Privacy Policy

1. Scope

This Policy applies to information collected through the Service, including the Research mode at /, the Philosophy mode at /thinking, and any read-only share pages generated by either mode. It does not apply to third-party services to which the Service may link, which are governed by their own privacy policies.

2. Information we collect

We collect only the information needed to operate the Service. We do not require account creation, do not request an email address, and do not collect personal identifiers beyond what is described below.

a. Information you submit

• Conviction or belief text.The sentence you enter into the Service’s input field, used to generate a structured artifact (an investment thesis or philosophical worldview).
• Generated artifacts. The structured output produced by our generation pipeline, stored under a randomly assigned, unlisted slug.
• Feedback submissions. Optional free-text feedback, with a self-selected category (general feedback or bug report), submitted through the in-product feedback form.

b. Information collected automatically

• IP address. Used solely as a key for request-level rate limiting (currently 10 generations per IP per 24 hours). Not associated with the artifacts you generate, and not retained for analytics purposes.
• Standard request metadata. User agent, referrer, request timestamp, and response status, as logged by our infrastructure provider for operational purposes (security, performance, error diagnosis).
• Aggregate usage data. Vercel Web Analytics surfaces anonymized, aggregated metrics such as page view counts, country, and device class. This data is not joined to specific users or specific generated artifacts.
• Google Analytics 4. The Service uses Google Analytics (measurement ID G-KQK4KMYYT3) to measure aggregate traffic patterns: page views, referrer source, approximate location (country / region derived from IP, then discarded), device class, and session duration. Google Analytics is loaded only in production builds. We do not associate Analytics data with the conviction text you submit or with the generated artifacts you produce.

3. How we use information

We process information for the following purposes:

• Service delivery. Generating the requested thesis or worldview, persisting it under an unlisted slug so the share URL works, and rendering it back to anyone who has the URL.
• Rate limiting and abuse prevention. Applying per-IP request limits, blocking obvious abuse patterns, and protecting the Service from automated misuse.
• Product improvement. Reading feedback submissions to identify bugs and prioritize improvements. Reviewing aggregate usage to understand what is working.
• Legal compliance. Responding to lawful requests, enforcing our Terms, and protecting the rights, property, or safety of users or the public.

4. Legal bases for processing (GDPR / UK GDPR)

For users located in the European Economic Area, the United Kingdom, or other jurisdictions with similar requirements, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) for processing necessary to provide the Service you requested.
• Legitimate interests (Art. 6(1)(f)) for rate limiting, abuse prevention, security monitoring, and aggregate usage analytics.
• Consent (Art. 6(1)(a)) where consent is required by law and where you provide it (for example, non-essential cookies, if any are introduced in the future).
• Compliance with a legal obligation (Art. 6(1)(c)) where applicable.

5. Service providers and recipients

We share information only with the service providers required to operate the Service, each acting as a processor under our instructions. We do not sell personal information and we do not share information with third parties for their independent advertising purposes.

• Vercel Inc. Hosting, content delivery, request logging, and aggregate Web Analytics.
• Google LLC (Google Analytics 4). Aggregate traffic measurement on production pages. Loaded via gtag.js. Google Analytics processes IP address, user agent, and page-view metadata to derive aggregate metrics; we do not configure Google Analytics to receive your submitted text or generated artifacts.
• Upstash, Inc. Managed Redis storage for generated artifacts and feedback submissions.
• Google LLC.Inference for the generation pipeline via the Gemini API. Submitted text is sent to Google for the purpose of returning the generated output. Per Google’s API terms in effect on the effective date, Google does not use API request content to train its models.
• Financial Modeling Prep, Twelve Data, and the Federal Reserve Bank of St. Louis (FRED). Market and macroeconomic data providers used by Research mode. We do not transmit your conviction text to these providers; we only request market data using the validated tickers produced by the generation step.

We may also disclose information when required by law, court order, or other valid legal process, or to protect the rights, property, or safety of Wellow, our users, or others.

6. Data retention

• Generated artifacts (theses and worldviews) are retained for ninety (90) days from creation, then automatically deleted. The unlisted share URL stops resolving once the underlying record is deleted.
• Feedback submissions are retained for three hundred sixty-five (365) days from submission, then automatically deleted.
• IP addresses used for rate limiting are stored only for the rolling rate-limit window (currently 24 hours) and then expire automatically.
• Operational logsretained by our hosting provider follow that provider’s standard retention schedule.

You may request earlier deletion of any artifact or feedback record by contacting us at the address in Section 13 with the relevant slug or context.

7. International data transfers

Wellow operates globally. Information processed by the Service may be transferred to, stored at, or processed in the United States or other jurisdictions where our service providers operate. These jurisdictions may have data protection laws different from those in your home jurisdiction. Where required, we rely on appropriate transfer mechanisms (such as the Standard Contractual Clauses approved by the European Commission) to safeguard cross-border transfers.

8. Your rights

Depending on your jurisdiction, you may have the following rights with respect to information that identifies you:

• Access: the right to know what information we hold about you.
• Correction: the right to correct inaccurate information.
• Deletion: the right to request deletion of information we hold about you.
• Restriction: the right to restrict processing in certain circumstances.
• Portability: the right to receive a copy of certain information in a structured, commonly used, machine-readable format.
• Objection: the right to object to processing based on legitimate interests.
• Withdrawal of consent: where processing is based on consent, the right to withdraw consent without affecting the lawfulness of prior processing.
• Lodging a complaint: the right to lodge a complaint with your local data protection authority.

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), including the right to know, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any of these rights, contact us at work@designwithorbital.com. Because we collect minimal information and do not require accounts, we may need additional context (such as the specific share URL or slug) to locate the records relevant to your request.

9. Cookies and local storage

Wellow does not set advertising cookies and does not participate in any cross-site advertising network. The Service uses cookies and local storage as follows:

• Google Analytics cookies (e.g. _ga, _ga_*) are set on production pages to support aggregate traffic measurement. These are first-party cookies set by gtag.js; they expire automatically (typically up to two years for the client-id cookie).
• Local storage is used for one purpose: remembering whether the first-visit announcement of the Philosophy mode has been dismissed, so the announcement does not reappear on subsequent visits.
• Strictly necessary technical cookies set by our hosting provider (for example, a load-balancing cookie) may be present and are exempt from consent requirements under most laws.

10. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect information against unauthorized access, alteration, disclosure, or destruction. Examples include TLS 1.2 or higher for data in transit, restricted-access infrastructure, and time-limited storage. No method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security.

11. Children’s privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to the Service, contact us at the address in Section 13 and we will take prompt steps to delete it.

12. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will revise the “Effective date” at the top of this page and, where appropriate, provide additional notice through the Service. Your continued use of the Service after the effective date of an updated Policy constitutes acceptance of the changes.

13. Contact

For privacy questions, requests to exercise your rights, or other matters related to this Policy, contact us at work@designwithorbital.com. We will respond within the timeframes required by applicable law.