1. The short version
If you only read one section: we run no analytics and no trackers. There is no Google Analytics, no advertising pixel, no session recorder, no fingerprinting. There is exactly one cookie and it exists to keep you signed in.
The only piece of plainly-readable personal information we store is your email address, and only if you create an account. Everything else that identifies you — session tokens, API keys, the IP behind a public contribution — is stored as a one-way hash, so a copy of our database does not hand someone your credentials or your address.
2. What we collect
This is the complete list. Each row is a real table in the application database.
| Where | What | Why |
|---|---|---|
| accounts | Your email address, account status, and the dates it was created and changed. The only plaintext personal identifier we hold. | To sign you in and to attach your API keys to you. |
| login_tokens | A hash of the one-time sign-in link, its expiry, and whether it has been used. Never the link itself. | Passwordless sign-in. A magic link is the default way in, and always works — which is why there is no password-reset flow to lose. |
| accounts.password_hash | Only if you choose to set a password: a slow one-way hash of it (PBKDF2-HMAC-SHA256, 600,000 iterations, unique random salt per account) — never the password, and not something the hash can be turned back into. Optional; blank unless you set one, and you can remove it at any time. | To let you sign in without waiting for an email. |
| sessions | A hash of your session cookie, and its expiry. | To keep you signed in for 30 days. |
| api_keys | A hash of each key, plus its short visible prefix, the name you gave it, its plan, and the created / last-used / revoked dates. | To authenticate API calls and let you recognise and revoke your own keys. We cannot show you a key again after you create it, because we do not have it. |
| api_usage | Per request: which key, the timestamp, the path, the response status, rows returned and milliseconds taken. No IP address and no user agent. | Rate limiting, plan enforcement, and knowing which endpoints matter. |
| watches | The filters you set and, if you supply one, your webhook URL. | To deliver the change feed you asked for. |
| contributions | What you typed, the source URL you cited, and a keyed hash of your IP address — HMAC-SHA-256 under a secret unique to this deployment, truncated. Not a plain hash: an IPv4 address has only about four billion possible values, so a plain SHA-256 of one can be reversed on a laptop. That would be storing your address while claiming otherwise. | Abuse prevention and de-duplication on a form that is open without an account. The secret is stripped from every published copy of the database. |
Our hosting provider and CDN keep their own short-lived server and security logs, which include IP addresses. Those are theirs, described in section 5.
3. What we don't collect
- No analytics or product telemetry. No Google Analytics, Plausible, PostHog, Segment, Hotjar or equivalent.
- No advertising or social pixels, and we run no advertising.
- No password unless you ask for one. Sign-in is by emailed link by default. If you set a password we store a slow one-way hash of it, never the password itself, and you can remove it at any time — the emailed link keeps working either way.
- No payment card details. Paid plans are arranged and invoiced directly; card data never touches our servers.
- No IP addresses or user agents in our request logs.
- No selling or sharing of personal information, and no data brokers. We do not sell your data; we sell access to a dataset about infrastructure.
4. Cookies
One cookie, set only after you sign in. It holds a random session identifier — not your email, not your name. It is HttpOnly (JavaScript on the page cannot read it), Secure (sent over HTTPS only), and SameSite=Lax (not sent from other sites' requests). It expires after 30 days, and signing out deletes it.
We set no other cookies. Because we run no tracking, there is no consent banner to click through — there is nothing to consent to.
5. Who else sees it
Four third parties are involved in serving this site. Two of them see your IP address simply because your browser connects to them, which is worth stating plainly rather than burying.
| Who | What they get | Why |
|---|---|---|
| Render | Everything you send us — they run the servers — plus their own request logs including IP. | Application hosting. |
| Cloudflare | Your IP address, request metadata and TLS connection; they sit in front of our servers. | DNS, caching and denial-of-service protection. |
| Resend | Your email address and the sign-in link, when one is sent. | Delivering sign-in emails. |
| Google Fonts | Your IP address, on every page, because the typeface files load from fonts.googleapis.com and fonts.gstatic.com. | Typography. |
| OpenFreeMap | Your IP address, and the map tiles you request from tiles.openfreemap.org — which implies the area you are looking at. Only on the fleet map at /energy/map. | Base map tiles. |
Most sites don't. But loading a file from another company's server discloses your address to that company as surely as a tracker does, and we hold ourselves to saying so. The map libraries themselves are served from our own domain, not a CDN, precisely to keep that list short.
6. People in the dataset
Our product is a record of energy infrastructure: projects, tenders, and the organisations behind them. That dataset is about companies, not individuals, and that is a deliberate policy rather than an accident of collection.
We do not collect or publish names, job titles, direct phone numbers or personal email addresses of the people who work at those companies. Where a page looks like it is missing a contact, it is missing it on purpose, and the page says so.
If you believe personal information about you has nonetheless ended up in the dataset — for example because a public source we cite names you — write to us and we will remove it.
7. How long we keep it
- Sign-in links — minutes. They expire, and are marked used the moment they are followed.
- Sessions — 30 days, or until you sign out.
- Account and API keys — until you close your account. Revoked keys keep their hash so an old key cannot be silently reactivated.
- Usage records — retained to operate rate limits and understand load. They contain no IP address.
- Contributions — kept as part of the editorial record, because a correction to a public dataset has to remain auditable. The hashed IP is not reversible by us.
8. Your rights
You can ask us to show you the personal data we hold about you, correct it, delete it, or send you a copy. Because the list in section 2 is short, so is that process — write to hello@ai-root.com and we will act within 30 days.
Deleting your account removes your email address, your sessions and your keys.
Depending on where you live you may have additional rights — under the Australian Privacy Act, the GDPR if you are in the UK or EEA, or your local equivalent — including the right to complain to a regulator. Where the GDPR applies, our lawful basis is contract for running your account and API access, and legitimate interests for security, abuse prevention and keeping the service up.
We are an Australian company, but the servers are not in Australia. The application and its database run in Singapore, and Cloudflare serves cached pages from edge locations worldwide, including Sydney. So your data is processed outside Australia — and outside your own country, wherever you are. We rely on our providers' standard contractual protections for those transfers.
9. Security
Everything is served over HTTPS. Credentials are stored as hashes, never in a form we could read back. Webhook destinations you register are checked, at creation and again at send time, to stop the change feed being used to reach private network addresses. Published copies of our database have the contribution hashing secret removed before they leave our machine.
No system is perfect. If you find a vulnerability, please tell us at hello@ai-root.com before disclosing it publicly, and we will work with you.
10. Changes to this page
If we change what we collect, we will change this page and move the date at the top. If a change is material — a new category of data, or a new third party who sees your information — we will email account holders rather than rely on you noticing.
11. Contact
Privacy questions, access requests and complaints: hello@ai-root.com.
The operator of this service is BPAA Australia Pty Ltd, Sydney, New South Wales, Australia.
This page describes the software accurately — the tables, the hashing and the third parties were read off the code, not drafted from a template. It is still not legal advice, and a lawyer should read it before you rely on it.