Privacy Policy

Last updated: July 25, 2026

ProvenMachine LLC ("we," "us," or "our") is an Illinois limited liability company based in Brookfield, Illinois. ProvenMachine designs, ships, and operates its own iOS apps distributed through the Apple App Store, and separately retains website-audit tooling for businesses. We respect your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website at provenmachine.com, and how app-level privacy notices work for our iOS apps.

1. Scope of This Policy

This Policy covers two different things, described separately below:

This website — provenmachine.com, including our website-audit tool, onboarding forms, and consultation booking.
ProvenMachine iOS apps — apps we design, ship, and operate that are distributed through the Apple App Store.

Data practices are not identical across our apps. Each app's specific data collection and processing practices are described in that app's own in-app privacy notice and its App Store privacy label (Apple's "App Privacy" section on that app's product page) — not in this general website policy. Where this Policy and an app's own privacy notice differ, that app's own privacy notice controls for that app. If you engage us for a private client iPhone-app build, that engagement's signed agreement governs data handling for that project and may supplement this Policy.

2. Information We Collect — Website

Information you provide:

Website URLs — When you use our audit tool, we collect the URL you submit for analysis.
Contact information — When you book a consultation, submit an onboarding form, or send a client-build inquiry, we collect your name, email address, phone number, and business details.
Website access credentials — If you hire us for website-audit implementation work, we collect login credentials (such as CMS or hosting passwords) necessary to perform that work. We do not collect this for iOS app engagements.
Communication content — Messages, feedback, and other content you send to us.

Information collected automatically:

IP address — Used solely for rate limiting and abuse prevention.
Usage data — Pages visited, audit requests made, timestamps, and interaction with the website.
Device and browser information — Browser type, operating system, and screen resolution transmitted via standard HTTP headers.

3. Information Collected by ProvenMachine iOS Apps

Our apps do not all collect or process data the same way, and this website does not receive personal records you enter into an app (such as habit logs, inventory records, warranty details, or decision journal entries) unless that specific app's privacy notice says otherwise. For the exact categories of data a given app collects, whether that data leaves your device, and how it is used, see:

The in-app privacy notice available in that app's Settings.
That app's App Store product page, under Apple's "App Privacy" section, which lists the data types the developer has declared.

If you have a privacy question about a specific app that its in-app notice does not answer, contact us using the details in Section 13; identify the app by name so we can route your question correctly.

4. How We Use Website Information

To perform website audits you request
To generate AI-powered audit reports and recommendations
To communicate with you about our services, including client iPhone-app inquiries
To implement website improvements you've purchased
To prevent abuse and enforce rate limits
To improve our services and develop new features
To comply with legal obligations

AI processing disclosure: When you submit a URL for audit, publicly accessible content from that website (such as HTML, CSS, text, and images) may be sent to third-party AI services (Anthropic Claude and Google Gemini) for analysis and report generation. We do not send your personal contact information or website credentials to any AI service. AI-generated outputs are included in your audit report and subject to the data retention periods described below. This disclosure covers the website audit tool only; it does not describe how any ProvenMachine app processes data, which is covered by that app's own privacy notice.

5. Third-Party Services

We use the following third-party services to operate the website and audit tool:

Anthropic (Claude AI) — We use Claude to analyze website data and generate audit recommendations. Publicly accessible website content you submit for audit may be processed by their API. See Anthropic's Privacy Policy.
Google Gemini AI — We use Gemini for image generation and visual analysis as part of our audit process. Website images and visual elements may be processed by this service. See Google's Privacy Policy.
Google PageSpeed Insights API — We use this service to analyze website performance metrics. Only publicly available data is sent. See Google's Privacy Policy.
Hetzner Cloud — Our infrastructure hosting provider, with servers located in Germany and the United States. See Hetzner's Privacy Policy.
Apple — Purchases, subscriptions, downloads, and App Store transactions for any ProvenMachine app are processed by Apple under Apple's own terms, not by us. See Apple's Privacy Policy.

Any third-party services a specific app uses beyond Apple's platform frameworks are disclosed in that app's own privacy notice and App Store privacy label, not in this list. We do not sell your data to any third party. Website-side services above receive only the minimum data necessary to perform their function.

6. Data Retention

Audit reports are retained for 90 days from generation, then permanently deleted.
Contact information (name, email, phone, business details) is retained until you request its deletion.
Website access credentials are permanently deleted within 7 days of project completion.
IP addresses and rate limit data used by the website are retained for 24 hours, then automatically purged. Standard server access logs used for security, diagnostics, and first-party visit analytics may be retained according to host log rotation, typically up to 30 days.
App data retention (including whether data stays only on your device) is described in that app's own privacy notice, not here.

7. Data Security

We implement security measures to protect information collected through the website:

Encryption at rest — Stored website data is encrypted using AES-256 encryption.
Encryption in transit — Data transmitted between your browser and our servers is protected by TLS (Transport Layer Security).
Credential isolation — Website access credentials are never sent to any AI API (Anthropic, Google, or otherwise). Credentials are stored separately from all other data, are accessible only to the team member assigned to your project, and are permanently deleted within 7 days of project completion.
Access controls — Strict access controls on all administrative endpoints and internal systems.
Rate limiting — Automated abuse prevention to protect the integrity of our systems.

App-level security practices (such as local-only storage, on-device encryption, or iCloud sync) are described in that app's own privacy notice. No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights

Regardless of where you reside, you have the following rights regarding your personal information:

Access — Request a copy of the personal data we hold about you.
Deletion — Request that we delete your personal data.
Correction — Request that we update or correct inaccurate information.
Opt out — Unsubscribe from marketing communications at any time.
Data portability — Request your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, email us at privacy@provenmachine.com. We will respond to your request within 30 days.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with additional rights regarding your personal information. This section addresses personal information we collect through the website; an app's own privacy notice addresses that app's collection separately, and may include its own CCPA/CPRA disclosures.

Categories of personal information we collect (website):

Identifiers — Name, email address, phone number, IP address.
Internet or network activity — Browsing history on our site, audit requests, interaction data.
Professional or employment-related information — Business name, job title, and business details you provide.
Sensitive personal information — Website access credentials (login usernames and passwords) are treated as sensitive personal information under CPRA.

Sources of personal information: We collect personal information directly from you when you use our website, submit forms, or communicate with us. We collect technical data automatically through your use of our website.

Business purpose for collection: All personal information is collected and used for the business purposes described in Section 4 of this policy — primarily to provide, maintain, and improve our website audit and optimization services and to respond to client-build inquiries.

Third parties receiving personal information: We share data only with the service providers listed in Section 5 (Anthropic, Google, Hetzner, and Apple where relevant) solely for the purposes of providing our services. We do not share credentials with any third party.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Your California rights include:

Right to know — Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete — Request deletion of your personal information.
Right to correct — Request correction of inaccurate personal information.
Right to opt out of sale or sharing — We do not sell or share your data, but you may still submit such a request.
Right to limit use of sensitive personal information — You may request that we limit the use of sensitive personal information (such as credentials) to what is necessary to provide the services.
Right to non-discrimination — We will not discriminate against you for exercising any of your privacy rights.

Response timing: We will acknowledge your request within 10 business days and provide a substantive response within 45 days. If we need additional time, we will notify you of the extension (up to an additional 45 days) and explain the reason.

Authorized agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of written authorization and may verify your identity directly.

To submit a California privacy request, email privacy@provenmachine.com with the subject line "California Privacy Request."

10. Data Breach Notification

In accordance with the Illinois Personal Information Protection Act (815 ILCS 530), in the event of a data breach affecting personal information we hold, we will:

Notify affected individuals in the most expedient time possible and without unreasonable delay.
If website access credentials are involved, notify you via both email and phone to ensure prompt awareness.
Notify the Illinois Attorney General if the breach affects more than 500 Illinois residents or as otherwise required by law.
Provide details about the nature of the breach, the types of information involved, and steps you can take to protect yourself.

11. Cookies & Tracking

We do not use tracking cookies, third-party analytics, or any advertising trackers on the website. We do not use Google Analytics, Facebook Pixel, or any similar tracking tools.

We may use strictly functional cookies for rate limiting and session management. These cookies do not track you across websites and contain no personal information.

Global Privacy Control (GPC): We recognize and honor Global Privacy Control (GPC) signals sent by your browser. When we detect a GPC signal, we treat it as a valid opt-out request.

Our apps' own use (or non-use) of tracking, analytics, and identifiers is described in that app's own privacy notice and App Store privacy label.

12. International Data Transfers

Website data may be transferred to, stored, and processed in the United States and Germany (via our hosting provider, Hetzner Cloud). By using the website, you consent to the transfer of your information to these countries, which may have data protection laws that differ from those in your jurisdiction.

We take steps to ensure that your data receives an adequate level of protection wherever it is processed, including the security measures described in Section 7.

13. Children's Privacy

The website and our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 through the website. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as promptly as possible. If you believe we have collected information from a child, please contact us at privacy@provenmachine.com. Any age rating or age-related handling for a specific app is described in that app's App Store listing and its own privacy notice.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of the website after such changes constitutes acceptance of the updated policy. We encourage you to review this page periodically. Changes to an individual app's privacy notice are posted with that app and, where required, reflected in that app's App Store privacy label at its next update.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our website data practices, contact us at:

ProvenMachine LLC
Brookfield, IL 60513

Email: privacy@provenmachine.com
Website: provenmachine.com

For a question about a specific app's data practices, email us and name the app, or use the contact method listed in that app's own privacy notice or Support URL on its App Store product page.