Privacy Policy

This Privacy Policy (“Privacy Policy”) explains the information we collect, how we use and share it, how to manage your privacy controls, and your rights in connection with our website, our locally installed application, and our related testing and simulation platform (collectively, the “Services”) offered by Rystic Inc. (“Rystic,” “we,” “us,” or “our”). This Privacy Policy is incorporated into, and forms part of, our Terms of Service. For purposes of this Privacy Policy, “Personal Information” means any information relating to an identified or identifiable individual, and “Customer” has the meaning given to it in our Terms of Service.

We update this Privacy Policy from time to time so please review this Privacy Policy regularly. If we materially alter the Privacy Policy, we will notify you of such changes by posting a notice on our website and/or contacting you at the email address provided to us. Terms not otherwise defined in this Privacy Policy have the meaning given to them in our Terms of Service.

This Privacy Policy applies to Personal Information we collect from individuals who interact with the Services, including representatives of our Customers, prospective Customers, and visitors to our website. Our Services are intended for business use, and we generally do not collect or process Personal Information contained within a Customer’s own data, systems, or test environments.

Personal Information We Collect

The table below describes the categories of Personal Information we collect, examples of each category, and the source of that information.

We are not currently designed to collect special categories of sensitive Personal Information, and we ask that you not submit such information through the Services. As described in our Terms of Service, we do not collect the content of the environments our customers test against, and our enterprise deployment option is designed to operate without transmitting usage telemetry to us.

Your Content, AI Output, and Usage Data

In addition to Personal Information, the Services process other categories of data as described in our Terms of Service, including data, configurations, scenarios, scripts, prompts, agents, or models you submit to the Services (“Your Content”), output generated by or through the Services in response to Your Content (“AI Output”), and technical usage telemetry relating to your access to and use of the Services (“Usage Data”). This Privacy Policy addresses Personal Information. For information on how Your Content, AI Output, and Usage Data are owned, used, and protected, please see our Terms of Service.

How We Use Personal Information

The table below maps the categories of Personal Information described above to the purposes for which we use them.

How Personal Information is Shared

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising. We may disclose Personal Information to the categories of recipients described in the table below, each for the business purposes indicated.

We may preserve and share your Personal Information with third parties, including law enforcement, public or governmental agencies, or private litigants, if we determine that such disclosure is compelled by or reasonably necessary to comply with the law, including to respond to court orders, warrants, subpoenas, or other legal or regulatory process, or otherwise permitted by law. We may also retain, preserve, or disclose your Personal Information if we determine it is reasonably necessary or appropriate to protect our operations, property, or legal rights.

Cookies and Similar Technologies

We and our service providers may use cookies, pixels, and similar technologies on our website to operate the website, remember preferences, and understand how visitors use our website. We may use analytics tools to collect information such as pages visited, time spent, and navigation patterns. Our locally installed application does not use advertising cookies; usage telemetry from the application is limited to the categories described in the table above.

We do not currently sell or share Personal Information for purposes that would require a “Do Not Sell or Share My Personal Information” opt-out link, and we do not use Personal Information for cross-context behavioral advertising.

Your Legal Rights and How to Exercise Your Legal Rights

Privacy laws provide certain rights to users in certain jurisdictions. Below are rights that may be available to you under applicable laws.

• Access and Portability. You have the right to know, and request access to, the Personal Information we collect, use, share, or otherwise process about you.
• Right to Rectify, Restrict, and Delete. You have the right to rectify, restrict, or delete Personal Information, including by requesting that we correct inaccurate information or delete your Personal Information.
• Right to Object. Where we process your information based on our legitimate interests, you can object to this processing under certain circumstances.
• Right to Revoke Consent. To the extent we rely on your consent to engage in certain processing, you have the right to withdraw that consent at any time.

You may exercise these rights by contacting us using the information in the “Contact Us” section below. We will not discriminate against you for exercising any of these rights. We may need to verify your identity before responding to your request, and certain information may be exempt from these rights under applicable law.

California Residents

California residents have the rights described above under the California Consumer Privacy Act, as amended, in addition to the right to be informed of the categories of Personal Information collected and the purposes for such collection, as set out in the tables above. We do not “sell” or “share” (as those terms are defined under California law) Personal Information. If this changes in the future, we will update this Privacy Policy and provide any required opt-out mechanism.

• Privacy rights requests for non-customers. California privacy rights apply to all individuals, not just registered users. All such individuals who are California residents can request additional information about our privacy practices with respect to their information, as well as make the access, deletion, correction, and opt-out requests described above, by contacting us. Please provide sufficient information that we can identify you, and be aware that we may employ a more extensive authentication process to verify your identity before responding to your request.

Data Retention

We keep Personal Information for as long as you use the Services or otherwise authorize under this Privacy Policy, or as reasonably necessary or advisable to fulfill the purpose(s) for which it was collected, provide the Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, protect against fraud, enforce our agreements, and comply with applicable laws.

Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of your information and designed to protect against unauthorized access, use, or disclosure. If we become aware of unauthorized access to Personal Information that compromises its confidentiality or integrity, we will notify you without undue delay as required by applicable law. Nonetheless, the transmission of information via the Internet is not completely secure, and we cannot guarantee the security of data sent to us electronically. Transmission of such data, including Personal Information, is therefore entirely at your own risk.

If you have any concerns or questions about the processing of Personal Information under this Privacy Policy, please contact us via email at founders@rystic.ai.

International Users

We are based in the United States, and Personal Information we collect is primarily processed in the United States. As we expand our operations internationally, we may process and transfer Personal Information to the United States and other countries, which may have data protection laws that differ from those of your jurisdiction. Where required by applicable law, we will implement appropriate safeguards for such transfers.

Governing Law and Dispute Resolution

This Privacy Policy is governed by, and disputes arising out of or relating to this Privacy Policy are subject to the dispute resolution and governing law provisions set out in our Terms of Service.

Users Only of Legal Age of Majority

The Services are designed and intended for business users who have reached the age of majority (18 years of age). By accessing and using the Services, you affirm that you are at least 18 years of age or older. We are not liable for any damages that may result from a user’s misrepresentation of age. We do not knowingly collect, maintain, or use Personal Information from children under 18 years of age, and no parts of our Services are directed to children.

No one under the age of 18 is authorized to submit or post any information, including Personal Information, through the Services. If you learn that a child has provided us with Personal Information through the Services in violation of this Privacy Policy, please contact us at founders@rystic.ai.

Contact Us

You can contact us at founders@rystic.ai or 2099 Pacific Blvd Apt 214, San Mateo, CA 94403. We will respond within a reasonable timeframe or as required by applicable law.

Appendix: Details of Our Data Practices

This appendix forms part of this Privacy Policy. It describes in more detail what the Services collect today, who processes it for us and how long we keep it.

In short: while a metered simulator runs, its launcher tells us which product and version it is, when it started, and which of its half-minutes were active. These reports never send us the requests the simulator serves or their contents, your hostnames or usernames, or the users and data inside the service it simulates. Licensed (Enterprise) builds send no usage reports while they run.

The website

Vercel hosts this site. Like any web host, it sees your IP address when it serves a page. Vercel’s web analytics collects standard, aggregated request data, such as page views and coarse location, to keep the site running and understand traffic; it isn’t tied to your identity.

For each page request, our server also sends one event to PostHog: the page address, the referring page, your browser’s user agent and the request method. We don’t send your IP address with it, and PostHog’s location lookup is off.

On the documentation pages, your browser also reports a few reading signals to us: the code block you copy (the page, section, language and block number); what you type in the docs search and how many results it found; how far down a page you scrolled and how many seconds you spent reading it; and the link you followed off the page. Our docs MCP server, which AI assistants can query, records each tool call: the tool, the search text or page path, and how many results it found or whether the page exists. Search text is cut to 100 characters, and a search text or path that looks like a key or token is stored as “[redacted]”. We send each of these to PostHog with the user agent, without your IP address and without a profile that ties them to you, and PostHog’s location lookup is off.

Signing in sets the cookies Clerk needs to keep you signed in, and Stripe’s pages set their own. We don’t use advertising cookies or third-party trackers to build a profile of you.

The waitlist

If you join a waitlist, we collect the email address you submit, and nothing else. Resend stores it and sends our emails. We use it to tell you when access opens and to share occasional updates about Rystic, not for unrelated marketing.

Your account

Sign-in runs on Clerk. When you sign in with Google or GitHub, Clerk receives your name, email address and avatar from that provider, and keeps your org memberships, roles and invitations. Clerk also keeps the sign-in session records its service needs, under its own privacy terms. Our billing database refers to people and orgs only by Clerk’s IDs.

Billing

Stripe processes payments. Your card details go to Stripe and never touch our servers. Stripe also holds the billing details you give it, such as your billing address and tax ID, to issue invoices and to calculate tax with Stripe Tax. For each org we store its Stripe customer and subscription IDs, its plan, its payment status, its current billing period, its number of seats, and its spend cap and alert thresholds.

We also record each billing step as a PostHog event under your org’s ID, so we can see where teams get stuck: starting and completing Checkout (with the seat count), opening the billing portal, a change in the number of members, a saved spend cap and its alert thresholds, an API key created (its kind and first few characters) or revoked, overage reported to Stripe (the active time) and a spend alert sent (its threshold). PostHog also keeps your org’s name and URL slug with these events, so our metrics show a name rather than an ID. None of them carries a card, an email address or an IP address, and PostHog’s location lookup is off.

Tokens

For each token we store its label, its first few characters (so you can tell tokens apart), the SHA-256 hash of the whole token, the member it belongs to (none for a team token), who created it, and when it was created and revoked. We never store the token itself.

Installing the command-line tool, and the trial

Installing and updating. When the install script, or the rystic CLI’s rystic update or its update check, asks this site which release to download, we record one PostHog event: the operating system and processor architecture; the version asked for and the version we answered, or the error we refused with; whether the install carried an embedded license; whether it ran in a CI environment; whether it came from the install script or a self-update; and the request’s user agent. It isn’t tied to you or your account, we don’t send your IP address with it, and PostHog’s location lookup is off.

The no-signup trial. At the end of an install, the CLI can start a 15-minute trial without an account. It generates a trial token and presents it to this site. We keep the token’s SHA-256 hash and its first few characters (never the token itself); a trial org the token runs under, with no name or member; the trial’s start time and deadline; and a keyed hash of the network it came from (your IPv4 address, or the /64 block of an IPv6 address), so that one network can start one trial a day. We never store the address itself, and we clear the network hash after 24 hours. The trial’s simulators report to the lease server like any metered simulator, under the trial org. We record each trial started, or refused and why, as a PostHog event with the trial org’s ID, the trial’s length and the request’s user agent; it carries no email address, IP address, token or network hash.

What a metered launcher sends

A metered simulator runs under a launcher, which makes three kinds of call to our lease server; the simulator itself makes no lease-server calls. Every call carries the token in the Authorization header. The lease server hashes the token to look it up, and never stores or logs the token itself. Beyond the token, each call carries exactly these fields:

• When it starts: the product; its version; an instance ID, random for each process; its start time; and a registration ID, random for each registration.
• About every 30 seconds while it runs: the session ID we issued when it started; a sequence number, which is the latest half-minute it has completed; and the list of half-minutes since its last check-in in which it was active.
• When it stops: the session ID; the sequence number; the list of active half-minutes not yet reported; the reason it stopped (a normal shutdown, a stop we ordered, a lease that ran out, or an error); and whether more stop reports follow.

A half-minute is active if, during it, the simulator served a request to the API it simulates, held an open websocket that had a subscriber, sent a webhook or played a recording. The launcher works that out on your machine and sends only the result. It never sends request or response bodies, which endpoints were called, hostnames, usernames, scenario or network-profile contents, or the simulated service’s own users and data. A successful start or check-in returns a signed lease naming your org, the product and what your plan entitles it to, and it may carry a notice about your account. A successful stop report is acknowledged without a new lease.

Network addresses. The load balancer in front of the lease server writes an access log line for each call: the time, the network address and port it came from, the request line, the user agent and our response status. We keep those logs for 30 days to keep the service secure and working. The lease server itself doesn’t record the address.

What the lease server keeps

The lease server runs on Amazon Web Services. From these calls it keeps:

• A session for each simulator run: the token, org and member it ran under (no member for a team token); the product, version, instance ID and registration ID; the start request as first received and the answer we sent to it; when it started and when we last heard from it; the latest sequence number counted and the active time counted; and when and why it closed.
• Usage: the active time counted for each token in each of its org’s billing periods.
• A call archive: one record per call, with the time we received it; the session, org and token IDs; the token’s first few characters; the product and version; the sequence number; the active half-minutes reported and those counted; and our answer or the reason we refused. It never holds a token or a token’s hash. It is stored privately and encrypted, so that we can answer a billing dispute, and kept for 13 months.
• Session events: when a session starts and when it ends, the lease server sends one PostHog event under your org’s ID (the trial org’s, for a trial): the session ID; the product, version and edition; the plan it ran on; the token’s first few characters; and whether the org is one of our own test orgs. The end event adds how long the session ran, the active and billed time counted, the last sequence number and why it ended. These events never carry a token or a token’s hash, an IP address or a request body, and PostHog’s location lookup is off.

Downloads and the free edition

Licensed builds. A licensed (Enterprise) build sends no usage reports while it runs. When the rystic CLI downloads or updates one (on rystic pull, rystic update, the update check in rystic status, and rystic run for a simulator not yet installed), it sends us the license file with the product, version, operating system, processor architecture and the command. We record that exchange as one PostHog event: the licensee the license names, the product, version, operating system, architecture, command and time. No IP address, hostname or headers are kept, and PostHog’s location lookup is off. An exchange under a license issued with metrics off creates no download event.

Metered builds. When the CLI downloads or updates a simulator with an API key or a trial token (on the same commands), we record that exchange as one PostHog event under your org’s ID (the trial org’s, for a trial): the product, version, operating system, architecture, command, time and the key’s first few characters. The key itself is never recorded, no IP address, hostname or headers are kept, and PostHog’s location lookup is off.

The free edition, while we offer it. A download from this site records the product, version, operating system, architecture and time, with no identifier. A running free-edition simulator reports when it starts, hourly while it runs, and when it stops: the product, version, edition and built-in world; the operating system and architecture; a random installation ID it writes beside itself on first run; the event; the seconds since it started; and a count of requests per API route and per control endpoint, never the requested path. We don’t store the IP address a report comes from, and PostHog’s location lookup is off.

Email

Resend delivers our email: waitlist mail, spend-cap alerts and billing notices. It receives the address and the message.

Who processes it

These providers process data on our behalf, under their own security and privacy terms:

• Clerk: sign-in, accounts and org membership.
• Stripe: payments, invoices, tax (Stripe Tax) and the Customer Portal.
• Amazon Web Services: the lease server and its load balancer’s access logs, the billing database and the call archive.
• Resend: email.
• Vercel: hosting this site, and its web analytics.
• PostHog: the events described above: this site’s request log and docs events, install and trial events, download events, billing events, the lease server’s session events and free-edition reports.
• Grafana Cloud: operational metrics and logs.
• GitHub: storage for release downloads. When you download a build, the file comes from GitHub’s storage.

How long we keep it

• Account, org, billing and token records: while the account or org exists, and after that as described below.
• Session and usage records: with the billing records for the periods they were billed in.
• The call archive: as stated above.
• The lease server’s load balancer access logs: 30 days.
• A trial’s network hash: 24 hours.
• Every event in PostHog: 12 months.

Exporting and deleting your data

Export. Email us from your account’s address and we’ll send you a copy of your account’s data: your profile, your orgs and their members, your tokens (never a token itself), and your sessions and usage.

Delete. You can delete your account, or an org you administer, or ask us by email to do it. We then delete your profile from Clerk and revoke your tokens. We keep what we must for tax and dispute records: invoices and payment records, at Stripe and in our books, for seven years; and the org’s billing, session and usage records and its call archive until the dispute window for its last invoice closes. After a deletion, those records refer to you only by internal IDs.

Waitlist. You can unsubscribe at any time with the link in any email we send, or by emailing us, and we’ll delete your email address from our records on request.

Enterprise

Licensed builds send no usage reports to Rystic while they run. A license issued with metrics off suppresses the download event described above; ordinary website records still apply when you visit this site. The Kalshi simulator can separately fetch a replayed market’s metadata from Kalshi, as its documentation describes; that request goes to Kalshi, not Rystic, and can be disabled. A signed agreement may add to this policy.