Privacy Policy

content_hash: e40e2cb1db3430f9

# Privacy Policy

**Operator:** CardSearch AI LLC ("Operator") operating Tokenmaxxing.  
**Version:** 2026-08-01

## What we collect

Account email · auth ids · mission/lease metadata · product_events · connector secret refs (encrypted vault path - Class B only) · billing Stripe customer ids when billing configured · consent records (`tmx_consent`) · support emails you send.

## What we do not do

We do not sell your data. We do not publish unredacted Usage receipts by default. We do not put VAULT_KEK / vault decrypt on Vercel Desk/MCP paths. We do not invent fake Live telemetry for marketing.

## How we use data

Operate missions and leases · meter Desk activity · seal Usage receipts on Hand Off · bill Pro via Stripe when configured · security/abuse response · product improvement via shadow Burn Brain only until promote flag (default OFF).

## Retention

Free product history **7 days** · Pro **90 days** · `product_events` **90 days** · `jobs` **14 days** · billing **7 years** (Legal/Database).

## Your rights / DSR

Export and delete via product Settings / API inventability. Mailbox: privacy@trytokenmaxxing.com · support@trytokenmaxxing.com. We respond within a commercially reasonable time.

## Cookies and CMP

See [/legal/cookies](/legal/cookies). Consent cookie inventability: `tmx_consent`. Essential auth cookies required for signed-in Desk.

## Subprocessors {#subprocessors}

| Vendor | Purpose |
| --- | --- |
| Vercel | Hosting / edge / cron |
| Supabase | Auth + Postgres |
| Stripe | Billing (when configured) |
| Fly.io | Class B workers (when deployed) |
| Resend | Email (when Live) |
| Axiom | Logs/metrics (optional Soft Hand Off) |

## Age

13+. Under-13 attempts blocked (age gate).

## Changes

Material Privacy changes bump version and may re-prompt consent for optional analytics.