2pyrtl — Privacy Policy

This policy explains what personal data 2pyrtl handles, why, and what you can do about it. It uses the same defined terms as our Terms of Service — in particular the Browser Application, which runs in your own browser, the Backend, which is our server, and the Sandbox, in which your code is run.

1. Who is responsible

Lone Wolf Softlabs (OPC) Private Limited, at B-1203, Shriram Sahaana Apts., Avalahalli, Yelahanka, Bengaluru 560064, Karnataka, India, decides how and why your personal data is handled. Write to info@lonewolfsoftlabs.com with any question, request or complaint about it.

2. What we collect, and why

Because you have an account: your username, your email address, and the times your account was created and last updated. These are what the account is.

To sign you in: the public part of each of your passkeys, and what your browser tells us about it — the credential's identifier, a signature counter, the kind of device, the ways it can be reached, and a name you choose for it. The Backend never receives a password, and the private part of a passkey never leaves your device.

So that your files can be encrypted: for each of your Credentials, a public value and a copy of your file-encryption key sealed to it. The Backend never receives your passphrase, and never holds the file-encryption key itself.

So that you can recover a lost passkey: your backup codes, stored hashed, so that a code can be checked without us knowing it.

To keep your files: the encrypted contents of what you save, together with their names, sizes and timestamps, which are stored in readable form because your file tree and your storage quota depend on them.

To keep the Service usable for everyone: your IP address, and a count of how many runs you have made. IP addresses are held only long enough to apply a rate limit — a matter of minutes to hours, not days.

To tell you things: your email address, used to verify your address at signup and to send you operational notices — maintenance, changes to these documents, and replies to feedback you send us.

To record that you accepted these documents: which document you accepted, which version of it, when, and the IP address and browser you accepted from. This is the one place an IP address is kept beyond a rate-limiting window, because this record is the evidence that the agreement was made.

If you send feedback from inside the app: the message you write. It is not stored; it is sent to us by email, together with your username and email address, so that a person can read it and reply to you.

We do not sell your data. We do not use it for advertising. We use no analytics.

3. What encryption does and does not protect

Your files are encrypted by the Browser Application, on your device, before they reach us, using keys derived from Credentials that only you hold. The Backend stores the encrypted form and cannot open it.

There are three limits on that, and we would rather state them plainly than let you assume more than is true.

1. File names, sizes and timestamps are not encrypted. We can see what your files are called, how large they are and when they changed. We cannot see what is inside them.

2. When you run a Design, it is necessarily handled in readable form — that is, not encrypted. Running code means the code must be readable by the machine running it. Your source travels from the Browser Application to the Backend and on to the Sandbox, runs there, and its output returns before the Browser Application encrypts it again. Each of those transfers travels over an encrypted connection, but at each end the content is necessarily in the clear. Neither your source nor its output is retained beyond what the run requires.

3. If you lose your Credentials, your data cannot be recovered. There is no master key. In its stored form we cannot see the contents of your files — and for exactly that reason, we cannot help you recover them either.

4. Who else processes your data

We use these providers to run the Service. They process data on our instructions and for no other purpose.

Your encrypted files are stored in the United States, and your code is executed on a server in India. Your data therefore crosses borders in the ordinary course of running the Service.

5. How long we keep it

Your account data is kept for as long as your account exists. Your encrypted files are kept until you delete them or delete your account. Rate-limiting records expire within hours. Server logs are kept for up to 30 days.

Records of which documents you accepted are kept for as long as your account exists, and for three years afterwards, because they are the evidence of an agreement.

Deleting your account removes your account record, your stored files, your passkey records and your backup codes.

6. Your rights

You may ask us what we hold about you, ask us to correct it, or ask us to delete it.

Deleting your account is available in the app, and does the whole of it at once: your account record, your stored files, your passkey records and your backup codes are all removed together. For anything else, write to info@lonewolfsoftlabs.com. We will try to respond as promptly as we can.

7. Children

The Service is not intended for people under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to info@lonewolfsoftlabs.com and we will remove it.

8. Cookies

We use one cookie, which keeps you signed in. We use no advertising cookies, no tracking cookies and no analytics.

9. Changes to this policy

We may change this policy. Where a change materially reduces your rights, we will notify you before it takes effect, by email to your registered address and by asking you to accept the new policy the next time you sign in. For any other change, we may notify you by the same means. The current version is always published here, with its version number and effective date at the top.

10. Contact

Write to us at info@lonewolfsoftlabs.com.