bpviz Back to home

Privacy Policy

Last updated August 20, 2026

bpviz is a process and decision system operated by an individual operator based in California, United States. This policy describes what information we collect, how we use it, and the choices you have. It is written to match how the product actually works today.

Information we collect

Google account data. You sign in with Google. We request the profile and email scopes and store your Google user id, email address, name, and profile photo so we can create and authenticate your account and show your identity in the app. We do not request access to your Google Drive, Gmail, contacts, or other Google services.

Account data. We store your billing plan (currently free or paid) and, when you use chat, the timezone reported by your browser so dates and schedules display correctly.

Content you create. This includes processes and diagrams, chat messages, metrics and observations, goals, version history, and share links you publish. We also store structured “user facts” that the system extracts from your conversations so later chats can remember constraints and baselines you have stated.

Session cookie. After you sign in we set a single first-party cookie named SESSION. It is HttpOnly, scoped to our domain, and lasts seven days, extended while you keep using the product (a sliding window). It holds a session identifier, not your password — there is no password. We do not set other first-party cookies. During the Google sign-in redirect we use the browser’s sessionStorage (not a cookie) to remember where to send you afterward.

Infrastructure logs. Our hosts (Cloudflare for the website, Fly.io for the API) process IP addresses and standard request metadata in order to operate and secure the service. We do not run product analytics pixels or advertising trackers.

How we use information

  • To create your account, keep you signed in, and show your name and photo in the app.
  • To provide the product: generate and update process diagrams, chat, metrics, forecasts, and share pages.
  • To send your process and chat content to the language-model and embedding providers that power those features.
  • To enforce the free-tier quota and operate the service (security, abuse prevention, reliability).

We do not sell your information. We do not use Google user data for advertising, and we do not use it to train our own models. Google account data is used only to authenticate you and display your identity in bpviz.

Processors who help us run the service

We use the following companies to operate bpviz:

  • Google — sign-in (OAuth) and the fonts loaded on our pages.
  • Anthropic — language-model processing of the content you put into the product (chat, process generation, summaries, and related features).
  • Voyage AI — text embeddings used for semantic search over your chat history and related content.
  • Neon — hosted PostgreSQL database.
  • Fly.io — API hosting.
  • Cloudflare — website hosting and content delivery.

Those providers process data only as needed to provide their services to us, under their own terms and privacy policies.

Share pages

If you create a share link, the audience you chose can view the process content included in that share. Public shares may be listed in our sitemap and discovered by search engines. Unlisted shares are not added to the sitemap, but anyone who has the URL can open them. You can revoke a share at any time; revocation stops new access to that link.

Retention and deletion

We keep your account and content for as long as the account exists. Inactive sessions expire; you can also review and revoke active sessions in the app.

There is no self-serve account-deletion button today. To delete your account and associated content, email us at privacy@bpviz.io from the address on the account. We will delete the account and the data we hold that is tied to it, except where we must retain a limited record (for example to complete a deletion request or to meet a legal obligation).

Your choices

  • Sign out, or revoke individual sessions, from the account panel in the app.
  • Edit or delete processes, metrics, observations, goals, and shares you created.
  • Disconnect bpviz from your Google account via Google’s account permissions, which will prevent new sign-ins until you authorize again. That does not by itself delete data already stored in bpviz — email us for deletion.
  • Depending on where you live (including California and the EEA/UK), you may have rights to access, correct, or delete personal information, or to object to or restrict certain processing. Email us to exercise those rights.

Children

bpviz is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes

If we change this policy in a material way, we will update this page and the “Last updated” date. Continued use of the service after a change means you accept the updated policy.

Contact

Questions about this policy, or requests to access or delete your data, go to privacy@bpviz.io. bpviz is operated by an individual operator based in California, United States.