Privacy

510 lab (Nestekant Desserprit, org. no. 830 567 682), Troms, Norway runs Peer and is responsible for the personal data described here. Questions and requests go to hello@510.at.

The files your agent sends are read in memory by the model and dropped once the answer is sent. They are never written to disk, to a log, to our database or to a training set.

So that checking an unchanged file again is fast and free, we keep a fingerprint of each file (a one-way hash of its path and contents, from which the code cannot be rebuilt) together with its answer: the file’s path, the rules found, their scores and line numbers. Never the code. These entries are removed after a while without use.

• Waitlist. Your email, and if you tell us, what you would use Peer for and the plan you looked at. We use it to invite you and to understand who Peer is for. Older requests may also hold the job title and company given at the time.
• Account. Your email, your name and the id of your sign-in, to sign you in and to write to you about your account and payments.
• API keys. Each key’s name, its first characters and a fingerprint of it, never the key itself, with when it was made, when it expires and when it was last used.
• Credit and usage. Every top-up and refund (amount and Polar order number), and for every review its input tokens, number of files, the model that answered and the time. That is how we charge you and show your usage. It holds no code and no file names.
• Reviews. For every review: the key that asked and through what (the MCP tool, init or the API), how many files it read and how many came from the cache, its input tokens, the model and how long it took, the ids of the rules it found broken and on how many files, the rule ids your PEER.md skips and keeps, and the earlier review it re-checks when your agent names one. Never your code, file names or PEER.md’s text. We use it to see which rules hold up and to improve Peer.
• When something breaks. If a review or a payment fails, we log the error with your account id and the token count, never the code.

We do not sell your data, show ads or use it for marketing. We email you only about Peer: your invitation, your account and your payments.

In the terms of the GDPR, we rely on our contract with you for your account, reviews and payments; on your request when you join the waitlist; and on our legitimate interest in keeping Peer secure and working.

Peer sets two cookies, both needed to sign in, and nothing that tracks you:

• peer_session keeps you signed in, encrypted, for up to 30 days.
• peer_oauth_state protects the sign-in itself, for 10 minutes.

The sign-in page and Polar’s checkout are run by WorkOS and Polar, which set their own.

These companies process data for us, each only for its part:

• Cloudflare serves the website and the API.
• Modal runs the model on its GPUs, in the United States. Your code passes through it in memory.
• PlanetScale hosts our database: accounts, keys, credit and usage.
• WorkOS handles sign-in.
• Sentry receives error reports and page and request timings from the website and the API, in the EU: the address, the error and your browser, never your code, cookies or keys.
• Polar sells you credit as merchant of record. It collects your payment details, billing address and tax information under its own privacy policy, and tells us what was paid.

Some of them process data outside your country, including in the United States. Where the law requires it, the transfer is covered by safeguards such as the EU’s standard contractual clauses.

• Waitlist entries: until you are invited, or until you ask us to remove yours.
• Account, keys, credit and usage: while your account is open. Closing it deletes them.
• Review records: kept to improve Peer. Closing your account removes your account id from them.
• Invoices and payment records: kept by Polar for as long as tax law requires.

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it for something. Write to hello@510.at. If you think we handle your data wrongly, you can also complain to your data protection authority.

Everything travels encrypted. Keys are stored only as fingerprints, so a copy of our database would not reveal them, and your sign-in cookie is encrypted. Only the people who run Peer can reach the data, and only to run it.

Peer is a tool for developers and not meant for anyone under 16.

If we change how we handle your data, we will update this page and its date, and tell you about changes that matter. The terms cover the rest of how Peer works.