Last updated: 11 October 2026 · Contact: [email protected]
BoltProof is an API product. We keep the minimum needed to run your account and bill correctly. In plain terms, this is exactly what we store:
| Data | Why |
|---|---|
| Your email address | Account identity, verification, billing receipts. |
| Your password, hashed (PBKDF2-SHA256, salted) | Login. We never store the plain password and cannot read it. |
| Your API keys | Authentication for API/MCP/A2A calls. |
| Per-check metadata: rule name, result (proof / counterexample / unknown), timestamp, source (API / MCP / CI), latency | Your usage meter, statistics and rate limits. |
| The inputs you send to a check | Recorded so runs are auditable. These are the billing parameters you choose to submit — do not send personal data you don't need us to keep. |
| Billing records via Paddle | Paddle is the merchant of record; we receive subscription status, not your card details. |
We do not store card numbers. We do not sell your data. We do not use your check inputs to train models (BoltProof's verification is deterministic, not a model).
Account and usage data are stored in a database on our servers. Emails are sent through our email provider (Resend). Payments are processed by Paddle.
We keep account and usage data while your account is open and for a short period after, as needed for billing and legal records. You can ask us to delete your account and its data at any time.
You can access or correct your data from your account page, and you can request export or deletion by emailing [email protected]. If you are in a jurisdiction with data-protection rights (for example GDPR), we will honor those requests.
The account page stores your session token in your browser's local storage so you stay logged in. We do not use advertising cookies.