Privacy Policy

Effective date: to be set at public launch.

This Privacy Policy describes how Network Crusader (“Network Crusader,” “we,” “us,” or “our”) collects, uses, stores, and protects information about you when you use the Network Crusader platform and services (the “Service”).

Please read this policy carefully. By using the Service, you agree to the practices described here.

1. Who We Are

Network Crusader operates this Service. For privacy inquiries, contact us at gregory@digitalrooftop.com. Our mailing address is pending legal review.

2. Information We Collect

2.1 Account Registration Information

When you create an account, we collect:

• Email address — required for authentication and service communications
• Display name — optional; defaults to the portion of your email before @
• Avatar URL — optional; provided by you or via an OAuth provider (if applicable)
• Password — handled entirely by Supabase Auth; Network Crusader does not store, access, or process your password directly

2.2 API Keys (BYOK — Bring Your Own Key)

Network Crusader operates on a Bring Your Own Key (BYOK) model. You provide API keys from third-party AI providers (such as OpenAI, Anthropic, OpenRouter, or others you configure) to enable content generation.

How we handle your API keys:

• Your API key is transmitted over HTTPS (encrypted in transit)
• Upon receipt, your key is immediately encrypted using AES-256-GCM encryption before being stored in the database
• The encryption key is stored separately from the encrypted data
• The plaintext API key is never stored in the database, never logged to disk, and never transmitted back to your browser after initial submission
• The key is decrypted in memory only at the moment an API call is made to your provider, then immediately discarded
• A masked representation (last 4 characters) is stored for your reference only
• You may delete your API keys at any time; deletion is permanent and irreversible

What we cannot do with your API keys:

• We cannot retrieve or display your full API key value
• We cannot access your provider account, billing settings, or account information beyond what the specific API endpoint requires
• We cannot modify your provider account settings or spending limits

2.3 WordPress Site Credentials

If you connect a WordPress site, we collect:

• Site URL — stored in plaintext
• WordPress username — stored in plaintext (not considered sensitive)
• WordPress Application Password — encrypted using AES-256-GCM (same scheme as API keys); plaintext is never stored

2.4 Content and Usage Data

When you use the Service to generate content, we collect and store:

• Job configuration — the parameters you supply (topic, keywords, word count, tone, model selection, etc.)
• Generated content — the full text of articles generated using your API key
• Generated images — temporarily stored when AI image generation is enabled for a job
• Job metadata — status, timestamps, credits charged, tokens consumed, model used
• Published content URLs — if you publish to WordPress, we store the resulting URL

2.5 Credit and Transaction Data

• Credit balance — current spendable credits associated with your account
• Transaction history — an immutable ledger of all credit events (grants, usage deductions, refunds, adjustments), including amounts, timestamps, and descriptions

2.6 Link Packs

If you use the Smart Links feature, we store:

• Link URLs, anchor text, keywords, and configuration settings you provide

2.7 Scraped Content Cache

If you use features that scrape external URLs (e.g., Content Reforge), we temporarily cache scraped content to avoid redundant requests. Cached data is subject to our retention schedule.

2.8 Automatically Collected Technical Data

We automatically collect:

• IP address — for security, abuse prevention, and rate limiting
• User agent / browser information — for compatibility and fraud detection
• Session tokens — managed by Supabase Auth; used to authenticate your requests
• Error logs — application errors for debugging (do not contain your API keys or content)
• Job queue telemetry — job processing times and failure rates (aggregated, not linked to personal content)

We collect first-party usage analytics — page views, scroll depth, feature and call-to-action clicks, and signup funnel events — sent to our own /api/analytics endpoint to understand how the Service is used. We do not use third-party advertising trackers, tracking pixels, or behavioral advertising cookies.

3. How We Use Your Information

We use the information we collect to:

We do not:

• Sell your personal data to third parties
• Use your generated content to train AI models
• Use your API keys for any purpose other than executing jobs you submit
• Share your data with other users

4. Data Sharing and Third Parties

4.1 AI Providers (Critical — BYOK Model)

This is the most important disclosure in this policy.

When you submit a generation job, the content of your request (prompts, keywords, configuration) is transmitted from Network Crusader’s servers to the AI provider associated with your API key (e.g., OpenAI, Anthropic). This transmission:

• Uses your API key — the request is authenticated under your account with that provider
• Is governed by the AI provider’s terms of service and privacy policy, not Network Crusader’s
• Means the AI provider’s data retention and usage policies apply to the prompt and response content

You are responsible for reviewing and accepting the terms of your chosen AI provider(s). Network Crusader is not responsible for how AI providers handle data transmitted under your API key.

4.2 Infrastructure Providers

We use the following infrastructure providers who may process your data:

4.3 Payment Processor (Planned)

When payment processing is added:

• A dedicated payment processor will handle payment card data directly; Network Crusader will not store or handle raw payment card data
• This section will be updated prior to enabling payment functionality
• A separate PCI-DSS compliance posture will be established

4.4 Legal Disclosures

We may disclose your information when required by law, legal process, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Security

We implement the following security measures:

• Encryption at rest: API keys and WordPress credentials encrypted with AES-256-GCM + HKDF key derivation
• Encryption in transit: All data transmitted over HTTPS/TLS
• Tenant isolation: Row-Level Security (RLS) enforced at the database level — you cannot access another user’s data
• Access controls: Production database access is restricted; plaintext API keys are not accessible to staff through normal database queries
• Secrets management: Encryption master keys stored separately from encrypted data, never committed to version control

Despite these measures, no system is 100% secure. In the event of a security incident affecting your data, we will notify you as required by applicable law.

6. Data Retention

Summary of our retention periods:

7. Your Rights

7.1 All Users

Regardless of where you are located, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your generated articles and job history
• Delete individual API keys at any time from the API Keys settings page

7.2 GDPR Rights (EEA, UK, and Switzerland Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the GDPR:

• Right to data portability — receive your data in a machine-readable format
• Right to restriction of processing — request that we limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent
• Right not to be subject to automated decision-making with legal effects

To exercise any GDPR rights, contact: gregory@digitalrooftop.com

We will respond to verified requests within 30 days (extendable by 60 days for complex requests, with notice).

7.3 California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, including:

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete your personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your rights
• Right to correct inaccurate personal information

To exercise California rights, contact: gregory@digitalrooftop.com

7.4 Account Deletion and Data Export

To delete your account, use the Delete Account option on the Settings page. Upon deletion, your profile, API keys, generated articles, and job records will be permanently deleted within 30 days. Credit transaction records may be retained for 7 years for financial record-keeping purposes even after account deletion.

To request a data export, contact us at gregory@digitalrooftop.com and we will provide an export of your data.

8. Children’s Privacy

The Service is not directed to children under the age of 16 (or 13 in the United States). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at gregory@digitalrooftop.com and we will delete it.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your home country, including the United States. Where we transfer data from the EEA, UK, or Switzerland to countries not deemed adequate under applicable law, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Cookies and Tracking

We use the following cookies:

UI preferences (such as your theme choice) are stored in your browser’s local storage, not in cookies. We do not use advertising or behavioral tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notification at least 30 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints:

Email: gregory@digitalrooftop.com
Mailing address: Network Crusader, Attn: Privacy — mailing address pending legal review.

Appendix A — Data Processing Summary