse can be found and fixed.

We do not sell your data, show ads or use tracking or analytics tools.

Anthropic, as described above, for the text you send to be summarised.

Resend, which delivers our account emails (confirming your email address, setting a new password). It receives your email address, your name and the message itself, and nothing else: no summaries, no text. We turned its open and click tracking off.

The hosting provider (Contabo), whose server stores the database. It provides the machine; it does not use the data.

Cloudflare R2, which stores the nightly backup copy. The copy is encrypted on our server before it leaves, so Cloudflare holds it without being able to read it.

Staff of Distill (the owner, admins and moderators) see account details and usage metadata in the admin console to run the service. Every staff action is recorded with its reason.

Nobody else, unless the law requires it.

The database runs on one server in Singapore. Connections to it are encrypted (HTTPS).

Account emails are sent through Resend's servers in Tokyo.

The encrypted backup copy is stored by Cloudflare R2 in Europe.

Summaries stay until you delete them, or until you delete your account.

Devices sign out by themselves after 30 days without use.

Usage records, account events (sign-ins, confirmed emails, password resets) and staff actions are kept to keep limits, spend and the security record correct. When your account is deleted, they stay without any link to you.

Backups: the whole database is backed up every night, to restore the service if something goes wrong and for nothing else. Copies on the server are kept for 14 days and the encrypted copy off the server for 30 days, so something you delete can remain in a backup for up to 30 days before it is gone for good.

The web server's own logs, which include IP addresses, are kept for 14 days for security, then deleted. The app itself does not store IP addresses, and it does not look up where you are. (The places in the public admin demo are invented, like everything else there.)

Export: on your Profile, you can download everything in your account (your profile and every summary with its source) at any time.

Delete: on your Profile, Delete account removes your account, every summary and every device at once. It cannot be undone.

You can also delete single summaries from Saved at any time.

Sign-in: one cookie keeps you signed in. It holds a random token; only a hash of it is stored on the server.

Time zone and window height: two small cookies, so times show in your zone and lists fit your window.

Theme and motion: remembered in your browser's own storage.

There are no advertising, tracking or third-party cookies.

Distill is for people aged 18 and over.

If this policy changes, the new version and its date appear here before it applies.

Questions, or a request about your data: privacy@jeromebadour.com.