Python Visuals · An Apeiron Company

Privacy Policy

Effective October 19, 2026 · Version 2.59

1. Who We Are

Apeiron is operated by Python Visuals LLC, a New York limited liability company formed on June 5, 2026. Throughout this Privacy Policy, "Apeiron," "we," "us," and "our" refer to Python Visuals LLC. Before that date the same practice operated as Python-Visuals Web Design (Long Island, New York); Python Visuals LLC is its successor, and this policy continues to apply unchanged.

This Privacy Policy applies to the following properties, which we collectively refer to as the "Platform":

  • apeironweb.com — the Apeiron Command Center, including the login page, the founder dashboard, the client portal, the public legal pages, and any subpages hosted on this domain.
  • python-visuals.com — our public-facing site, presenting the Apeiron OS productized service plans, services catalog, case studies, capabilities, partner network, and contact forms.
  • blackoutmedia.org, blueprintmedia.club, sydneyssweets.com — active client sites that we build, host, and maintain on behalf of the named client businesses. On these sites, Apeiron acts as a data processor rather than a data controller (see Section 9).

This Policy does not cover the data practices of the client businesses themselves — their own policies govern how they, as controllers, use any personal information they collect from their end customers through the sites we build for them.

2. What Information We Collect

The information we collect depends on which part of the Platform you are using and in what capacity. We have tried to describe this as plainly as possible.

If you are a visitor to apeironweb.com or python-visuals.com: We collect your IP address and basic request metadata (browser user agent, referring URL, page viewed, timestamp) through Cloudflare's standard edge logging, which is used for security, performance, and fraud prevention. On Apeiron-owned properties (apeironweb.com, python-visuals.com) we also receive aggregate, cookieless analytics data through Cloudflare Web Analytics (page views, Core Web Vitals, country-level geography). On externally-owned client sites that we build and host, Cloudflare Web Analytics is currently enabled on blueprintmedia.club and sydneyssweets.com (captured at the time the sites were stood up; written consent from the respective owners is being formalized as of May 2026). We will remove Cloudflare Web Analytics from any client site whose owner declines. On python-visuals.com our own pages also keep a small first-party record of a few steps: a click to book a call, start an order or a plan, see our work or open the Website Check, each step of the order page (which package you looked at, and when you started and finished its questions), and on the Soul page (python-visuals.com/box) how far down it you got, for each card you swipe in its deck whether you kept it or passed on it (for a card from our library, only its topic and kind, never which card), which pictures or cards you opened, whether the deck asked you to keep your cards in a Box, which looks you tried on the sample Onibee (Soul’s pet), whether you tapped the card to Underword, the name of the site that sent you there, and a click to sign in. On Underword (python-visuals.com/underword) the same record keeps the page opening, a return on a later day (how many days since your last game, and your streak), your first move, each round reached and solved, how the game ended and how many rounds you solved, in Call Your Shot your call and your Onibee’s when you lock it, each board you solve or lose and the flips you have left, how each run ended with your call and the rounds you made, and a tap on Stop here with the rounds you made and your call, a tap on Share, the name of the site that sent you there, the short tag on the link that brought you (like the name of a games list, or "dare" when a friend shared their result), and a click to sign in, never a word you typed or guessed. On Future Sight (python-visuals.com/future-sight), our free skill for Claude, the same record keeps the page opening (whether you came from the Soul page, from inside Soul, or from another site, by that site’s name), a tap on the download, and a click to sign in. On our sign-in page (apeironweb.com/signin), the same record keeps the page opening (whether you came to make an account or to sign in, and whether a streak, a day, kept cards or an invite was waiting for you), which way in you tapped (Google, Discord or email), that a code was sent, that you signed in, and the kind of problem if a step failed (like a code that did not work), never your email address, your name or anything you typed. When you tap from python-visuals.com to the sign-in page, the link carries that tab’s random key, so the two parts of one visit count as one. Each record holds what was clicked or reached, where, and a random key your browser keeps for that one tab (see our Cookies Notice), never your name or IP address. If you use the Website Check (python-visuals.com/ai-fit), the address you type goes to our function, which opens that one page, and the site’s robots.txt, sitemap.xml and llms.txt, the way a browser would, runs a fixed list of checks with no AI, and shows you the result. We keep only that a check ran, how it ended and how many checks looked good, never the address you typed or anything from the page; the record of steps keeps that you tapped Check (and which of our sample sites, if you tapped one), those numbers and a tap on Copy, never the address. If you tap Send these fixes to Theo, the site’s address, the list and the email you type (and your name or phone, if you add them) go to us as a request, so Theo can reply: we keep them with our other requests, they reach us by email and in our team’s chat, and that is the one time the address is kept. (Before October 13, 2026 this page was the AI Fit Check, which recorded the choices you picked the same way.) If you then place an order, the key is saved with it, which connects those steps to your order. We do not use Google Analytics, Facebook Pixel, or any cross-site advertising tracker anywhere on the Platform.

If you swipe the deck on the Soul page (python-visuals.com/box): its cards come from our server, from the same library every Box starts from, and nothing about you goes with that request. The cards you keep or pass on stay in your browser (see our Cookies Notice) and choose the next card right there on the page; none of them leaves your browser unless you make your account with cards kept (below). A video card shows its words only, and nothing loads from YouTube until you tap to watch it; then it plays in YouTube’s privacy-enhanced mode (from youtube-nocookie.com), and your browser tells Google your IP address, as it does for any video. A link card opens the other site in a new tab, without telling it which page you came from. If you have kept cards and tap to make your account, the page sends which library cards you kept (their ids, nothing else) to our function, which keeps them for up to 24 hours under a code, storing only a scrambled form of the code, with the topics they lean to. The code goes with you to the sign-in page at apeironweb.com, which keeps it for that tab. Once your account’s Box exists, those topics (up to three) become your first goals with their cards, and the cards you kept are saved on them, the way a swipe right saves a card in your Box. Then the code is used up, and the record that it was used goes a day later; codes nobody uses are deleted after 24 hours.

If you play Underword (python-visuals.com/underword): the game runs in your browser. When you finish a round, the page sends our function that day’s date and the moves you made (each coin you turned and each word you guessed, and how long after the round began), so it can check them and deal the next round; we keep nothing from that (the page’s own count of its steps, never the words, is above). Your browser keeps today’s game, so a reload carries on, and the days you played, for your streak, for up to 60 days (see our Cookies Notice); none of it leaves your browser unless you tap Keep my streak. A day you leave unfinished also stays in your browser for 7 days, so you can finish it for practice: it counts for nothing, and the page counts none of its steps. Share copies your day’s squares for you to paste where you like, and never the words. In Call Your Shot, Underword’s ten-round game, your Onibee makes a call of how many rounds you’ll finish and you can change it before you play; your browser keeps your call, today’s run (the boards you were dealt and your moves, so a reload carries on) and your last 14 plays (each one’s date, your call, the rounds you made, how it ended and the flips you used), so the end screen can show how your calls tend to land. When you solve a board, the page sends our function that day’s date and your moves, as above, so it can check them and deal the next board, and we keep nothing from that. Nothing else of it leaves your browser unless you tap Keep my XP. Share copies your call and the rounds you made, never the words. If you tap Keep my XP when a run has ended, the page sends that day’s date, your moves, your call and whether you stopped (never your name) to our function, which checks the whole run, works out its XP and keeps them for up to 24 hours under a code, storing only a scrambled form of the code. The code goes with you to the sign-in page at apeironweb.com, which keeps it for that tab. Once your account’s Box exists, the day is added to it once, with your call, kept the way your Box keeps its own games (below): its XP grows your Onibee, and it never counts for Soul Coins. Your Box takes one Underword day a day, whichever game it was. Then the code is used up, and the record that it was used goes a day later; a day nobody adds is deleted after 24 hours. We use the calls and how far each run got, counted across everyone who plays, to tune the game: how many rounds your Onibee calls, how many flips a run gets, and how hard each length of board is. Those counts never name you and are never shown to anyone else. If you use Tell us what you think, we keep what you write, the page you wrote it on, and whether you were on a phone or a computer, for up to 12 months, so our founders can read it and act on it; it is kept apart from every Box, never placed in one, and carries nothing that says who you are unless you write it in. If you tap Put me on the board, our function gives your browser a random key, which it keeps for the weekly board (see our Cookies Notice), and a made-up name from a fixed list of words (Re-roll name asks for another); we keep only a scrambled form of the key and the number that picks the name. From then on, each day you finish sends that day’s date and moves with the key, and once our function has checked all six rounds we keep the date, how many rounds you solved and how many coins you turned. The board shows each player’s made-up name, rank, rounds solved and days played that week to anyone who finishes a day. We delete each day after 8 weeks, and a key’s record once it has no days left; nothing on the board says who you are. If a day’s score cannot reach us, your browser keeps its date with the key and sends it again later. Leave the board deletes your key’s record and every day it holds at once, and your browser forgets the key. If you tap Keep my streak, the page sends the days of your streak (their dates and your moves, at most 30 days, never your name) to our function, which checks each one and keeps them for up to 24 hours under a code, storing only a scrambled form of the code. The code goes with you to the sign-in page at apeironweb.com, which keeps it for that tab. Once your account’s Box exists, the days become your Box’s games for those dates, kept the way your Box keeps its own games (below): they count for your streak and never for Soul Coins, and a day your Box already has stays as it is. Then the code is used up and the moves we held are deleted, and the record that it was used goes a day later; days nobody claims are deleted after 24 hours. When you tap Keep my streak and today’s game is done, the page also sends today’s date and your moves (never your name) to our function, which checks all six rounds and keeps them for up to 24 hours under a code, storing only a scrambled form of the code. That code goes with you to the sign-in page beside your streak’s, and the sign-in page keeps it for that tab. Once your account’s Box exists, the day is added to it once, kept the way your Box keeps its own games (below); unlike carried days, it counts for Soul Coins, within the same daily limit as Soul’s own game. Then the code is used up, and the record that it was used goes a day later; a day nobody adds is deleted after 24 hours.

If you submit one of the forms on python-visuals.com: Besides the order page (below), the site has three forms that collect personal information voluntarily. (1) The Contact form collects your name, email address, business name (optional), and the message you send us. (2) The lead-magnet form ("Get All Three Guides") collects your email address only. (3) The SEO Snapshot form collects your domain and email address. All three forms submit to our formspree-webhook Supabase edge function, which records the submission and forwards it via Resend (transactional email) and Discord (internal notification) to the appropriate recipient. We use the information solely to respond to your inquiry, deliver the requested artifact, or, if the inquiry converts into a client relationship, to deliver services to you. We do not add submissions to any marketing email list.

If you order a build or start a plan on python-visuals.com (at python-visuals.com/order, or through an AI assistant ordering for you): when the order is sent, we keep your name and email address, your business name and phone number if you give them, your answers about the project and any notes, with the package and its price. We keep them before you pay, so an order left at checkout stays with us unpaid; if your answers put the job outside what the package covers, the page tells you so and we keep only that it happened, not your details. You pay on Stripe’s own checkout page (see Section 5), which sends us back the result and Stripe’s reference numbers, never your card. When a deposit is paid, your name, your business name, the package and the amount go into our books, a notice to our founders, and a post in our team’s private Discord, so that a person starts your build and sends you your upload link. If you start a monthly plan instead, Stripe collects your name and email address, and they reach the same places and our client records. We use all of this to deliver what you ordered and to keep our tax records (see Section 6). To have an unpaid order removed, email [email protected].

If you have a Box (made when you make an account at apeironweb.com/signin, which is also where a friend's invite takes you, and served at apeironweb.com/workstation; it opens only when you are signed in to that account): Before accounts opened on September 30, 2026, people asked for a Box at python-visuals.com/box. For each of those requests we keep the name, email address, optional X handle and sentence the person wrote, plus a hashed form of their IP address for abuse control, and the name, the handle and the start of that sentence were posted to a private channel in our team's Discord so that a person saw it. Your Box holds what you put in it — your intake answers, the items you place on its board, files you upload, and any cards or files the crew returns to you — stored in our database (Supabase, United States) under your page, with your files in private storage, and used only to build what you asked for. Every file is checked by its own contents when you upload it, and only PDFs, Word (.docx) documents, plain text and photos (JPEG, PNG, WebP, HEIC) go in; videos and archives are refused. To build it, the crew reads what you send, and so do the AI tools we build with (today, Anthropic's Claude; see Section 5). When one of your cards goes to our build floor, only the words of your idea travel: never your name, your page, or anything else about you. Your Box’s page never calls an AI model; when a routine runs for you (below), our server does. If you connect your own AI assistant, we store only a hash of the key you mint; the key opens your Box alone, you can revoke it on your page at any time, and we never receive or store your assistant's own credentials. The Soul page (python-visuals.com/box) shows three totals across every Box: how many Boxes people have signed in to, how many times an AI assistant has connected to them, and how many different assistants have. They are counts only, and never say whose Box or which assistant. If you install Apeiron OS, the note inside the folder it makes (telemetry/README.md) lists everything that folder sends to your Box. Videos on your Box come from YouTube. When a playlist on your page holds a video, the video's picture loads from YouTube's image servers when its card comes on screen, and the player loads in YouTube's privacy-enhanced mode (from youtube-nocookie.com) when you open it. Your browser then tells Google your IP address and that the request came from apeironweb.com, never the address of your Box, and what YouTube does with that is covered by Google's own privacy policy. A link on a card opens the other site in a new tab without telling it which page you came from. If you play the daily game on your Box, each game is saved to your Box as you play: each round's two words, every coin you turn and every word you guess, and how long after the round began you made each move. It is used to score your game, grow your Onibee, show you how you played and help choose the cards on your goals, and it goes when your Box goes. After a game, your Box shows a short read of how you played: a few lines, each naming one of your moves, written by fixed rules, never by an AI. Your “that’s me” and “not me” answers, and any reason you type, are kept on your Box and go when your Box goes. Now and then a read ends with one more question, which of two descriptions is more you, to check whether the read really knows you; your pick is kept the same way, apart from the read, and never changes it. If you change an answer later, both are kept. Your Box also keeps when you open it and which of its tabs you open (Home, Play, Goals, You or Sky), and nothing else about where you look on the page; we use it to see which parts of the Box people actually use. When you save a card, mark it done, or mark it not for me, that choice is kept on your Box too: it decides what your Home shows you next, and the crew reads it to choose what to add. When a choice comes from Undo on Home, Back to your hand on You, or Done on your Sky, we also note which of those it was. When you send a card up to your Sky or clear it off, we note which card and when; that note holds none of the card’s words. From those choices our server also counts, by fixed rules and never by an AI, the kinds of card you keep and pass (videos, pages and steps, short or long, and by goal), and gives those counts to the AI that chooses your cards as a quiet guess; they are not shown on your Box, they are in Download my box, and they change as your choices do. When you make a goal, you tell your Box where you are with it (new to it, dabbled, do it regularly, or good and wanting better) and, if you like, what you have already tried; both are kept on your Box, read to choose your cards, and go when your Box goes. Our AI (today, Anthropic’s Claude) lays out cards for the goal and adds more as you go; when you first say where you are with a goal that already has cards, the cards you have not opened are picked again for that level. It runs on our server the moment you make a goal, say where you are with one, or finish or pass a card that leaves two or fewer on its branch: our server sends what it reads (below) and the matching shelf of our card library to Anthropic’s API. It may search the web in a few general words about the topic, never with your name or anything you wrote, and every video and page it picks is checked before it reaches you. We keep a record of each growth (its date, the model, how much text went in and out, how many searches, what it cost, and which cards it added), never the cards’ words in that record. Anthropic deletes what it receives within 30 days, except where its usage policy or the law requires longer, and does not train its models on it. To choose them it reads what your Box holds: your answers, your goals (where you said you are with each, and what you tried) and their cards, the cards you saved, finished or passed on, your games and your read, your asks, your dates, and the names of your files. It never reads what’s inside your files, and never another person’s Box. Each card it adds says why it picked it. Your Box is yours to empty: on your Box, Delete my Box (under your letter, after Download my box) asks you to sign in again, then closes your Box at once and erases it 7 days later, unless you tap Keep my Box before then; pressing it also cancels a membership, and bought Soul Coins go with the Box. Or email [email protected]. Either way, within 30 days we delete your page and everything on it, your account if you made one, your request and its Discord post if you made one, your files, the bug reports you sent us, and any copy of your idea on the build floor. Copies in our weekly backups are gone within five weeks after that (see Section 6).

If you turn on card emails: When you switch on “Send tomorrow’s card to email” on You, or say yes when your Box asks after you finish a card, we keep that it is on, your time zone as your browser reports it (so the email comes at 8 AM your time), when you were asked, and when and how you turned it on or off. Each day it is on and you have not opened your Box yet, we send one email, from [email protected] through Resend, to the address you sign in with: it names the next card on the goal you worked on last, and what you kept from the last card you finished, in the cards’ own words. For each email we keep the day, which card it carried, Resend’s reference for it, whether it went, and whether you opened your Box from its button (the button passes through our server to note that, then takes you to your Box). Every email has a link to a page where one button turns them off, without signing in; opening the link alone changes nothing. Your mail app’s own Unsubscribe, where it shows one, turns them off too, and you can turn them off on You at any time. It is all deleted with your Box.

If a routine runs on your Box: Once a day, our server sends what our AI reads to choose your cards (listed above), the routine’s instructions, and the cards it sent you before with how you judged each, to Anthropic’s API (Claude). It may search the web to find videos and pages; it is told to search in a few general words about the topic, never with your name or anything you wrote, and it never has the address of your Box. Every video and page it picks is checked before it reaches you: a video with YouTube, a page by loading it from our server. The cards land in your For you, named for the routine. We keep a record of each day’s run (its date, the model, how much text went in and out, how many searches, what it cost, and how many cards landed), never the cards’ words in that record; the cards themselves stay on your Box like any other. Anthropic deletes what it receives within 30 days, except where its usage policy or the law requires longer, and does not train its models on it.

If you talk with Soul on the back of a card (18 and over only): When you send a message, our server sends the card’s title and words, the name of the goal it is on, and what you and Soul have written about that card in this visit, to Anthropic’s API (Claude), which writes the answer. We keep a count of your messages (when, which card, how much text went in and out, and what it cost), never what you or Soul wrote: the conversation stays on your screen and is gone when you leave the page. Anthropic deletes what it receives within 30 days, except where its usage policy or the law requires longer, and does not train its models on it.

If you make a skill or a branch: When a goal has given what it can, your Box offers to turn it into a skill, branch into what’s next, or keep going. If you spend coins on a skill, our server sends that goal’s branch (its goal in your words, its cards and what you did with each) and what our AI reads to choose your cards (above) to Anthropic’s API (Claude), which writes the skill; before we keep it we check it for anything that looks like an email, a phone number or a street address. We keep the skill on your Box as a file your own AI can read, its badge (its title, when it was made, and whether you pinned it to your Onibee), and a record of the order (its price, whether it was written, and what writing it cost us), never the skill’s words in that record. If it cannot be written, your coins come back. A branch you start from another keeps the card it grew from. Once you hold three skills, you can combine three you pick into a workflow: our server sends those three skill files and what our AI reads to choose your cards (above) to Anthropic’s API (Claude), which writes the workflow, and we keep it the same way as a skill, with its own badge and a note of which skills it came from. It stays on your Box; we do not share it with anyone.

If you use rooms or Soul Ties on your Box: A room shows the people in it each other’s first name, the status each one picks (quiet, here, away or building), each one’s level, each one’s Onibee in the room’s sky (its color and its edge, drawn at the size of its level; nothing about how they play), each Onibee’s name and what it wears, the cards someone put into the room on purpose, who voted which way on them, how many Soul Coins each one put in the room’s pot, and the cards the room sent us for a review (when, what each cost from the pot and when its answer is due); nothing else from your Box crosses into a room. If you write in a room’s chat, everyone in that room sees your words and your first name; we keep each message for 30 days and then delete it, you can delete your own at any time, and the room’s owner can hide one, which keeps it out of sight until it is deleted. If someone in the room reports a message to us, we keep a copy of it with their report so our crew can read it. A room’s chat is never read by your AI apps or anyone else’s. Coins you put in a pot, and any that come back to you when a room closes, are lines in your Box’s record of Soul Coins (below); a review a room pays for is kept like an order: what it was, what it took from the pot, when it was due, and whether it was answered or the coins went back. When a room sends a card for a review, our crew is told that a review is due and when, never what the card says, and reads the card itself on the crew’s floor. A Soul Tie is a friend you both said yes to: you give someone your Soul Tie code or an invite, and they accept, or you accept theirs. An invite is a sign-up link that works once: for each one you make we keep the first name you typed, the room it asks them into, when it was made and whether it was used or cancelled, until your Box is deleted, and only a scrambled form of the link itself. When a room’s owner invites a Soul Tie into it, they can add a short note saying why (up to 140 characters); the person invited reads it, with the room’s goal and how far along it is, before they choose to join, and we keep the note with their seat in the room. A Soul Tie always sees your first name, your Onibee’s name and what your Onibee wears. They see your status, whether you played the day’s game, and that game’s squares (one square per round, solved or not) only if you turn each of those on in Settings, on your Soul Ties list; all three start off. A Soul Tie never sees your words, your answers, your cards, your files, your AIs or the address of your Box. You can untie, take back a request, make a new Soul Tie code (the old one stops working) or turn any of the three off at any time. When a Box is deleted, its Soul Ties go from both people’s lists.

If you earn or spend Soul Coins on your Box: Your Box keeps a record of every Soul Coin in and out: the welcome coins, the coins for the daily games you finish (up to the daily and monthly limits your page shows), any the crew gives you, and any you spend or get back. When you close a branch, our AI (the same one described above, reading the same things) may draft what that branch could become: a blueprint your own AI can follow, a routine we run for you, or something our crew builds for you. If you get one with your coins, we keep the order: what it was, how many coins it took, when it was due, and whether it was delivered or your coins came back. A blueprint arrives in your Box as a file your own AI can read. A new order tells the crew, in our team’s private Discord, that one came in and what kind it is, never your name or your words. When you buy Soul Coins, Link (Stripe’s checkout) sells them to you as the seller of record: Link collects your card details, your email and your billing address (to work out sales tax) and sends your receipt, under Link’s own privacy policy. We receive a record of the purchase (the pack, the amount, the tax, the time and Stripe’s reference for it), never your card number. If a payment is refunded, the coins it bought come off your balance, and while a payment is disputed your coins are held. Soul Coins have no cash value and cannot be sold, traded or turned into money. If your Box is deleted, your coin record and your orders stay: they keep amounts, kinds and dates as money records, never your name, your words or the address of your Box.

If you get a blueprint: A blueprint comes with a short list of what you will have when it worked. When your own AI follows one and tells your Box how it went, we keep that run: which blueprint and which version, which app ran it (the app your Box is connected to, or the one your AI named), whether your AI said everything on the list came true, and your answer, Yes or No, to “Did it do what it promised?” If you change your answer, we keep your first one beside it. We never keep what your AI did or anything you wrote. Other people see only counts, such as how many people a blueprint worked for, never who. If your Box is deleted, your runs stay in those counts without your name: each stays tied to its order, which we keep as a money record, the way we keep your coin record.

If you publish a first edition: You can publish one of the skills your own AI keeps on your Box as a first edition under your name. When you do, we keep the skill as you published it, each version you publish, its title, and that you said you are 18 or older, with the time. Before it goes, your Box checks it: it won’t publish anything that looks like a key or a password, and it shows you each email, phone number and street address in it and publishes only when you say they’re fine to share. When your own AI follows your edition and tells your Box how it went, we keep that run the way we keep a blueprint’s run (which version, which app, whether your AI said it came true, and your Yes or No), and it never counts toward how many people something worked for. Nobody else sees your editions yet: they stay yours until the shelf opens, and this notice will say what others see before that happens. If your Box is deleted, your editions, their versions and your runs of them are deleted with it.

If you get looks or name your Onibee: Soul Coins also get looks: skins that change your pages’ colors and the stars behind them, colors for your Onibee, things it wears, and borders for its card. We keep which looks your Box has, what each one took in coins, and when you got it. Looks bought with Soul Coins stay yours while your Box exists, and go with it. Your Onibee’s name is shown to you, to your Soul Ties and to the people in your rooms, and so is what it wears. Anyone who sees a name can report it to us: a report keeps who sent it, the name, whose Onibee it is, anything the sender wrote and when, and the crew reads it. Its owner is not told who reported it. If we clear a name that breaks the naming rule in our Terms, its owner can name the Onibee again for free. A report goes when either Box goes. A new report tells the crew, in our team’s private Discord, that one came in, never a name or any words.

Keepsakes: On a day your Onibee reaches a new level, your Box keeps a Keepsake: a dated card of how it looked that day (its level, what it had grown, its color, edge, name and what it wore, its card’s border, your skin, and the shape it had from how you play). Your first one is kept the first time you open Soul after Keepsakes began, of how your Onibee looked that day. Only you see your Keepsakes, on your You page; they are not shown to your Soul Ties, your rooms or an AI you connect. They are in Download my box, and they go when your Box goes. If you turn Sound or Reduce eye candy on or off, your Box keeps those two settings so they follow you to another device; your browser keeps its own copy too.

If you send us a bug report from your Box: We keep what you wrote, which Box sent it, the tab you were on, the time, and your browser’s name and the kind of device it runs on. The crew reads it, and we keep it to fix things. It goes when your Box goes. A new report tells the crew, in our team’s private Discord, that one came in, never your name or your words. When the crew marks your report fixed, your Box tells you once, quoting the start of what you wrote, and keeps the time you tapped Got it.

If something fails on our side while you use your Box: We count it: which Box, which part of Soul it was (its name, like “goal_set”), the day, and the error code, never what you were doing, sending or typing. We use the count to see how often Soul lets someone down and to fix it. Each count goes after 90 days, or when your Box goes.

If you make an account: Accounts are open to anyone 13 or older. The first time you open your Box it asks the year you were born; we keep only whether you are 13 to 17 or older (and when you answered), never the year. If you are under 13, your Box closes and is erased 7 days later, and until then we keep only that you are under 13. When you are 13 to 17, or have not answered yet, our AI writes your cards under stricter rules: only cards from our library and short lessons it writes, no links or videos it found itself, and none of the topics listed at apeironweb.com/soul-safety. Until uploads are checked automatically, only a Box set as 18 or over can upload pictures; if you are 13 to 17, or have not answered yet, your Box takes PDFs, Word documents and plain text. Every card our AI wrote is marked “Written by Soul’s AI”. If you tap Report this card, we keep the card, the time and anything you add, and the card leaves your tree. You make one with a code we email you, with Google, or with Discord. Your Box is made the moment you make your account, free, unless you already have one. With it we keep which way you came in, so we can tell which ways in work: whether an Underword streak, a day of Underword, kept cards or an invite was waiting for you, whether you made it from an AI app’s Allow screen, and whether you tapped through from python-visuals.com (a yes or no, never that visit’s random key). We keep your email address, when you made the account and when you last signed in, and, for each browser where you are signed in, its IP address and what kind of browser and device it is, until you sign out there. Our sign-in pages run Cloudflare’s bot check (Turnstile), which looks at your browser, never at what you type, to tell a person from a bot; Cloudflare’s Turnstile privacy addendum covers what it collects. Google and Discord check for bots on their own side, so those sign-ins skip our bot check. If you connect an AI app such as ChatGPT, Claude, Gemini or Grok to your account, you allow it yourself on our Allow screen, and we keep which app you allowed, what it may do and when; the app’s own sign-in, including the IP address and software it connects with; and, on your Box, a note of each time the app used it. If you hand a card from your Sky to your AI (My AI handles it), the app sees it in its next read of your Box, and we keep with the card when you handed it and, once your AI reports back, what it said it did, which app said it and when; you mark it done yourself. A card an app puts on your Box, or in one of your rooms, carries the app’s name: the name we can prove from the address the app signs people in through, or else the name the app gave itself, marked as its own word. A card left with a key you made carries the name you gave that key. Every app connected to your Box can read those names. What the app does with what it reads is covered by that company’s own terms. If an AI you connected asks to do something in one of your rooms (join it, put a card in it, or vote there), nothing happens in the room until you say yes in your Sky: we keep what it asked for, its exact words, which app asked and when, and your answer, until your Box is deleted, and an ask you never answer closes after 7 days. On your You page you can see what your connected AIs did on your Box in the last 30 days. If you sign in with Google, our sign-in service also keeps what Google sends it: your email address, your name, the address of your Google profile picture and Google’s id for your account. Google’s own privacy policy covers what Google keeps. If you sign in with Discord, our sign-in service also keeps what Discord sends it: your email address, your username, the address of your Discord profile picture and Discord’s id for your account. Discord’s own privacy policy covers what Discord keeps. You can disconnect an app on your page at any time. Your account is not in our weekly backups; our database provider’s own backups keep it for their usual period (see Section 6). Deleting your account, which we do with your Box or on its own when you ask, also removes its sign-ins and every app you allowed.

If you are an Apeiron founder or authorized team member using the Command Center: We collect your email address, chosen password (stored as a salted hash by our authentication provider, never in plaintext), role, display name, task assignments, financial records you create, client and prospect records you create, calendar events, messages you send to other founders, and any notifications generated by your activity. The Command Center is an internal operations tool, and this data is the subject matter of your use of it.

If you are a Python Visuals client using the Client Portal: We display information about your account — your project status, estimates, invoices, photo uploads, and activity history. If you make a payment, we collect your email address and billing name through Stripe Checkout (see Section 5). We do not collect or store your full credit card number or CVV — that information goes directly from your browser to Stripe and never touches our servers.

If you visit one of the client sites we host (blackoutmedia.org, blueprintmedia.club, sydneyssweets.com): The data the site collects — bookings, inquiries, contact form submissions — is collected on behalf of the named client business, not Apeiron. Apeiron's role is to transmit, store, and display that data using the infrastructure described in Section 4. The client business, not Apeiron, determines how that data is used. See Section 9 for more detail on this processor relationship.

3. How We Use Information

We use the information we collect for the following purposes:

  • To provide the services you request. If you ask for a quote, we use your contact information to respond. If you are a client, we use your information to deliver the site, send invoices, and communicate about the work.
  • To operate and improve the Platform. Basic request logs help us debug issues, monitor uptime, detect abuse, and improve performance.
  • To send you transactional communications. Invoice emails, payment receipts, service notices, and responses to your direct inquiries. We do not send marketing email newsletters as of the effective date of this Policy; if that changes, we will update this Section and obtain appropriate consent where required.
  • To comply with legal obligations. Tax records, financial reporting, contractual recordkeeping, and responses to lawful requests from government authorities.
  • To protect our rights and your safety. Detecting fraud, investigating suspected abuse, enforcing our Terms of Service, and protecting against security threats.

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes. We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

4. How We Store and Protect Information

All information described in this Policy is stored using the following infrastructure providers, each of which maintains its own security controls and compliance certifications:

  • Supabase (PostgreSQL database, authentication, file storage): Primary data store for both the Command Center and the Platform client sites. All tables are protected by Row-Level Security (RLS) policies that enforce data isolation at the database level, independent of any application-layer checks. Passwords are stored using Supabase's default bcrypt-style hashing.
  • Cloudflare (DNS, CDN, edge workers, R2 object storage, Pages hosting, Email Routing): All web traffic to the Platform transits Cloudflare's edge network. Client photo uploads and similar binary assets are stored in Cloudflare R2.
  • Resend (transactional email delivery): Outbound invoice emails and service notifications are sent through Resend using SPF, DKIM, and DMARC authentication.
  • Stripe (payment processing): Client invoice payments are processed via Stripe Checkout, a hosted payment page operated by Stripe Payments, Inc. Payment card information never touches Apeiron-operated infrastructure.
  • GitHub (source code hosting): Apeiron's codebase is stored in private repositories on GitHub. The code does not contain personal data about users; it contains the software that runs the Platform.
  • DocuSign (electronic signatures): Executed contracts and signed documents are stored in DocuSign.

All data is transmitted between your browser and our infrastructure over TLS-encrypted connections. Data is also encrypted at rest by each of the infrastructure providers listed above, per their respective standard practices.

Security does not mean invulnerability. No system is perfectly secure. We maintain an internal Incident Response runbook that defines a 72-hour notification clock anchored to the moment a breach is discovered, aligned with the New York SHIELD Act and the 72-hour notification obligation of GDPR Article 33 for affected EU data subjects. If a breach occurs that materially affects your information, we will notify you and any applicable regulators as quickly as practicable, and within the legally required windows.

5. Third-Party Sub-Processors

The infrastructure providers listed in Section 4 are our sub-processors. Each of them may process limited personal information on our behalf to deliver the underlying service. We choose providers that publish their own Data Processing Agreements, support industry-standard authentication and encryption, and maintain SOC 2, ISO 27001, or equivalent certifications where available.

Current sub-processors and their purposes:

  • Supabase (Supabase Inc., USA) — database, authentication, storage.
  • Cloudflare (Cloudflare, Inc., USA) — DNS, CDN, edge compute, R2 storage, email routing, web analytics, and the bot check on our sign-in pages.
  • Resend (Resend Inc., USA) — transactional email delivery.
  • Stripe (Stripe Payments Company / Stripe, Inc., USA) — payment processing; for Soul Coins, Link (Stripe’s checkout) is the seller of record.
  • GitHub (GitHub, Inc., a subsidiary of Microsoft Corporation, USA) — source code hosting. No customer personal data is committed to repositories.
  • DocuSign (DocuSign, Inc., USA) — electronic signature and contract storage.
  • Anthropic (Anthropic, PBC, USA) — Claude AI inference. Used inside our automations, admin help systems, and customer-facing intelligence features to power reasoning steps. Python Visuals is a member of the Anthropic Claude Partner Network. When customer data passes through a Claude reasoning step, Anthropic processes it under their published data terms, which prohibit training on customer-submitted content by default.
  • Google (Gmail and Google Workspace) — email inbox for our human support and forwarded privacy contacts, and sign-in with Google (see Section 2). Subject to Google's own privacy policy.
  • Discord (Discord Inc., USA) — sign-in with Discord (see Section 2), and private team notifications: the contact forms, Box requests and paid orders described in Section 2 are posted to a private channel so a person sees them. For Soul, a post says only that something new came in (a card, an order or a report), never who sent it or what it says.

If we add, change, or remove a sub-processor, we will update this list. Clients who have executed a Data Processing Agreement with us will receive advance notice of any material sub-processor change and a reasonable objection window, consistent with the terms of that Agreement.

6. How Long We Keep Information

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The practical retention periods are:

  • Inquiry and quote records that do not convert into a client relationship: reviewed annually, generally deleted or anonymized after 12 months unless we have reason to expect further contact.
  • Active client records: retained for the duration of the client relationship plus a reasonable archival period (typically 3 years after termination) for dispute resolution, warranty claims, and tax purposes.
  • Financial, invoicing, and tax records: retained for at least 7 years to comply with federal and state tax recordkeeping requirements.
  • Authentication logs, security logs, and Command Center activity history: retained for operational and security auditing purposes, typically 12–24 months.
  • Backups: We keep our own weekly database backups in private storage, the five most recent at a time, so anything deleted is gone from them within five weeks. Infrastructure backups maintained by our sub-processors may also contain deleted data for a period defined by their own retention schedules (typically 7–30 days).

When the retention period ends, we delete or anonymize the information, except where longer retention is required by law.

7. Your Rights

Depending on where you live and which part of the Platform you interact with, you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate or incomplete information.
  • Delete your personal information, subject to legal retention exceptions (see Section 6).
  • Port your information, receiving a copy in a commonly used machine-readable format.
  • Object to or restrict certain processing activities.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with a supervisory authority in your jurisdiction.

New York residents have the protections of the New York SHIELD Act, including breach notification and reasonable security safeguards, which we observe.

California residents (CCPA/CPRA) have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by California law.

Residents of the European Economic Area, United Kingdom, and Switzerland have the rights granted by the GDPR and the UK GDPR. Our legal bases for processing are typically (i) your consent, (ii) the necessity of processing for a contract with you, (iii) our legitimate interests in operating and securing the Platform, and (iv) compliance with legal obligations. If you are contacting us from one of these regions and wish to exercise your rights, please note that Apeiron is a US-based operator and your data may be processed in the United States.

To exercise any of these rights, email [email protected] with your request and enough information for us to identify the records you are asking about. We will respond within 30 days (or the shorter period required by your jurisdiction).

8. Cookies and Similar Technologies

The Platform uses the smallest practical set of cookies and browser storage. We do not use advertising, profiling, or cross-site tracking cookies anywhere on the Platform.

For a full, detailed breakdown of every cookie, localStorage key, and sessionStorage key used, which part of the Platform uses it, what it does, and how long it persists, see our Cookies Notice.

9. Client Sites and Our Processor Role

When you visit a website we have built and host on behalf of one of our clients — for example, blackoutmedia.org, blueprintmedia.club, or sydneyssweets.com — the information that site collects from you (bookings, contact forms, inquiries) is collected by the named client business as the data controller. Apeiron's role, and the role of our infrastructure providers, is to act as a data processor on that client's behalf — transmitting, storing, and displaying the information as instructed.

Practically, this means:

  • The client site's own published privacy policy (if any) governs how your information is used.
  • If you want to exercise data subject rights against a client site's data, contact that business directly. They will, in turn, contact us as their processor if they need us to retrieve, export, or delete data from the underlying database.
  • Apeiron will not use client-collected data for our own purposes. We will not merge it with our own customer records. We will not market to the client's customers under the Apeiron brand.
  • Where required, Apeiron executes a Data Processing Agreement with the client defining the scope, duration, and security measures of the processor relationship.

If you are unsure whether a site is a Platform client site and want to know which entity is the controller of your data, email [email protected] and we will identify the controller and route your request to them.

10. International Data Transfers

Apeiron operates from the United States. Our infrastructure sub-processors (Supabase, Cloudflare, Stripe, Resend, and others) may store, process, or transit data through data centers in the United States, the European Union, and other regions depending on where their edge infrastructure is located and where you are accessing the service from.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal information may be transferred to and processed in the United States. Where such transfers occur, we rely on legally recognized transfer mechanisms — typically the Standard Contractual Clauses published by the European Commission — as implemented by our sub-processors' own data processing terms.

11. Children

The Platform is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, please email [email protected] and we will delete the information promptly in accordance with the U.S. Children's Online Privacy Protection Act (COPPA).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, infrastructure, or legal obligations. When we make a material change, we will update the effective date at the top of this page and, where practical, post a notice on apeironweb.com or send a notice to registered users. The current version is always available at python-visuals.com/legal/privacy.

13. Contact

If you have any questions about this Privacy Policy or how we handle your information, please contact us:

Apeiron — Privacy Contact
Email: [email protected]
Postal: Long Island, New York, United States

We are committed to resolving any concern you have about your privacy directly and in good faith before any formal complaint is necessary.