🛡️
TenantGuard Privacy Guarantee: ColtaneDB is engineered with provable multi-tenant isolation. Your queries, schema definitions, and credentials never cross tenant boundaries, and execution plans are cryptographically bound to your workspace.
1. Overview & Scope
This Privacy Policy explains how ColtaneDB ("we", "our", or "the Platform"), created by Ayush Bhattacharya, collects, uses, and safeguards information when you visit coltanedb.vercel.app, use the ColtaneDB Web Studio, interact with our REST API, or integrate with our client libraries.
ColtaneDB operates as an open-source, web-first multi-model database engine, compiler, and query router. We respect your developer sovereignty and prioritize data minimization at every layer of our stack.
2. Information We Collect
A. Authentication & Profile Data
When you sign up or log in via Firebase Authentication, we receive:
- Email Address: Used strictly for account identification, session continuity, and security alerts.
- OAuth Identifiers: When signing in with Google, we receive your Google User ID (UID), verified email, and profile avatar URL. We do not access contacts or Google Drive contents.
- Alpha Invite Tokens: If you join via an invitation code (e.g.
COLTANE-ALPHA-2026), we record token redemption to provision your isolated tenant workspace.
B. Tenant Data & Query Workloads
- Tenant Identifiers: Randomly generated cryptographic IDs (e.g.
tnt_xxxx) used to bind your storage tables, document collections, and vector indices.
- API Tokens: Cryptographically generated API keys (e.g.
clt_live_xxxx) used to authenticate programmatic query requests.
- Colt Query Code:
.colt language statements submitted to the web editor or REST endpoints (/api/v1/query) to compile ASTs, execution plans, and query results.
C. Essential Local Storage & Cookies
We do not use invasive marketing trackers or third-party ad networks. We utilize browser localStorage solely for essential platform operations:
coltane_tenant_v1: Preserves your active tenant identifier and API key across browser refreshes.coltane_theme: Remembers your dark / obsidian interface preference.coltane_cookies_decided & coltane_cookies_accepted: Stores your cookie consent selection.
Lawyer Review Note: Review and verify whether regional cookie consent regulations (e.g. ePrivacy Directive in the EU) require affirmative opt-in for telemetry tracking before recording anonymized compiler latencies.
3. How We Process & Route Your Data
ColtaneDB is a compiler and intelligent query router, directing execution to the appropriate underlying storage adapters:
- Multi-Model Execution: Your queries are parsed into typed ASTs and checked for semantic correctness before routing.
- TenantGuard Protection: Queries are executed through TenantGuard adapters to guarantee zero cross-tenant data leakage.
- Anonymous Compilation Telemetry: If accepted in the cookie banner, we aggregate anonymous compilation timings (e.g. lexer latency, JIT cache hit rates) to benchmark our compiler.
4. Third-Party Subprocessors & Infrastructure
ColtaneDB partners with enterprise cloud infrastructure providers to deliver high availability and sub-millisecond execution:
- Vercel (USA / Global Edge): Hosts our serverless runtime, static assets, and edge query distribution.
- Google Firebase (Google Cloud Platform): Provides OAuth authentication tokens and project security rules under project
coltanedb.
- Upstash Redis: Powers our high-speed, sub-millisecond key-value caching layer and rate-limiting tier.
- Supabase / Neon (AWS / GCP): Powers relational table backing stores and ACID transactions.
Lawyer Review Note: Execute formal Data Processing Agreements (DPAs) and verify Standard Contractual Clauses (SCCs) for cross-border data transfers between EU and US cloud availability zones.
5. Data Retention, Portability & Deletion Rights
Under regulations such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act), you retain full sovereignty over your data:
- Right to Erasure: You can purge your tenant database, delete stored collections, or revoke API keys at any time via the Studio or by emailing our data officer.
- Right to Portability: Export your complete schema, table rows, and queries in
.colt or JSON format directly from the Table Explorer.
- Account Deletion: Deleting your account will immediately sever all Firebase OAuth links and purge assigned tenant metadata within 30 days.
6. Security Measures
We implement defense-in-depth security to protect your assets:
- Strict TLS 1.3 encryption across all client-to-server and server-to-subprocessor connections.
- Cryptographic hashing of credentials and API keys.
- Continuous fuzz-testing of parser and execution runtimes to prevent injection attacks and memory leaks.
7. Contact & Maintainer Information
If you have any questions about this Privacy Policy, wish to exercise your data rights, or need security disclosures, contact the platform creator:
Creator: Ayush Bhattacharya
Platform: ColtaneDB