Privacy Policy

Trialytic is operated by Fedor Lipskerov, sole trader, based in Israel. For any privacy question, or to exercise the rights below, write to fedorlipskerov@gmail.com.

Only what running accounts and subscriptions requires:

• Account details — your email address, your name if you give one, and your password, which is stored only as an Argon2id hash. We cannot read your password.
• Sessions — when you sign in we store a hash of your session token, never the token itself, plus its expiry.
• Security log — sign-ins, sign-outs, password changes and failed attempts, with the IP address they came from. This is what lets us detect someone attacking your account.
• Usage counts — how many analyses and exports you have run, to enforce the limits of your plan.
• Subscription status — mirrored from Lemon Squeezy so the product knows what you are entitled to.
• Your content — saved searches and similar items you create.

We do not ask for and do not hold health data about you, and nothing you search for is treated as information about your own health.

• We do not sell personal data, and we do not share it for advertising.
• We run no third-party analytics, advertising or session-recording scripts. There is no Google Analytics, no advertising pixel and no tracker on this site.
• We never receive or store your card details — see payments below.

Trialytic sets two cookies, both strictly necessary, both first-party, and neither used for tracking:

• a session cookie, so you stay signed in. It is httpOnly, so page scripts cannot read it.
• a CSRF token cookie, which stops another site submitting actions as you.

Because neither is used for advertising or analytics, there is no consent banner to click.

Payments are processed by Lemon Squeezy as merchant of record. They collect and process your payment details and billing address under their own privacy policy, and send us only what we need to grant access — your subscription status, plan and renewal dates.

• Lemon Squeezy — payments, invoicing and tax, as merchant of record.
• Resend — transactional email only: address confirmation and password resets. No marketing email is sent through it without asking you first.
• Our hosting provider — the server that runs the application and its database.

Account details for as long as your account exists. Sessions until they expire or you sign out. Security-log entries and usage counts for a limited period, and billing records for as long as tax law requires us to keep them. Ask us to delete your account and we will remove your personal data except what we are legally required to retain.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to fedorlipskerov@gmail.com and we will respond within 30 days. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

If this policy changes materially we will say so by email or in the product before the change takes effect.