Primitive accountPRIVACY
EFFECTIVE DATE:

Primitive Account Privacy Policy

This policy covers your Primitive account: the one account that signs you in to Primitive Pass and Primitive Pages.

IN SHORT

SECTION 02Your password stays with youSign-in uses OPAQUE, so the server never learns your password. SECTION 03Pages gets a sign-in, not your passwordPages receives your account ID, email and plan limits, and checks back on every request. SECTION 04No selling, no adsWe do not sell personal information or use it for advertising. SECTION 05Pass and Pages stay separateOne account, but your vault and your files are never combined or shared between them. SECTION 09You choose what to deleteDelete your Pages data, your Pass vault or your whole account from your account page. SECTION 08Short-lived by designCodes last 10 minutes, sessions up to 30 days, logs 30 days, backups normally 35 to 36 days.

01Who we are

Your Primitive account (at accounts.primitiveai.com.au) is provided by PRIMITIVE AI LABS PTY LIMITED, trading as Primitive AI.

  • ABN: 86 701 195 708
  • ACN: 701 195 708
  • Registered address: Unit 15, 42 Terrace Road, East Perth WA 6004, Australia
  • Contact: hello@primitiveai.com.au

This policy covers the Primitive account: signing up, signing in, two-step sign-in, your account page, deleting your data, and the sign-in that Primitive Pages uses. What happens inside each app is covered by that app’s own policy: the Primitive Pass Privacy Policy for your encrypted vault, and the Primitive Pages Privacy Policy for your files.

02Our privacy approach

One Primitive account signs you in to Primitive Pass and Primitive Pages, but your data, permissions and deletion choices stay separate for each product. We say what the account service stores, why, and who else handles it. We do not promise absolute security, and we do not claim an independent audit.

Your password never leaves your device in a form the server can use or read: sign-in uses OPAQUE, a password protocol in which the server stores a registration record rather than your password or a hash of it.

03Information we collect and hold

Account information

  • your email address;
  • an account ID (it begins acct-; your account page shows it so support can find your account);
  • OPAQUE registration records for your password and, if you set up a Pass vault, your Recovery Key;
  • account and credential timestamps; and
  • which apps you have set up (Pass and Pages) and their state, including a Pages generation number that changes if you delete and set up Pages again.

Signing up and signing in

  • a 6-digit email code, stored salted and hashed, which expires after 10 minutes;
  • short-lived sign-up and sign-in state needed to finish those steps;
  • if you turn on two-step sign-in: your authenticator secret, stored encrypted, and salted hashes and usage state for your recovery codes; and
  • the IP address of sign-up and sign-in attempts, to limit repeated attempts.

Sessions

When you sign in, the server keeps a hashed session token and your browser keeps a session cookie (see section 10). The server never stores the session token itself.

Signing in to Primitive Pages

When you open Pages, the account service gives Pages a sign-in for your account only. Pages checks it with the account service on every request. With each check, Pages receives your account ID, your email address (to show who is signed in), your Pages generation number, your plan’s limits and when the sign-in expires. Pages never receives your password, your Recovery Key or anything from your Pass vault.

Plans and billing

Paid plans are not offered yet. When they are, we will keep the information needed to link a plan to your account: the plan, its status, the billing interval, the end of the current period, and the payment provider’s customer and subscription references. Card and payment details are handled by Stripe (or, for purchases inside our mobile apps if offered later, by Apple or Google), not stored by us.

Companies

If you create or join a company on your Primitive account, we keep:

  • the company name and a random company ID;
  • who is in it: each member's account ID, role (owner, admin or member), when they joined and a membership generation number that changes when their role or membership changes;
  • invitations: the invited email address, the role offered, who sent it, and when it was sent, accepted, cancelled or expired. We store only a hash of the invitation link, never the link itself; and
  • a company activity record (for example, created, renamed, someone invited, joined, removed or left). It holds account IDs and invitation IDs, not email addresses or names.

Who sees your email address in a company: the owners and admins of that company can see each member's email address, role and account ID, and its pending invitations. Ordinary members can't see each other's email addresses, and nobody outside the company can. A company can't see or open anyone's personal Pass vault. If you join a company with a work email address, its owners and admins will see that address.

When you sign in to an app that uses companies, that app is told which of your companies you are in and your role in each, so it can show you the right shared work.

Deletion records

When you delete Pages data, your Pass vault or your whole account, we keep a record that the deletion happened, so we can show it was done: what was deleted, when, the confirmation each app returned, and a SHA-256 hash of your account ID. While the deletion is running the record holds the account ID itself (a random identifier, not your email); once it has finished, only the hash is kept. After a whole-account deletion we also keep a SHA-256 hash of the former account ID and the time of deletion. These records do not include your email address, your files or your vault. We keep these deletion records for 12 months after the deletion, so that deleted sessions and codes can’t be reused and so we can show that the deletion happened, and then delete them. We keep them longer only if we need to meet a legal obligation or resolve a dispute.

Technical information

The web server and account service handle requests from your browser, including your IP address, request times and the pages requested, and record service errors and security events. We do not use this information for advertising.

04Why we use information

We use information only for purposes connected to running and protecting the Primitive account, including to:

  • create and run your account and verify your email address;
  • sign you in, keep you signed in, and sign you in to the apps you set up;
  • provide two-step sign-in when you turn it on;
  • carry out deletions you ask for and confirm they finished;
  • apply your plan’s limits in Pages, and run paid plans when they are offered;
  • prevent abuse, fraud and unauthorised access, including by limiting repeated attempts;
  • investigate incidents and provide support; and
  • meet legal, accounting and regulatory obligations.

We do not sell personal information, and we do not use account information for advertising.

05Keeping Pass and Pages separate

Using one account for both products does not combine the information each one holds, or make it available to the other.

  • Primitive Pass: your vault is encrypted on your device before it is uploaded. We do not hold the keys needed to decrypt a locked vault. Pages and the account service never receive your vault contents or its keys.
  • Primitive Pages: your files are held in Pages. Pages is not end-to-end encrypted: its server processes readable content to provide storage, editing, version history and the features you ask for.

We do not send your Pass vault to Pages, or your Pages files to Pass, because both use the same account. The account service shares with each product only what sign-in and access need (section 3). Optional AI features, sharing and connected apps are explained in each product’s own policy.

06Your password and Recovery Key

Your password is checked with OPAQUE, so the server never learns it. This also means we cannot look up or reset your password for you.

Reset by email is not available yet. If you use Primitive Pass, you can get back in with your Recovery Key in Pass and then set a new password. Getting back into your account does not by itself recover an encrypted Pass vault: that depends on your Recovery Key and the recovery process Pass supports; see the Primitive Pass Privacy Policy.

07Service providers and overseas processing

We use service providers to run the Primitive account. Each receives only the information its job needs.

  • Hetzner: hosting for our own server, in Singapore.
  • Resend: delivery of sign-up and sign-in emails, in the United States and through its approved subprocessors, under Resend’s standard Data Processing Addendum.
  • Stripe: not active yet. Stripe will be our payment processor only once paid plans launch; it processes payments in the United States and other countries where it operates.
  • Apple and Google: purchases made inside our mobile apps, if we offer them later, under their own terms.

Our production server runs on our own self-hosted deployment on Hetzner. We do not use Coolify Cloud. Some providers process or store information outside Australia; where applicable, we take reasonable steps required by law when using overseas providers.

08Retention

We keep account information only as long as it is reasonably needed, subject to security, legal and operational requirements.

  • Email codes: 10 minutes.
  • Unfinished sign-up: 15 minutes.
  • Sign-in state between steps: 2 minutes.
  • Sessions: up to 30 days, unless you sign out or the session is revoked sooner.
  • Rate-limit records: deleted no later than 24 hours after their window ends.
  • Production logs: 30 days.
  • Backups: we make an encrypted backup once a day and normally delete each one 35 to 36 days after it is made. Deletion runs only after a newer backup has been saved and checked, so if backups fail, older ones are kept until a backup succeeds again. Deleted information may remain in a backup until that backup is deleted.
  • Company invitations: the invited email address is deleted 30 days after the invitation is accepted, cancelled or expires (invitations expire after 7 days).
  • Company membership and activity records: kept while the company exists. When you leave or are removed, your membership is marked as ended but keeps your account ID, role history and dates, so the company's record stays accurate.

Some information may need to be kept longer if the law requires it or for a legal claim.

09Deleting your information

On your account page, choose Delete options. You can delete your Pages data, your Pass vault, or your whole account. Each one asks for your password (and your two-step code, if it is on) before anything is deleted, and shows you its progress until it finishes.

  • Pages data: Pages erases your files, versions, Trash, forms and their responses, connected-app access, and the activity logs Pages keeps about your account (the Connected apps audit log and the form share-link log), and confirms when it has.
  • Pass vault: your encrypted vault and its sync history are deleted; see the Primitive Pass Privacy Policy.
  • Companies: if you are the only owner of a company that still has other members, make someone else an owner first. Deleting your account then ends all your company memberships, cancels invitations you sent, and deletes any company where you were the only member. The company activity record keeps your account ID, but never your email address.
  • Whole account: everything above, then your email address, sign-in records, sessions and two-step settings. We keep only the deletion records described in section 3: what was deleted, when, the apps’ confirmations and a hash of the account ID.

Before deleting, export anything you want to keep using the product’s own export features. Copies in system backups are removed as those backups are deleted, normally 35 to 36 days after each backup is made (see section 8). Some records may be kept longer where the law requires, such as accounting records. If you cannot use Delete options, email hello@primitiveai.com.au and we will help. We may need to verify your identity first.

10Cookies and local storage

The account site uses:

  • a session cookie (__Host-primitive_account): it keeps you signed in. It is secure, HttpOnly, limited to accounts.primitiveai.com.au, and lasts up to 30 days;
  • a theme setting in your browser’s local storage (acct:theme), if you choose light or dark; and
  • the email you typed on Sign in, kept in this browser tab’s session storage (acct:email) so Reset your password can fill it in. It is never put in the address bar, and it goes when you close the tab.

We do not use analytics or advertising cookies.

11Access, correction, questions and complaints

Email hello@primitiveai.com.au to ask what personal information we hold about you, to ask us to correct it, to raise a privacy concern, or for help with deletion. We may need to verify your identity before we disclose or change anything. We will consider your request under applicable privacy law.

Questions and complaints

If you have a question or concern about how we handle your personal information, or you think we have breached the Australian Privacy Principles, please email our privacy contact at hello@primitiveai.com.au with the subject “Privacy complaint”. Tell us what happened and how you would like it resolved. We don’t need your password and will never ask for it.

We will acknowledge your complaint within 7 days, investigate it, and aim to give you a written response within 30 days. If we need more time, we will tell you why and when to expect a response.

If you are not satisfied with our response, or we haven’t responded within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC). The OAIC accepts privacy complaints in writing:

For general enquiries you can phone the OAIC on 1300 363 992 (+61 2 9942 4099 from outside Australia).

12Security

The account service uses technical and organisational controls intended to reduce unauthorised access, disclosure, change and loss. These include OPAQUE sign-in, optional two-step sign-in, hashed session tokens and codes, host-only secure cookies, protection against cross-site requests, rate limiting, and fail-closed checks. No internet service can promise absolute security.

13Data breaches and incidents

We maintain a cyber security incident and data breach response process. If an incident affects personal information, we will assess it and take the notification and remediation steps required by law and the circumstances.

14Children

The Primitive account is for adults. You must be 18 or older to create one, and sign-up asks you to confirm this.

15Australia and other jurisdictions

Primitive AI is an Australian company and uses the Australian Privacy Principles as its privacy benchmark. The Primitive account is initially offered for Australia. We will address other privacy requirements before deliberately offering it in other markets.

16Changes to this policy

We may update this policy when the account service, our providers, our data practices or the law change. If a change materially affects how we handle personal information, we will update the effective date and give notice where appropriate.

17Contact

Privacy questions or requests:

PRIMITIVE AI LABS PTY LIMITED
Trading as Primitive AI
ABN 86 701 195 708
ACN 701 195 708
Unit 15, 42 Terrace Road
East Perth WA 6004
Australia
hello@primitiveai.com.au