Privacy Policy

Overview

Fluxcode Studio LLC, operating as Superstack ("we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our token optimization service.

Information We Collect

Account Information

When you create an account, we collect your email address and authentication credentials through our OAuth providers (GitHub, Google).

Product telemetry — on by default, opt-out

Please read this section carefully. When you install Superstack, the background daemon uploads anonymous usage metrics to our metrics endpoint roughly every five minutes. This is enabled by default. We do not show a consent prompt during installation, and you do not need an account for it to run. You can turn it off at any time — see How to turn telemetry off below.

Each uploaded event describes one optimization, timestamped to the hour (not the minute or second), and may contain:

• A random event identifier and an hour-rounded timestamp
• Model family (haiku / sonnet / opus / unknown) and the tool you used (e.g. claude-code, cursor)
• Token counts: baseline, optimized, saved, and estimated output tokens
• Estimated cost saved, in cents
• Whether the prompt cache was hit
• Names of Superstack features that were active (feature names only, never their inputs)
• Query type and a coarse query-complexity bucket
• Context-budget allocations (P0 / P1 / P2) and your installed Superstack version
• An A/B experiment group, where one is assigned
• An error category when a run fails (a category label, never a stack trace or message)
• A bucketed hook-execution time and a governance rule category
• Shell-output compression stats: ecosystem label, whether a filter ran, compression ratio, estimated tokens saved
• Your anonymous device identifier (see below), used to authenticate the upload and to de-duplicate

Some additional behavioural signals (for example whether a request was a retry, or whether Vibe Mode was on) are only collected when they have been perturbed with differential-privacy noise first, under a capped per-device privacy budget. They are off unless explicitly activated.

Telemetry never includes prompt or response content, your source code, file paths, project or repository names, directory listings, environment variables, API keys or other credentials, your IP address as a stored field, your email address, or your account identifier. Field selection is enforced by an explicit allowlist in the client: anything not on that list is never assembled, let alone sent.

How to turn telemetry off

Any one of these disables all telemetry uploads. The first two take effect immediately for new processes; the third takes effect after you restart the daemon with ~/.claude-superstack/bin/restart-daemon.sh.

• Set the environment variable SUPERSTACK_TELEMETRY=off
• Set the industry-standard DO_NOT_TRACK=1 environment variable, which we honour
• Set "telemetry_level": "off" in ~/.claude-superstack/config/global.json

There is also a middle setting, "telemetry_level": "core_only", which keeps the core optimization counters above but drops every pseudonymized behavioural signal.

Installer telemetry

The install script reports the outcome of your installation so we can see where installs fail. Each ping contains only your invite token, a random run identifier, a coarse platform string (e.g. darwin-arm64), the version being installed, and an outcome (started / completed / failed) with a stage name. It contains no paths, hostnames, project names, or file contents. Set SUPERSTACK_NO_TELEMETRY=1 before running the installer to skip it.

Cloud sync — signed-in accounts on paid plans

If you sign in from the desktop client on a plan that includes dashboard sync, the client also uploads your optimization events to your account so the web dashboard can show your history. This runs automatically once you are signed in; it does not run for anonymous installs. Unlike telemetry above, these records are linked to your account, and they include:

• The project path and project folder namethe event came from — e.g. /Users/you/code/my-project. This is the one piece of potentially identifying local context that leaves your machine, and it exists so the dashboard can break your savings down per project.
• Event timestamp, tool, source (hook / api / mcp) and model
• A payload category label (prose / code / structured) — the category only, never the content
• Baseline, optimized and saved token counts, and cost saved
• A session identifier and a content hash used for de-duplication

Signing out of the desktop client stops cloud sync. Deleting your account deletes these records.

Across every path above: we never store the content of your prompts, your model responses, or your source code. All prompt processing happens locally on your device.

Device Information

We generate a unique, anonymous device identifier (SHA256 hash of hardware and OS characteristics) to authenticate uploads and to track device limits per subscription tier. It is one-way and is not derived from your name, email, or account. On its own it cannot be used to identify you personally, though for signed-in cloud sync it is linked to your account.

How We Use Your Information

• Provide and maintain our service
• Calculate and display your token savings
• Process subscription payments
• Improve our optimization algorithms
• Send important service updates (opt-in for marketing)
• Prevent fraud and enforce our terms

Legal Bases for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide you with the Superstack service (account data, usage metrics, payment processing)
• Legitimate interests: Improving our optimization algorithms, preventing fraud, and ensuring service security. Default-on product telemetry is processed on this basis; you can object at any time by turning it off using any of the methods listed above, with no loss of functionality.
• Consent: Marketing communications and newsletter subscriptions (opt-in only, withdrawable at any time)
• Legal obligation: Retaining billing records as required by tax and accounting laws

Data Storage and Security

Your data is stored securely using industry-standard practices:

• Database hosted on Neon (PostgreSQL with encryption at rest)
• All data transmitted over HTTPS/TLS
• Authentication via secure OAuth 2.0 providers
• Local data stored in ~/.claude-superstack/ with user-only permissions

Third-Party Services

We integrate with the following third-party services:

Polar

Payment processing. Polar handles all payment information and is PCI-DSS compliant. We do not store your credit card details.

Anthropic

Claude API provider. Your prompts are sent to Anthropic for processing. See Anthropic's Privacy Policy.

OAuth Providers

GitHub and Google for authentication. We only receive your email address and basic profile information.

Resend

Transactional email delivery for account notifications, support ticket confirmations, and service updates. See Resend's Privacy Policy.

Cloudflare Workers

Our product-telemetry endpoint runs on Cloudflare Workers. Anonymous telemetry events described above are transmitted to and processed by Cloudflare on our behalf. As with any HTTPS request, Cloudflare necessarily observes the connecting IP address in transit; we do not store it as part of the telemetry record. See Cloudflare's Privacy Policy.

Cloudflare Turnstile

Bot protection for our contact and newsletter forms. Turnstile verifies that form submissions come from real users without using CAPTCHAs. See Cloudflare's Privacy Policy.

Sendy

Newsletter delivery for opted-in subscribers. If you subscribe to our newsletter, your email address and name are shared with our self-hosted Sendy instance for email delivery. You can unsubscribe at any time via the link in each email.

Federated Learning (Opt-In)

We offer an optional federated learning feature that contributes anonymized optimization metrics to improve our models for everyone. It is off unless you turn it on, and it is separate from the default-on product telemetry described above — turning telemetry off does not turn federated learning on, and vice versa.

Federated learning is configured per device: each installation reads opted_in from ~/.claude-superstack/config/federated.json on that machine. The toggle in your account settings records your preference on your account; it does not currently reconfigure machines you have already installed, so change the file on each machine you want to include or exclude.

If enabled, we contribute only the following, and nothing else:

• A one-way, salted device identifier (see anonymization below)
• Token savings ratios and aggregate model-usage patterns
• Anonymized solution templates, with secrets and credentials filtered out

We never contribute prompt content, code you did not explicitly share as a pattern, file or project names, IP addresses, email addresses, account identifiers, or any directly identifying information.

How we anonymize this data

Federated contributions are hashed with a key that rotates and is destroyed each month; once destroyed, that month's contributions cannot be recomputed or re-linked to a device, account, or person — including by us. We retain only aggregates from 5 or more contributors, with differential-privacy noise, and never any prompt or code content.

Federated contributions are designed to be anonymous, not merely pseudonymous. Specifically:

• Disposable monthly key. Your device identifier is hashed with a random per-month key that is destroyed when the month closes. After destruction, that month's contributions cannot be recomputed or re-linked to a device — even by us. Contributions from different months are already unlinkable to each other.
• No identity join. Federated records contain no link to your account, email, or subscription — they are stored entirely separately from your user profile.
• Statistical noise. Numeric signals are perturbed using differential-privacy techniques before they reach our servers, so no single record reflects your exact activity.
• No raw identifier retained. We do not store the raw device identifier we receive; it is hashed on arrival and discarded.
• Aggregation with a minimum cohort. Patterns and metrics are retained only in aggregate, and only once they appear from at least 5 distinct contributors; per-device records are purged when the month is sealed.

Our commitment. We maintain and use this information only in anonymized form. We do notattempt to re-identify it or link it back to any individual, device, household, or account, and we will not authorize any third party to do so — except solely to verify that our anonymization process works, as permitted by law. Because this data is not reasonably linkable to you, we treat it as de-identified under U.S. state privacy laws. Once a month is sealed and its per-month key is destroyed, we consider that month's contributions anonymised and, on our assessment, outside the scope of the GDPR; before sealing, contributions are treated as pseudonymised personal data.

Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your data
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Export your data in a standard format
• Opt-out: Unsubscribe from marketing communications, and turn off product telemetry at any time (see “How to turn telemetry off” above)

To exercise these rights, contact us at hello@superstack.now. We will respond to all subject access requests within 30 days. If we need additional time (up to 60 more days for complex requests), we will notify you of the extension and the reason.

Account Deletion:You can delete your account at any time by navigating to Settings → Danger Zone → Delete Account in your dashboard. Upon requesting deletion, your account enters a 7-day grace period during which the deletion can be cancelled. After the grace period, all account data is permanently deleted within 30 days.

A note on anonymized data: Aggregated, anonymized federated-learning contributions are not linked to your account and cannot be traced back to you, so they cannot be individually retrieved, exported, or deleted. Deleting your account removes all data that identifies you; it does not affect already-anonymized aggregate statistics, which no longer constitute your personal information.

Data Export:You can export a copy of your data at any time from Settings → Data Export in your dashboard. The export includes your profile information, usage metrics, and subscription history in JSON format.

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Opt-Out of Sale: We do not sell your personal information to third parties

Deidentified data. Our federated-learning contributions are deidentifiedwithin the meaning of Cal. Civ. Code § 1798.140(m). We have implemented technical safeguards that prohibit reidentification, we publicly commit to maintaining and using this information only in deidentified form, we do not attempt to reidentify it, and we contractually obligate any recipient to comply with the same. Such deidentified data is not “personal information” under the CCPA.

To exercise your CCPA rights, contact us at hello@superstack.now. We will verify your identity before processing any request.

International Data Transfers

Superstack is operated from the United States. If you are accessing our service from outside the United States, your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms to ensure your data receives adequate protection.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, as required by GDPR. Notification will be sent via the email address associated with your account and will include the nature of the breach, the data affected, and steps we are taking to address it.

Data Retention

We retain your data for as long as your account is active. We then prune older records on the following schedule (enforced by an automated daily job):

• Usage / sync events: 18 months
• Webhook & email delivery events: 90 days
• Security audit logs: 12 months
• Failed sign-in records: 30 days

Upon requesting account deletion, your account enters a 7-day grace period during which you can cancel the deletion request. After the grace period, all personal data and usage metrics are permanently deleted within 30 days, except where retention is required by law (e.g., billing records).

Children's Privacy

Superstack is not intended for users under 13 years of age. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the service. Your continued use after changes constitutes acceptance.

Cookies

Superstack uses essential cookies only. These cookies are strictly necessary for the operation of our service:

• Session cookies: Maintain your login session
• Authentication cookies: Securely identify your account

With your consent, we use anonymous analytics cookies from Google Analytics and PostHog to understand how visitors use our site and improve the experience. These are only loaded after you accept the cookie banner. You can decline analytics cookies and still use the full site. We do not use advertising cookies.

Contact Us

The data controller is Fluxcode Studio LLC (d/b/a Superstack). If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Email: hello@superstack.now