Privacy Policy.

• Account: your email address (sign-in, receipts).
• Usage ledger: per-run metadata — skill, timestamp, amount, status — so your receipts and disputes work.
• Payments: handled by Stripe; we receive confirmation events, never your card number.
• Run inputs/outputs: processed in the sealed session and discarded on teardown — we do not retain them, train on them, or share them with publishers.

• Train models on your inputs, outputs, or any publisher's skill body.
• Sell personal data.
• Show a publisher what you ran through their skill.

Named subprocessors and what they touch: Stripe (payments), the model API provider (run execution), email delivery (sign-in links, receipts), and infrastructure hosts. We limit each processor to the role needed to operate the marketplace.

Run inputs: not retained (destroyed with the session VM). Ledger and receipts: retained for accounting, tax, abuse-prevention, dispute, and security obligations. Account deletion: email support; eligible unused cash balance can be requested back under the refund policy.

We use first-party, fixed-code telemetry to understand whether the public site and marketplace are working. Static pages send only an allowlisted event code, such as a page view or marketplace click. App pages may also include a public skill id and whether the browser is signed in.

Telemetry does not include emails, support messages, URLs, referrers, search terms, buyer inputs, model outputs, API keys, wallet secrets, or skill bodies. We do not use third-party analytics scripts on these pages.

Access/export/deletion requests and regional privacy questions can be sent to privacy@sealed.run. We use the request metadata needed to verify and respond to the request.