Privacy Policy

Bulma Labs Corporation operates quarry and decides how the personal data described here is used. Under European law that makes us the "controller". Privacy questions and requests: hello@quarry.market.

This policy covers the quarry website, the creator app, and the services agents connect to. It does not cover what a creator does with their own files, or how the payment partners named in Who receives data handle what you give them directly: their own policies apply.

When you visit

Like any website, our hosting provider receives your IP address, the address of the page you ask for, and your browser's type, and keeps them in short-lived request logs. We count page views without cookies, by the page's path only.

When you have an account

Creators and subscribers alike:

• Your email address. Your password goes straight to our sign-in service; we never receive it.
• Google sign-in, if you choose it. Google tells us your email address, your name and your profile picture. They are kept with your sign-in record; we use the email address to identify your account, and nothing else.
• A profile photo, if you add one. Only you see it, in your account menu and your settings. We keep a square copy made from it, without the details a phone or camera hides in a photo, such as where it was taken.
• The terms you accepted. Which version, and when you created your account.
• API keys. Stored only as a hash, with a name, a short prefix, and when each was created, last used, or revoked.
• Agents you connect. The agent's name and identifier, and when you approved or disconnected it.

When you sell

• Your public handle: it appears in the address of your datasets and cannot be changed.
• Your payout wallet: it is created with our wallet partner when you pick your handle; we keep its public address and our references to it.
• Your files and what we derive from them: their text, the passages we cut it into, the search data built from those, previews, and their file names. When a dataset's files are ready, samples of their text are used to suggest its listing; you can change or remove every suggestion.
• Your listing: name, description, category, example questions, and price.
• Withdrawals: destination address, amount, status, and transaction reference.
• Bank withdrawals: we keep the last four digits of your account number and your bank's name. The account owner's name, the full account and routing numbers, the account type and the postal address pass through our servers to Privy and Bridge without being stored. Your identity documents go to Bridge directly, never to us; we read back only whether the check passed.
• Subscriptions you sell: your country and our references to your account with Stripe.

When you ask a dataset a question

Agents can ask without an account. We read the whole question, up to 2,000 characters, to find the passages that answer it. For each answered question we log:

• the first 500 characters of the question;
• how it was paid: one at a time in USDC, by subscription, or free;
• the account that asked, when an agent you connected or one of your API keys asked it;
• for a USDC payment, the paying wallet address, the amount and the transaction reference;
• the response time, and which passages were returned;
• the channel the question came through, and the kind of client software that sent it, taken from its name or User-Agent, never the full User-Agent.

Questions asked from your account. A question asked by an agent you connected, or with one of your API keys, is tied to your account however it is paid, and listed with its text on your Purchases page. That includes every question asked with the account's API keys, whoever used them.

Subscriptions. The answer to a question asked with a subscription is saved with the whole question for 24 hours, so that a retried request replays it instead of using a second question. After that we keep the record that a question was used, with a fingerprint of the question that cannot be read back.

Questions nothing answers. We do not log their text. We count them per dataset and per day. If you asked with a subscription, the record that you asked remains, without the text.

Searching the catalog. Free searches are not stored with the caller's identity. Their text goes to our search providers to order results.

Limits. To limit abuse we count requests by IP address, account, or paying wallet, sometimes per dataset. These counters expire on their own, after 48 hours at most.

When something breaks, or you report a bug

When a page or a request fails, we send our error-monitoring provider the error, the page's path without its query string, your browser's type and operating system, the app version, your recent steps in the app (clicks, pages opened, requests made, without their content), and your account id when you are signed in. Cookies, request bodies and the other request headers are not sent. We do not put your IP address in the report; the provider sees it when the report arrives and is set not to store it.

When you report a bug from the app, we also send your message, the contact email shown in the form, a screenshot if you add one, and a replay of your last moments in the app with all text, inputs and images masked. The replay is recorded only while you are signed in to the app, and leaves your browser only with a bug report or an error.

• People mentioned in uploaded files. A creator's documents can contain names, contact details, or anything else a document says about a person. We receive it from the creator, who is responsible for having the right to use it: see Uploaded files.
• The public blockchain. We read wallet addresses, amounts and transaction references from it to confirm payments, show balances and follow withdrawals.
• Google, when you sign in with it, as described above.
• Payment partners. Bridge tells us whether your identity check passed and the status of each bank withdrawal. Stripe tells us the status of subscriptions and invoices.

Where we rely on legitimate interests, we have weighed them against your own interests and rights. Ask us and we will explain how.

What we do not do. We do not sell personal data or share it for advertising. We do not send marketing email. We do not build a profile of you.

What you have to provide. An email address is needed to open an account, and a creator who wants bank withdrawals has to pass Bridge's identity check; without them those features are not available. Asking a question paid one at a time needs no account.

Automatic steps. A relevance check decides whether the passages found answer a question, and so whether it is charged. Limits can refuse requests for a while. A payment can be refused by the services that process it. None of these builds a profile of you or makes a decision with legal effect. Bridge's identity check is Bridge's own decision, under its own policy.

Anyone

• A creator's handle.
• A published dataset's listing: its name, description, category, example questions, number of documents and passages, how many questions it has answered and when the latest was, and its price.
• File names. They are shown to buyers as the source of each passage and, while the creator leaves free previews on, in search results with up to 200 characters of a matching passage.
• A creator's payout address. It is the address a buyer pays, so it is shown to anyone about to pay. The payments it has received are therefore visible on the public blockchain next to the creator's handle.

What a creator sees about buyers

For a question paid one at a time: the first 500 characters of the question, the amount, the paying wallet address, the transaction, and the passage that answered. Not who you are: a wallet address does not carry your name, and a creator never sees which account asked, even when the question was asked from one.

For a free question or one asked with a subscription, a creator never sees the text or who asked. These questions only count in the creator's totals.

Subscriptions

The creator is the seller. Through Stripe they can see the billing details you give at checkout, such as your name, email address and country.

Agents you connect

An agent you connect can see your subscriptions and a list of your latest purchases, without what was asked, and use your subscriptions' questions. It cannot change your datasets, manage your billing details or withdraw funds, and you can disconnect it at any time.

Payment partners. These companies receive identity, bank or card data, and handle it under their own privacy policies:

• Privy creates and secures each creator's payout wallet and passes bank withdrawal requests to Bridge. It receives your email address, our account ids, and the bank details you enter (its policy).
• Bridge runs bank withdrawals: the identity check, the conversion of USDC to dollars, and the bank transfer. It receives your email address, the identity information and documents you give it directly, and your bank details (its policies).
• Stripe runs monthly subscriptions: checkout, card payments, invoices, and payouts to creators. When you provide personal data in connection with a subscription or with subscription payouts, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
• Google, if you choose Google sign-in, learns that you sign in to quarry.

Service providers. Other companies process data for us, each only for its task and under its own data-processing terms:

We give the current list of these providers to anyone who asks: write to hello@quarry.market.

Others. We disclose data when the law requires it or to defend a legal claim, and to a successor if quarry is sold or merged, under this policy. We never sell it. What creators, buyers and the public can see is in What others can see.

A creator's files are theirs. We read and prepare them to answer questions, and for nothing else. We do not use them to train machine-learning models, and we send them to the providers above only so that they can do their part.

Files go to those providers as soon as they are uploaded, before the dataset is published. Until it is published, only the creator can see them on quarry.

Other people's data in a file. The creator decides why and how it is used, and answers for it; we handle it on the creator's behalf. Under European law the creator is the controller and we are a processor. A creator who needs a data processing agreement can ask us for one, with the list of the providers involved.

If you believe a dataset holds your personal data, write to hello@quarry.market with the dataset's address. We pass your request to the creator, and act on it ourselves where the law requires.

Payments and withdrawals in USDC are recorded on a public blockchain: the wallet addresses, the amount and the time. That record is public, copied across the network, and permanent. We do not control it and cannot change or erase it.

A wallet address does not name its owner, but anyone who links an address to a person can see its whole history. A creator's payout address is linked to their handle: see What others can see.

If you ask us to delete your data, we delete or anonymize what we hold that links a wallet address to your account or to your questions. The record on the blockchain remains.

We set only these cookies:

• session cookies, which keep you signed in until you sign out or they expire;
• a cookie used while you sign in with Google or with a link sent by email;
• a cookie that ties a link sent by email to the browser that asked for it, for 1 hour;
• a cookie that remembers whether you see a dataset's files as a grid or a list, for a year.

Your browser also keeps a few things on your device, which are not sent to us: your other display preferences and, while you are signed in, a marker used if you send a bug report.

There are no advertising or tracking cookies. We do not follow you across other sites or over time, and no other company collects data about your browsing on quarry for its own purposes. So there is nothing for us to change when your browser sends a "Do Not Track" signal.

When an account is closed, its datasets, its files, its profile photo and its lists of sales and withdrawals are deleted with it. The questions asked from it of other creators' datasets stay in those creators' records, no longer tied to the closed account.

We keep data longer when the law requires it, or while a dispute is open.

We are based in the United States, and so are most of our providers; some are in Europe. Your data is processed there. For transfers that European or United Kingdom law restricts, we rely on the standard contractual clauses approved for such transfers, which are part of our providers' data-processing terms. Write to hello@quarry.market for a copy.

What you can do yourself

• delete a file or an unpublished dataset;
• turn free previews off for a dataset;
• revoke an API key or disconnect an agent;
• change or remove your profile photo;
• remove your bank account;
• cancel a subscription.

What you can ask us

Wherever you live, you can ask for a copy of your data, ask us to correct it, or ask us to delete it and close your account: write to hello@quarry.market. We answer within one month, at no charge.

We need to know the request comes from you. We reply to the email address of your account. If we know you only by a wallet address, we will ask you to show that you control it.

Some things deleting cannot reach: the record on the public blockchain, the passages buyers have already received, and what a seller holds in their own account with Stripe. A handle cannot be changed, and neither can the address of a published dataset.

If you are in the European Economic Area, the United Kingdom or Switzerland

You have the right to access your personal data, to have it corrected or erased, to have its use restricted, and to receive a portable copy of it. We do not rely on your consent for any use today; if we ever do, you can withdraw it at any time.

You can object. Where we rely on legitimate interests (see Why we use it), you can object at any time, for reasons that relate to your situation. We then stop, unless we have compelling grounds to continue or need the data for a legal claim.

You can also complain to the data protection authority of the country where you live. We would appreciate the chance to answer first.

If you are in the United States

We do not sell personal data, and we do not share it for advertising. Residents of California, Nevada and other states can send any request about their data to hello@quarry.market.

Data is encrypted in transit. Access to storage and to the database is limited to the credentials that need it. API keys are stored only as a hash. Payout wallets are secured by Privy: we never hold their keys. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

quarry is for adults. It is not directed at anyone under 18, and we do not knowingly collect their data. If we learn that we have, we delete it. Tell us if you believe a child has given us data.

We may update this policy. When a change matters to you, such as a new use of your data, a new kind of recipient, or a change to your rights, we email account holders and post a notice on this page before it takes effect. Earlier versions are available on request.

Questions and requests: hello@quarry.market. See also our Terms of Service.