Data residency and privacy

A short tour of how distro handles your data. For the full version with legal weight, see the privacy policy and the DPA.

Where data lives

• Postgres — your core data (User, Apps, Ideas, Drafts, Posts, reviews). Hosted in Singapore (ap-southeast-1) for the staging environment; production replicates the same region.
• MongoDB — cache data, writing-sample embeddings, event logs. Same region.
• Object storage — uploaded media (logos, screenshots, voice notes). Singapore SGP1.
• Your AI provider — depends on which provider you chose. Anthropic is US, OpenAI is US + EU, Google is global, Mistral is EU, etc.

What we store

Everything needed to run the product: your apps, ideas, drafts, posts, reviews, preferences, writing samples, encrypted API keys, streak counters. Enough that deleting your account purges a meaningful amount of state (we do).

What we don't store

• Your API keys in plaintext. Encrypted at rest with libsodium XSalsa20-Poly1305. Decryption key lives only in server env vars. Never logged, never returned to the client.
• Your writing outputs sent to providers. Inference is a pass-through — we forward your prompt + voice context to the provider you chose, stream the response back to your browser, and cache the result for 30 days on content hash. Provider behavior depends on the provider; we don't retain beyond the cache.
• Payment data. Stripe stores that. We store customer IDs and subscription statuses only.

What we never send to AI providers

• Your email address or personal identifiers in prompts (unless you put them there)
• Data from apps you haven't explicitly connected to that provider
• Your peer reviewers' data — their writing is theirs, not context for your prompts

Data residency choices

EU-residency customers can request the Mistral + Gemini combo for inference, which keeps all AI processing within the EU. The distro infrastructure itself (Postgres, Mongo, storage) is Singapore-based — if EU-residency is a hard requirement for all data, contact us for an EU region deployment (Agency tier, enterprise arrangement).

Deletion

Export → delete. Data is purged from Postgres within 30 days of account deletion, from Mongo on the same schedule, from object storage within 7 days. Backups are 35-day rolling and not restored-from except under RPO-level incident recovery.