Privacy Policy

Who we are

BillCurfew is operated by Jarrett Christensen in Orem, Utah, USA. The product sends AI API spend alerts and can kill an OpenAI, Anthropic, or OpenRouter key when a rule says to. Questions about this policy go to hello@billcurfew.com.

Account

When you create an account we store your name, email, and a scrypt hash of the password. We do not store the password itself. We also store the plan, whether it is active, trialing, past due, or canceled, the trial end time, whether the morning digest is on, and when the account was created.

Signing in sets one cookie, bc_session. It is httpOnly, SameSite is Lax, it is marked Secure in production, and it lasts 30 days. The database stores a SHA-256 hash of that token, not the token. Logging out deletes the cookie and that hash.

Provider keys

A connection stores the provider (OpenAI, Anthropic, or OpenRouter), a label you choose, and the admin or management key. The key is encrypted with AES-256-GCM before it is written. We also keep a hint of the last four characters so you can recognize the key. The encryption key lives in the server environment, separate from the database. Disconnecting a provider deletes that secret.

For each watched key we store the provider’s key id, the OpenAI project id when the provider returns one, the key name, the redacted value the provider returns, whether the key is watched or disabled, a usage cursor for OpenRouter’s daily total, and the last time we saw it. We do not store prompts, completions, tool arguments, or embeddings. There is no column for them.

Spend

Each poll writes spend snapshots: the time bucket, its length, the cost in micro-dollars, input tokens, output tokens, the model name, and whether the figure came from the provider or from our price table. Snapshots older than the plan’s history window are deleted. That window is 7 days on Free, 30 days on Solo, 90 days on Team, and 365 days on Agency.

Rules store a daily cap or a spike setting, whether email or Slack should fire, and whether auto-kill is on. Auto-kill stays off until you turn it on. Client rows, on plans that include them, store a name and an optional budget. The activity log stores short messages for alerts, kills, restores, sync errors, and mail delivery. A kill event can also record whether it was automatic and whether the provider delete is reversible.

Email, Slack, and the list

Alert and digest mail is sent with Resend to the email on the account. The default sender is BillCurfew <alerts@billcurfew.com>. An alert contains the spend figure, the key name, and the rule that fired. A morning digest, on plans that include it, contains yesterday’s spend by key, client budgets when you have them, and the alert text from that day. Neither message contains prompts. A copy of the text, the recipient, the subject, and whether Resend accepted it is saved on the account so you can see it in activity. If Resend is not configured, the copy stays in that outbox and is not sent.

If you save a Slack webhook, the URL is encrypted with the same AES-256-GCM step as a provider key. We post the alert text to that URL. We do not read your Slack workspace.

When ActiveCampaign is configured, signup sends your name and email there and subscribes you to the list configured for this product. The account is still created if that call fails. The failure is written as an activity note.

Payments

Paid plans are billed by Stripe. We do not store card numbers. We store the Stripe customer id and subscription id. Stripe Checkout collects the card, and, when tax applies, the billing address and tax id. Those stay with Stripe. Provider keys are not sent to Stripe. Webhook deliveries are recorded by Stripe event id and event type so a repeat delivery is not applied twice.

Analytics

The site includes Vercel Web Analytics. It records page views and three product events: signup started, signup completed, and checkout started. Checkout started includes the plan name (Solo, Team, or Agency). Those events do not include provider keys, spend, or email. We do not store IP addresses. A signup from the same network is counted in memory so one network cannot create accounts without limit, and that count is not written to the database.

Where it lives

The app is hosted on Vercel. Account data is in a Postgres database on Neon. Calls to OpenAI, Anthropic, and OpenRouter use the key you pasted, and only the admin endpoints needed to read spend or to disable or delete a key you asked us to stop.

Closing an account

There is no delete button in the product. Email hello@billcurfew.com to ask for a copy of the account data or to close the account. Disconnecting a provider deletes that key. Canceling in the Stripe customer portal stops the subscription. The Terms of Service cover the plan and the kill switch. The security page lists the provider endpoints we call.