Privacy policy

Effective September 24, 2026

This policy explains how Schematic Research, Inc., a Delaware corporation (“Schematic,” “we,” or “us”) handles personal information in Schematic Platform, the Pup service, and related support. It also describes how submitted code and verification data are handled because that material can contain personal information. Contact support@schematic.tech with privacy questions or requests.

Information we collect

Account and Google sign-in information. We receive your Google account identifier, email address, and information confirming that Google verified the email. We use Google’s sign-in response to authenticate you.
Account security information. We keep information used to secure and manage your account, including sign-in records, API-key names and identifiers, and key creation and revocation activity.
Material you submit through Pup. This can include source files, repository names and identifiers, file paths, revisions, supertest declarations, properties, and other context included in an upload. Source files can contain personal information or confidential business information. Submit only material you are authorized to share.
Verification and usage records. We generate and store check histories, results, explanations, evidence, proposed changes, timestamps, status, diagnostic information, and token-usage measurements associated with your account and repositories.
Technical and support information. Our infrastructure processes request information such as IP address, browser or client details, time, and error information. If you contact us, we receive the correspondence and material you choose to include.

How we use information

We use this information to create and secure accounts, authenticate requests, run requested checks, deliver results and saved history, display usage, provide support, investigate faults and misuse, and meet applicable legal obligations. Where privacy law requires a legal basis, these purposes may involve performing our agreement with you, legitimate interests in operating and securing the service, legal obligations, or your consent where required.

We use Google sign-in information to authenticate and manage your Schematic account. We do not use Google sign-in information to train AI models, sell it, or use it for advertising. We do not sell personal information or share it for advertising across unrelated websites.

Source code and AI processing

Pup processes the source and context you submit to perform software verification. Relevant source, instructions, and intermediate results may be sent to AI providers used for that work. These services can generate explanations and proposed changes as well as assist verification.

AI providers process submitted material under the terms and data-handling policies applicable to the services we use, including their retention and training practices. Contact us to discuss any specific processing or confidentiality requirements before submitting your data. Do not upload passwords, access tokens, or personal information that is unnecessary for a check.

Who receives information

We use Google for sign-in and Google Cloud for service hosting, databases, storage, and operational logging. Cloudflare provides domain and DNS infrastructure. We use OpenAI and other AI service providers to process submitted material for software verification.

Authorized personnel and service providers may access information as needed to operate, secure, and support the service. We may disclose information when required by law, to respond to a valid legal request, to protect people and the service, or in connection with a business transfer subject to appropriate confidentiality protections and applicable law. We do not make private repositories or account records publicly available through the platform.

Processing locations

Our principal service infrastructure is located in Australia. Sign-in, DNS, support, and AI services may process information in the United States and other countries where their providers operate. Contact us to discuss any data residency requirements before submitting your information.

Cookies and browser storage

We use essential cookies to keep you signed in and secure the sign-in process. Session cookies expire within seven days. We also use browser storage to remember your interface preferences. We do not use advertising cookies in the platform.

We use Google Analytics on our website, documentation, and platform to understand page visits, traffic sources, and interactions with our sites. Analytics starts when a page loads and uses first-party cookies to recognize a browser across visits and our sites. Google receives information about pages viewed and interactions such as scrolling, link clicks, downloads, and form submissions, along with browser and device details. We do not send account details, form field contents, submitted source code, or authentication tokens as analytics event data. For more information about Google's processing, see How Google uses information from sites or apps that use its services.

Retention and deletion

We retain account information and submitted material as needed to provide the service, preserve requested check history, resolve support matters, maintain security, and meet legal obligations.

To request account closure or deletion, email support@schematic.tech. We may ask you to verify your identity and authority for the relevant account. We will explain any information that must be retained and the applicable reason. Copies in backups or third-party systems may take additional time to expire under their retention arrangements.

Disconnecting your Google account, signing out, or revoking an API key does not delete information already held by Schematic. You may request deletion by contacting us as described above.

Your choices and rights

You can revoke API keys in the platform, log out of your browser session, and manage Schematic’s Google connection in your Google account. Depending on applicable law, you may also be entitled to request access, correction, deletion, a copy of your information, restriction of processing, or to object to processing or withdraw consent. Withdrawing consent does not make earlier lawful processing unlawful.

Send privacy requests or complaints to support@schematic.tech. We will assess your request under applicable law and explain any limitation. You may also contact the privacy regulator where you live. In Australia, that is the Office of the Australian Information Commissioner.

Security and intended users

We use technical and organizational measures to protect information, including encryption in transit and access controls. No system is completely secure. Protect your keys and contact support promptly if you suspect unauthorized access. The service is intended for developers and organizations able to enter a binding service agreement, not for collecting information from children.

Changes to this policy

We will update the effective date when this policy changes and provide a prominent website or platform notice for material changes. If a change requires consent under applicable law, we will obtain it before applying the change. A separate signed data-processing or service agreement may provide additional protections for your organization.

Our registered office is Corporation Trust Center, 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, United States. Please direct privacy and support requests to support@schematic.tech.