Privacy
What Weightship (Reval Labs) collects, why, who else handles it, and how to get it or have it deleted.
What we keep
- Your account: email, handle, a scrypt hash of your password, and when you confirmed your email.
- What you create: models, adapter files, datasets you upload, projects, benchmarks and their results.
- Usage records for billing: which model, when, token counts, cost. We don't store prompts or completions sent through the API.
- Payment references from Stripe (customer and connected-account IDs). Card details never reach our servers.
- Provider keys you add for benchmarks (OpenAI, Anthropic, OpenRouter), encrypted with AES-256-GCM, used only to run the benchmarks you start.
- Short-lived records of sign-in and sign-up attempts by IP address, to stop abuse; they're deleted after an hour.
Who else handles it
| Service | What for | Where |
|---|---|---|
| Fly.io | Hosting for the website, API and database | Amsterdam, Netherlands |
| Tigris (via Fly.io) | Storage for adapters and datasets | EU and US edge locations |
| Stripe | Card payments and creator payouts | EU and US |
| Resend | Account emails (confirmation, password reset) | US |
| GPU providers (RunPod, Modal) | Running models; prompts pass through for the length of a request | EU and US |
When you import from Hugging Face, the request goes to Hugging Face with the read token you give us for that one download; we don't keep the token.
Your rights
- Download everything we hold about you from Settings → Your data.
- Delete your account from Settings. Personal data goes immediately; payment and payout records stay without your name for as long as bookkeeping law requires (seven years in Estonia).
- For anything else, including corrections and objections, email privacy@weightship.com. You can also complain to the Estonian Data Protection Inspectorate (aki.ee).
Cookies
One cookie, to keep you signed in. No analytics or advertising cookies.
Usage statistics
We count page views and a few product steps (signing up, adding credit, training, publishing, and clicks on the homepage demos) in our own database, without cookies. To tell visitors apart within a day we store a hash of your address, browser and the date, mixed with a secret, so it can't be turned back into your address and changes every day. Signed-in events are tied to your account. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.