Where your data goes
As of September 9, 2026 · Each claim below was checked against Toolroom’s actual code: the routes, logs, and analytics calls. The legal detail lives in the Privacy Policy.
Your prompts go to exactly one AI provider: Anthropic.
Everything you type into Scope, lessons, and Skills — text, documents, photos — is sent to Anthropic’s Claude API to generate your draft. No other model provider receives them, and Anthropic’s commercial terms bar training on them.
Until you sign in, your work lives in your browser.
Progress, streaks, saved prompts, your voice profile, and interview answers sit in your device’s local storage — anonymous use writes none of it to our database.
Signing in is the only thing that stores your work on our servers.
An account stores your email plus a sync snapshot of that same on-device work (so you can resume on another device) in our Postgres database, hosted on Railway.
Analytics can never carry your writing.
Every analytics event is a name, an id, a score, or a count — autocapture is off, session recording is off, and we verified call-by-call that no event includes prompt text or drafts.
Error monitoring gets errors, not your prompts.
When something breaks, Sentry receives the error and request metadata — never the text you typed or the draft that came back — and replay is disabled.
Server caches are short-lived and memory-only.
Scoring keeps a small in-memory cache of recent results so re-scoring the same prompt is instant, and the permit lookup caches resolved addresses for 24 hours — nothing in these caches is written to disk, and they vanish on every deploy.
The permit lookup sends your address to one place: the US Census Bureau.
The address you type is geocoded by the Census Bureau’s public service to find its jurisdiction — it is sent with no account information attached.
We only get your email when you hand it to us.
Sign-in links (sent via Resend), the optional email field on feedback, and the team-plan form on the pricing page are the collection points. The “join the waitlist” button is a plain mailto link that opens your email app. The team form sends exactly the five fields you type — name, work email, organisation, roster size, state — to our server, which stores them in Postgres and emails them to us; nothing on the page captures an address you did not type into it.
Rate limits and run meters count; they don't read.
Abuse protection uses per-IP counters held in memory and signed cookies that carry a number and a timestamp — never the content of a run.
No sale of data. No ad trackers.
There is no advertising integration, no data broker, and no cross-site tracking anywhere in the product.
The pipes: Railway behind Cloudflare, all HTTPS.
Hosting runs on Railway, fronted by Cloudflare for DNS and TLS — the standard infrastructure logs (IPs, URLs) those platforms keep are listed as processors in the Privacy Policy.
Your side of the deal
The biggest privacy lever is what you paste. The free lesson What customer paperwork is safe to paste teaches the 30-second redaction test before anything goes into any AI — this one or anyone else’s. And you can ask us to delete your account data any time: [email protected].