Privacy policy

The privacy of your data — and it is your data, not ours — is a big deal to us. Rezzaux is a personal record of the people you meet: your contacts, your notes, your rhythm of keeping in touch. That only works if you can trust us with it. In this policy we lay out what we collect and why, how it is handled, and your rights. We never sell your data, and we never will.

When we say “Rezzaux,” “we,” or “us,” we mean the Rezzaux website and application at this domain, operated by its founders.

What we collect and why

Our guiding principle is to collect only what we need. In practice:

Identity and access

When you sign up, we ask for your name and email address, and optionally your school, company, role, and LinkedIn URL. We use these to run your account, to show who you are to communities you choose to join, and to send you essential account email (such as confirming your address). We will never sell your personal information to third parties, and we won’t use your name in marketing without your permission.

The content you keep in Rezzaux

The product is a place to record your network: contacts you add (names, schools, companies, industries, roles, LinkedIn URLs you paste in, how you met), the interactions you log and any notes you write, your goals, and your reach-out schedule. We store this so the product works, and for no other reason. Nobody imports or scrapes this from anywhere — everything in your account is something you typed or uploaded (including CSV imports you choose to run).

What other members can see

If you join a community, other members of that community see a limited activity feed: your name, the type of interaction you logged (a call, an email, a coffee chat), and when — plus any messages you choose to post to that community, which are visible to its members until you (or we) delete them. By design — enforced in how the data is queried, not by a setting — the feed never includes who an interaction was with, where they work, or anything you wrote in your notes.

Comments you leave on articles in the Learn tab work differently: they are visible to everyone signed in to Rezzaux, not only to members of a community you belong to, and they are shown with your name. Treat a comment as public to every member. You can delete any comment you posted, and we can delete any comment.

If you join no communities and leave no comments, nobody sees anything.

Contact form and correspondence

If you write to us through the contact form or by email, we keep the correspondence — including your name and email address — so we have history to refer to if you reach out again. The contact form also records a one-way hash of your IP address, used only to rate-limit spam; we cannot recover your IP from it.

Cookies

We use essential first-party cookies to keep you signed in — that’s it. No advertising cookies, no third-party trackers, no analytics scripts that follow you around the web. Your browser’s local storage holds a few small interface preferences (like a dismissed banner). If you block cookies, sign-in will not work.

When we access or disclose your information

To run the service. Rezzaux is built on a small set of infrastructure providers who process data on our behalf: Supabase (database and authentication), Vercel (hosting), and Resend (delivers contact-form email to us). These providers may log technical information such as IP addresses as part of operating their platforms.

With your permission. No human at Rezzaux looks at your contacts or notes except with your express consent — for example, to help with a support request — or in the rare case where an error requires manual intervention to fix, in which case we look at the minimum necessary.

To investigate abuse. Accessing an account while investigating potential abuse of the service is a measure of last resort.

When required under applicable law. Our infrastructure is located in the United States. We do not respond to government requests for user data unless we are compelled by valid legal process, and our policy is to notify affected users before we disclose data unless we are legally prohibited from doing so.

If Rezzaux is ever acquired by or merges with another company — we don’t plan on that, but if it happens — we’ll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We apply the same rights to everyone, regardless of location: the right to know what we collect (this policy), to access it, to correct it, to receive a copy of it, to restrict or object to its processing, and to have it erased. Much of your information you can view and edit directly in the app. For anything else — including a full export or account deletion — email us at rezzaux@gmail.com and we’ll take care of it. We may need to verify your identity (at minimum your name and the email on the account) before acting on a request. We will never treat you worse for exercising these rights.

How we secure your data

All data is encrypted in transit between your browser and our servers (TLS) and encrypted at rest by our database provider. Every user’s data is isolated by row-level security rules in the database itself, so your contacts and notes are only readable by your account — the one deliberate exception being the limited community feed described above.

Deletion and data retention

If you delete content in the app, it is removed from your account immediately. If you ask us to delete your account, your content becomes inaccessible immediately, is purged from our active systems within 30 days, and ages out of database backups within 60 days after that. We keep information only as long as needed for the purposes described here, or as required to comply with legal obligations.

Location of site and data

Rezzaux is operated in the United States. If you are located outside the United States, please be aware that any information you provide to us is transferred to and stored in the United States. By using Rezzaux, you consent to this transfer.

Changes and questions

We may update this policy as the product evolves or as regulations require. Whenever we make a significant change, we will refresh the date at the top of this page and take appropriate steps to notify account holders. Questions, comments, or concerns? Email rezzaux@gmail.com and we’ll be happy to help.

Adapted from the 37signals open-source policies, used under CC BY 4.0.