🔒 Privacy Policy

Last updated: February 27, 2026

PirateClaw, Inc. ("PirateClaw", "we", "our") operates the website pirateclaw.com and associated APIs. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

1. Information We Collect

Account Information: When you create an account, we collect your username, email address, and optional display name. If you connect a Web3 wallet, we store only the public wallet address — never private keys.

Payment Information: Payments are processed by Stripe and PayPal. We do not store credit card numbers, bank account details, or PayPal credentials on our servers. We store only transaction IDs and amounts for billing records.

Usage Data: We collect anonymized API usage logs (endpoint called, credits consumed, timestamp). IP addresses are never stored in cleartext — they are hashed using HMAC-SHA256 with a server-side secret before any logging or storage.

Cookies: We use essential cookies for authentication (session tokens). We do not use third-party tracking cookies or advertising pixels.

2. How We Use Your Information

To provide, maintain, and improve our marketplace services.
To process payments and manage your account balance.
To detect fraud, abuse, and enforce our Terms of Service.
To send transactional emails (purchase confirmations, API key delivery).
To generate aggregated, anonymized analytics for service improvement.

3. IP Address Privacy

We take IP privacy seriously. All IP addresses are hashed using HMAC-SHA256 before being stored or logged. This means:

We cannot recover your original IP address from stored data.
Rate limiting and fraud detection use hashed IPs only.
No raw IP addresses are ever sent to third-party AI services (e.g., Mistral).

4. Third-Party Services

We use the following third-party services:

Stripe – Payment processing (Stripe Privacy Policy)
PayPal – Payment processing (PayPal Privacy Policy)
Mistral AI – AI service backend (no personal data shared; only anonymized prompts)
Vast.ai – GPU compute provisioning (no user PII shared; only instance metadata)
Turso (libSQL) – Database hosting (Turso Privacy Policy)
Amazon Associates – Affiliate links for book recommendations (standard Amazon cookies apply when you click an affiliate link)

5. Data Retention

Account data is retained while your account is active. API usage logs are retained for 90 days. Transaction records are retained for 7 years for legal and tax compliance. You may request account deletion at any time by contacting us.

6. Data Security

We implement industry-standard security measures including:

HTTPS/TLS encryption for all communications.
Helmet.js security headers (CSP, XSS protection, HSTS).
Rate limiting on all API endpoints.
HMAC-SHA256 hashing of all IP addresses.
API keys securely generated and scoped to individual products.
SSRF protection on all outbound server requests.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data ("right to be forgotten").
Object to processing of your data.
Request data portability.

To exercise any of these rights, contact us at privacy@pirateclaw.com.

8. Children's Privacy

PirateClaw is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us:

Email: privacy@pirateclaw.com
Website: pirateclaw.com/contact