Rivalatch Privacy Policy (operator draft)

1. Status

This page is an operator-owned draft for the public Rivalatch product front door. It is not legal advice, not a DPA, and invents no final company entity claims. Operator: Contravious Battle / ConWan30.

2. What the service handles

Rivalatch is an acceptance gate (gate.run / gate.status / gate.get_result) served over HTTPS MCP. Callers authenticate with an API key (X-Api-Key / VIBEGATE_API_KEY). Wire identifiers remain VibeGate.

• API keys: used only to authorize requests. Do not embed keys in public pages, tickets, or chat. Keys are compared server-side; this HTML never stores or displays them.
• Job payloads: request bodies for gate knocks (checks, criteria, app refs, idempotency keys) are processed to schedule and recall jobs and to detect Occupied/Contested conflicts.
• Results / artifacts: terminal GateResult data and job-scoped artifacts may be retained so callers can poll status and fetch results.
• Logs: operational logs may include request metadata (timestamps, status codes, job ids, redacted errors). Operators aim not to log raw API key values.

3. Retention (high-level)

Job store records, payloads, results, and related logs are retained while the operator needs them for debugging, idempotent recall, and service operation — typically on the order of days to weeks for routine data, subject to host capacity and operator cleanup. There is no separate consumer marketing database. Exact windows may change as the MVP evolves; contact support for a specific deletion or access request.

4. Hosting

The live Ship host is currently on Railway (vibegate-production.up.railway.app). Infrastructure subprocessors are those of the hosting platform the operator chooses.

5. Contact

See Support for how to reach the operator about privacy or deletion requests.