Fermium Privacy Policy

1. Who we are

This Privacy Policy explains how Fermium, a United States company ("Fermium," "we," "us," or "our"), collects, uses, and shares personal data when you use https://fermium.app, https://fermiumusercontent.app, our MCP server, and our API (together, the "Service"). Fermium is the data controller for the personal data described in this policy, except for content you publish that contains other people's personal data, for which you are the controller and we are your processor.

Contact: hello@fermium.app. Security issues: security@fermium.app.

2. What we collect

Account information. When you sign in with Google (via OpenID Connect) we receive and store your email address, your Google account identifier, and basic profile information such as your name and profile picture. We do not receive your Google password.

Workspace information. Every user belongs to a workspace. We store your workspace membership and role. Company workspaces may claim email domains; when they do, we use your email domain to place you in the right workspace automatically. Workspace administrators can see the email addresses and names of workspace members.

Content you publish. The HTML pages, Markdown documents, code snippets, images, PDFs, audio, and video you or your agents publish ("Documents"), along with their versions, tags, titles, descriptions, visibility settings, passwords (stored hashed), and expiry settings. Documents may contain personal data if you choose to include it.

Billing information. If you subscribe to a paid plan, Stripe processes your payment. We receive and store your plan, billing status, invoice history, the last four digits and brand of your card, and your billing name and address if you provide them. We do not store full card numbers; Stripe does, under its own privacy policy.

Agent and API activity. When you connect an AI coding agent or use the API, we store the tokens we issue you (hashed), the agent or client identifier where provided, and a record of publish, update, and delete actions so you can see what your agents did.

Viewer access and file activity data. We record successful Document opens and downloads, timestamps, observed IP addresses and client types to operate the service and provide file activity statistics. Verified, active accounts in the Document's workspace may be associated with their activity; other public visitors are anonymous to that workspace. App previews and detected bots are classified separately. We also record edits, permission requests and decisions, and form progress events; analytics do not copy form answers. Owners and editors can see aggregate counts. Detailed identities and IPs require sharing-management permission as well, and are subject to the plan retention below. IPs are masked by default in Activity and can be revealed by authorized managers for diagnostics. Viewer cookies support password and signed-in access; opening from the app can transfer the verified viewer identity to the content host.

Server logs and diagnostics. Standard technical logs: IP address, browser or client type, request paths, response codes, timing, and error reports, used to operate, debug, and secure the Service.

Support communications. If you email us, we keep the correspondence so we can help you. Fermium operators may keep internal support notes, customer-reported use-case tags, follow-up status, and records of plan or complimentary-credit adjustments. Our operator console brings together workspace creators where recorded, current membership, account milestones, billing records, and retained activity for customer support.

Optional advertising measurement. For new visitors identified as being in the United States, measurement starts after our notice is displayed unless you have opted out or send Global Privacy Control. For other visitors, including unknown locations, existing accounts and recognizable earlier visitors, it starts only after you select Allow measurement. We record visits to public marketing pages, completed new registrations and your first customer-created publish. We remember the ad-click identifier, campaign/ad identifiers and public landing feature, and link this attribution to your account when you sign in or enable measurement while signed in. This lets us measure later return visits and account activity, including publishing through an AI agent or another device, during the 30-day measurement period. A direct return does not replace an earlier ad click. We send the event type, time, a unique event ID, an allowlisted public feature/section or app URL, the OpenAI ad-click identifier when available, and a SHA-256 hash of the account email to OpenAI's Conversions API. Hashing supports matching and does not make the identifier anonymous. We do not send file contents, titles, prompts, form answers, private document URLs or full query strings. We request exclusion from any future user-level advertising personalization using the API's opt-out flag. We do not install a third-party advertising script in your workspace.

We estimate country from the connection's IP address using a local copy of DB-IP Country Lite, licensed under CC BY 4.0. We do not send visitor IP addresses to that provider or store location in advertising records. Country estimates can be imperfect, including when using a VPN. Unknown locations require opt-in. We record the notice version and start time separately from affirmative consent.

Measurement also includes your workspace's first confirmed positive payment for a subscription or AI credits, including its amount and currency, to measure and improve our ads. We associate this event only with the known purchaser for whom purchase measurement was permitted before payment, through either affirmative consent or the U.S. notice model above. Earlier opt-in choices that did not include purchases require a new affirmative choice before purchase reporting is enabled. We do not report previous purchases when measurement is enabled later, and do not count renewals, free trials or complimentary credits as new-customer purchases. Billing records remain available for operating the service independently of advertising measurement.

For our internal customer journey view, optional measurement also retains the time and allowlisted public path of each measured page view, campaign identifiers, and a broad referral category such as a search engine, an AI tool, another website, or direct/unknown. We do not retain the full referring URL. Under the U.S. notice model or an updated opt-in choice, we also record whether you interact with a use-case demo or select its signup button, together with the known use-case and page version. We never record demo values, text you enter, filenames, or form answers. These interactions and the referral category stay in Fermium and are not sent to OpenAI. Earlier opt-in choices require a new affirmative choice before interaction recording starts; earlier interactions are not replayed. Later signup, first-publish and first-purchase records can retain the last observed use-case page before the event. These records help us understand how visitors discover and use Fermium; they remain subject to the same 30-day expiry and withdrawal controls. The console is restricted to Fermium operators, not other customers or workspace administrators.

We do not collect precise location data or use device fingerprinting.

3. How we use personal data

We use personal data to:

• create and secure your account and sign you in;
• place you in the correct workspace and let administrators manage members;
• host, store, transmit, display, and back up your Documents and serve them to the viewers you choose;
• provide permission-controlled file activity, traffic charts and response-progress statistics;
• process payments, send receipts, and manage subscriptions;
• send transactional email such as receipts, account notices, security alerts, and warnings before Documents expire;
• enforce rate limits and storage quotas;
• detect and prevent abuse, fraud, malware, phishing, and security incidents;
• respond to support requests and legal requests;
• understand discovery and return visits and measure which ChatGPT ads lead to signups and product use, subject to the regional measurement rules and privacy choices above;
• comply with our legal obligations.

We do not train AI or machine-learning models on your content or personal data, and we do not permit third parties to do so through the Service.

We do not send marketing email at launch. If we introduce optional product updates in the future, they will be opt-in and you will be able to unsubscribe at any time.

4. Content scanning

We do not read your Documents. We run automated malware, phishing, and abuse checks on published content, and we review specific content when someone reports it or when required by law. Documents are served from a separate domain (https://fermiumusercontent.app) inside a browser sandbox to limit what published pages can do.

5. Legal bases (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract: account creation, sign-in, hosting and serving your Documents, billing, and support.
• Legitimate interests: securing the Service, preventing abuse and fraud, keeping technical logs, enforcing quotas, and sending essential account and security notices. We balance these interests against your rights and only rely on this basis where we believe your rights are not overridden.
• Consent: any optional communications we may introduce in the future, and any cookies beyond those strictly necessary for the Service. You can withdraw consent at any time.
• Legal obligation: retaining billing records, responding to lawful requests, and reporting illegal content where required.

6. Cookies

We use essential cookies for:

• Sessions and sign-in state on https://fermium.app, so you stay signed in;
• Viewer access on https://fermiumusercontent.app, so a viewer who has entered a Document's password, or signed in to a workspace, can continue viewing without re-authenticating;
• Security, such as protecting against cross-site request forgery.

These cookies are strictly necessary for the Service to work. You can clear or block cookies, but sign-in and protected access may not work without them.

Measurement and privacy choices. A separate first-party, secure, HTTP-only cookie (__Host-fermium_measurement) links an opaque browser reference to a measurement record for up to 30 days. It may instead store a refusal for up to one year. An essential preference cookie (__Host-fermium_privacy) and matching preference record remember refusals and the earlier opt-in model for up to one year; this preference identifier is not sent to OpenAI or used as advertising identity. A signed-in account's opt-out persists until you explicitly change it. Global Privacy Control signals are treated as a refusal. Select Your Privacy Choices in the public website footer to turn measurement off or change your choice. Withdrawal removes that browser's attribution record and queued events; when signed in, it also removes attribution linked to your account, stops future linked events, and does not affect use of the service. Events already sent cannot be recalled by this control; contact hello@fermium.app for privacy requests. Clearing cookies removes the browser preference but does not itself withdraw existing account-linked measurement. To withdraw it, sign in and turn measurement off in Your Privacy Choices. We cannot recognize an anonymous earlier visitor after their cookies are cleared or expire. A new measurement period requires a new notice for eligible U.S. visitors or a new opt-in for others; earlier events are never backfilled.

7. Who we share data with

We do not sell personal data for money. We share personal data with the following providers to operate the Service or for optional ad measurement under the rules above:

Provider	Purpose	Data involved
Google LLC	Sign-in (OpenID Connect)	Email, Google account ID, profile basics
Stripe, Inc.	Payment processing and invoicing	Billing name, email, address, payment method (held by Stripe)
OpenAI	Optional measurement of Fermium ads in ChatGPT	Permitted event metadata, ad-click identifier and hashed account email; see the OpenAI privacy policy
Let's Encrypt (Internet Security Research Group)	TLS certificates for our domains	Domain names only; no personal data
Fermium infrastructure	Hosting, object storage, and encrypted backups, operated by us in the United States	All Service data

We may also disclose personal data:

• To comply with law, such as in response to a subpoena, court order, or other lawful request, or to report illegal content (including CSAM) to the appropriate authorities;
• To protect rights and safety, including enforcing our Terms of Service and investigating fraud, abuse, or security incidents;
• In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will notify you and this policy will continue to apply to your data until it is changed with notice;
• At your direction, for example when you make a Document viewable by others or add members to your workspace.

Workspace administrators. If you belong to a company workspace, its administrators can see your name, email and role and administer workspace settings. File content and analytics use explicit file and folder permissions; membership alone does not grant access to private personal files. Workspace security and change audit records are available under the audit-log permissions.

Viewers of your Documents. Anyone who can view a Document sees its content and any metadata you chose to include (such as a title or description). Unlisted links can be forwarded by anyone who has them.

8. Where data is stored and international transfers

The Service is hosted on infrastructure operated by Fermium in the United States, including object storage and encrypted backups. If you access the Service from outside the United States, your personal data will be transferred to and processed in the United States.

For personal data from the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) with our service providers, and we provide equivalent contractual protections in our Data Processing Agreement. Our service providers Google and Stripe maintain their own transfer mechanisms, including participation in the EU-US Data Privacy Framework where applicable.

9. Retention and deletion

We keep personal data only as long as needed for the purposes described above:

• Advertising attribution expires within 30 days of the measurement period starting; return visits and ad clicks do not extend it. Pending delivery payloads are kept for at most 6 days and erased after confirmed delivery or permanent rejection. Click history, first/last-click snapshots and delivery receipts remain only until their source measurement record expires or is withdrawn. Operator reports use these retained records and do not retain personal advertising histories beyond that window. Withdrawing measurement removes the attribution and related queued events from the active database. Preference records have the separate duration described in section 6. Normal backup retention applies. OpenAI handles events already received under its own policies.

• Account data is kept while your account is active and deleted within 30 days of account deletion, except billing records we must keep for tax and accounting purposes (typically 7 years). Product milestones such as whether signup is complete and when you first published are account data; they prevent repeat actions being counted as new milestones. They contain no advertising identifiers and are shared for advertising only when measurement is permitted.

• Documents are kept until they expire or you delete them. Expired Documents stop being served. Deleted Documents enter a 7-day grace period during which they can be restored, after which they are permanently removed from storage. Copies in backups roll off within 14 days after that.

• Backups. We take nightly encrypted database snapshots and retain them for 14 days. Backups are used only for disaster recovery and are not restored to live systems except to recover from data loss.

• File activity details are retained for 0 days on Free, 7 days on Team, 30 days on Business and 90 days on Enterprise. Daily counts without IP addresses or viewer identities are retained for 90, 365, 730 and 1,095 days respectively. Lower plan limits apply immediately to queries; scheduled cleanup removes expired rows in batches. File-related request logs and legacy viewer audit rows follow the detail window. Backup copies expire on their separate schedule.

• Other server and access logs are kept for up to 90 days, or longer if needed to investigate a specific security incident.

• Agent and API activity records are kept while your account is active so you can audit what your agents did, and are deleted with your account.

• Support email is kept for up to 2 years after the conversation ends.

• Internal customer support notes and tags are kept while the workspace is active, unless removed earlier to resolve a correction or deletion request. Workspace deletion removes its support profile and notes. Billing adjustment audit records follow the account and billing retention above.

10. Your rights and choices

Everyone. You can view and update your profile in the app, change Document visibility and expiry, revoke API and MCP tokens, and delete individual Documents at any time. You can delete your account from the app or by emailing hello@fermium.app, and you can request an export of your data by emailing us. We will respond within 30 days.

EEA, UK, and Switzerland. You have the right to access, correct, delete, and port your personal data; to restrict or object to processing based on legitimate interests; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority. We have not appointed an EU or UK representative at launch.

California and other US states. Depending on applicable law, you may have rights to know, access, delete and correct personal information, to opt out of sale, sharing or targeted advertising, and not to be discriminated against for exercising your rights. We do not sell personal information for money. Disclosure of advertising identifiers to OpenAI may fall within broader state definitions of sale or sharing. You can opt out of all optional advertising measurement using Your Privacy Choices, including any such sale or sharing, without creating an account. We honor Global Privacy Control. We do not use sensitive personal information for advertising. You may designate an authorized agent to make requests on your behalf; we will verify the request through your account email.

To exercise any right, email hello@fermium.app from the address associated with your account, or use the account settings in the app. We may need to verify your identity before acting on a request.

11. Data Processing Agreement

If you use Fermium on behalf of a business and publish Documents that contain personal data of others, we act as your processor for that data. A Data Processing Agreement covering GDPR and UK GDPR requirements is available for Business and Enterprise plans on request at hello@fermium.app.

12. Security

We protect data with encryption in transit (TLS), encrypted backups, hashed tokens and passwords, access controls, and separation of published content onto a sandboxed domain. No system is perfectly secure, and you are responsible for keeping your Google account, API and MCP tokens, and Document passwords confidential. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law. To report a security issue, email security@fermium.app.

13. Children

The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact hello@fermium.app and we will delete it.

14. Changes to this policy

We may update this policy from time to time. For material changes, we will give you at least 30 days' notice by email or in the app before they take effect. The effective date at the top of this page tells you when the current version took effect. Continued use of the Service after a change takes effect means you accept the updated policy.

15. Contact

Fermium
Email: hello@fermium.app
Security: security@fermium.app
Web: https://fermium.app

Mailing address: available on request at hello@fermium.app while our business mailing address is being set up.