Draft, pending owner approval. Last updated 14 November 2026.
Data handling
This page describes, in plain terms, how we handle data on the Datarithms site as it runs today.
Today
- Data is stored in one PostgreSQL database on a server in the United States, rented by Pyramid Works LLC from Hivelocity and managed with self-hosted Coolify.
- All traffic to the site is encrypted in transit with HTTPS.
- Passwords are stored only as bcrypt hashes. We cannot read your password.
- Password setup links are single use, expire after 24 hours, and are stored only as a hash.
- IP addresses are not stored in our database; we keep only a keyed one-way hash to limit abuse.
- Sign-in is locked for an email address after 10 failed attempts within 15 minutes.
- Only administrators of Pyramid Works LLC can see early-access requests and the account list.
How long we keep data
| Data | How long we keep it | Why this long |
|---|---|---|
| Early-access request (work email, company, monthly ad spend range, company or agency) | Deleted automatically 365 days (about 12 months) after we receive it, or earlier if you ask. | So we can reply to you while early access runs. |
| IP address hash on an early-access request | Removed from the request automatically after 30 days. | Only needed for short-term abuse review. |
| Form submission records (IP address hash, time) | Deleted automatically after 7 days. | The hourly submission limit needs one hour; the rest is for abuse review. |
| Sign-in attempt records (email, IP address hash, time, success or failure) | Deleted automatically after 30 days. | The lockout looks back 15 minutes; the rest is for reviewing security incidents. |
| Password setup links (stored only as a hash) | Stop working after 24 hours; deleted automatically 7 days after that. | A short time to explain why a used or expired link no longer works. |
| Account (email, password hash, role, created and last sign-in time) | While the account exists; deleted within 30 days after you ask or after the account is closed. | Needed for the account to work. |
| Session cookie | 8 hours in your browser; removed when you sign out. | Keeps you signed in. |
| Server logs (time, requested page, response status, IP address) | [up to 30 days; server setting to be confirmed by the owner] | To run the service and investigate attacks. |
| Privacy requests and our replies | 3 years after the request is closed. | To show that we answered on time. |
[If database backups are kept: deleted data leaves the backups within the backup retention period, to be confirmed by the owner.]
Periods marked "automatically" are applied by a deletion job that removes or anonymises rows once their period has passed. [The daily run of the deletion job is not scheduled yet; the owner will set it up.]
When the product connects to your accounts
- We will read ad-account and payment data only after you authorise each connection.
- Access will be read-only. Nothing is changed in your ad accounts without your approval.
- Your data is used only to produce your reports and plans. It is never sold.
- You can disconnect a source at any time, and we delete your data on request.
What we do not claim
We do not hold security certifications such as SOC 2 or ISO 27001 today. If that changes, this page will say so.
Questions and deletion requests
Write to privacy@datarithms.io. See the Privacy notice for your rights and how we answer.