Privacy Policy

AI Points Lab is an independent project that rewards you with points for the AI subscription limits you already burn. This page explains exactly what we store, why, and how to get rid of it. Questions and requests: odddux@proton.me.

What we collect

• Your email address — to identify your account and send the six-digit sign-in code.
• Your AI vendor account identifier — the ID Claude, Codex, Cursor or Grok uses for your account. It is what stops the same subscription from being connected to a second profile to farm points twice.
• Your plan tier — Pro, Max and so on, because it sets the rate at which points are earned.
• Usage snapshots — how much of a limit window you have burned as a percentage, when that window resets, and when the reading was taken.
• Device name and platform — so you can tell your own devices apart, and so we can spot one subscription being spread across several accounts.
• Your IP address — used only to rate-limit requests, detect abuse, and derive your approximate country. Only the country itself — a two-letter code — is stored, for aggregate analytics and abuse prevention. The IP address it was derived from is not.

What we never collect

• Vendor access tokens. They are created on your device, stored in your device’s Keychain and used only there. They are never sent to our servers.
• Anything you do inside those tools. No prompts, no conversations, no code, no file names, no project names. The app reads usage counters, nothing else.

Why we are allowed to hold it

Your email, vendor account identifier, plan tier and usage snapshots are needed to run the account and the points you asked for — that is the contract between us. IP addresses and the one-way hash of your vendor account are kept on the basis of legitimate interest: without them the points economy can be farmed by anyone willing to open a second account.

Who else processes it

Railway hosts the application and the database. Vercel hosts this website. Resend delivers the sign-in emails. We do not sell your data, and we do not share non-aggregated usage data with anyone.

How long we keep it

Your email address, your device names and your vendor account identifier are kept while your account is open, and erased the moment you delete it. The devices themselves stay on as revoked, nameless records. Usage snapshots, the points ledger and your order history are kept for as long as the points economy needs to be auditable, and they survive deletion in a form that no longer names you. The one-way hash of your vendor account is kept indefinitely: it is the only thing that stops the same subscription from being reconnected to earn the same points twice. A sign-in code stops working after ten minutes, but the record that one was requested — the email address it was sent to and the device name given with it — is kept until an account with that email address is deleted. IP addresses live in our hosting provider's server logs and are kept for as long as that provider retains them.

Deleting your account

Open the app and go to Account, then choose Delete account. It takes effect immediately:

• your email address is erased and replaced with a placeholder that identifies nobody;
• every device is signed out and its name erased;
• your vendor account identifier is erased.

Some records survive, and none of them carry your name or your email. The points ledger, your order history, the usage snapshots behind them and your points balance stay, because the ledger is append-only by design — it is what makes the points economy auditable. A one-way hash of your vendor account also stays, so the same subscription cannot be reconnected later to earn the same points again. That hash cannot be turned back into your account, but it is not anonymous either: recognising a repeat connection is exactly what it is for.

Deletion is permanent. Signing up again with the same email creates a new profile and needs a new invite.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it — write to odddux@proton.me and we will answer within 30 days. If you are in the EU or UK and you are unhappy with how we handled a request, you can complain to your national data protection authority.

Children

AI Points Lab is not intended for anyone under 16.

Changes

If this policy changes, we update this page and the date at the top. Material changes are announced in the app.