Privacy Policy

Last updated: September 29, 2026

This policy explains, in plain language, what data Revoa collects, why, how long it is kept and how you control all of it. It applies to the website revoa.org and to the installable app (PWA).

What we collect

Data	When	Why
E-mail and password	when you create an account	to identify your account. The password is stored only as a scrypt hash — not even we know what it is
IP address	on every visit	to count the day's anonymous questions (a fair quota for everyone) and to prevent abuse, such as mass account creation
Question text	when you ask the specialist	to generate your page of ideas. The question is sent to the language model provider (currently z.ai) solely to generate the answer
Question history	when you ask	to power your "ask again" list (the history, in the app). With an account it persists; anonymous, it expires with the session
Session cookie (`revoa_sess`)	every visit	to keep you signed in and count your quota. It is strictly necessary — without it the site doesn't know who you are
Usage statistics (Umami)	every visit	to learn which pages matter and where visits come from, in aggregate numbers. It is a cookie-free analyzer running on our own server; it records the page, the referring site and the browser — no name, no e-mail, no behavior profile

What we do NOT collect

Zero third-party trackers: no Google Analytics, no ad pixels and no fingerprinting following your browsing. The only usage analyzer is Umami, installed on our own server — no cookies, and it doesn't identify you.
Zero advertising and zero data selling — to anyone, ever.
We don't ask for your name, phone number, address, national ID or birthday.

Generated pages are public

When you ask a question, Revoa creates a page of ideas that becomes part of the collective knowledge — visible in the public catalog so that someone else with the same material on hand can benefit from the answer. These pages contain no personal data: your e-mail, IP and session never enter them. If you want one of your pages taken down, write to the contact below.

Where the data lives

Everything (accounts, history, statistics and the knowledge graph) lives on our own server, in a database only Revoa accesses — the usage statistics stay in Umami, also installed on it.
Brevo (the e-mail delivery service) receives the minimum needed to deliver the signup verification message: your address and the link. Nothing more.
The language model provider receives the question text to generate the answer. We send no e-mail, IP or any other data along with it.

How long we keep it

Data	Retention
Account (e-mail + hash)	until you delete the account
History with an account	until you delete the account
Anonymous session and history	expire on their own (up to 90 days)
Quota counters	1 day (renewed at midnight)
Verification and reset tokens	24 hours
Usage statistics (Umami)	as long as Revoa exists — they're numbers, not people

Your rights (LGPD)

Brazil's General Data Protection Law guarantees you, at any time:

To know what data we hold (this page is that duty fulfilled);
To access and correct your data;
To delete your account and history — by yourself, on the "Delete my account" button inside My account (immediate effect, no need to talk to anyone);
A copy of your data or to revoke its use, by writing to the contact below.

Data protection officer contact (the person responsible for the data): [email protected] — we answer within 15 days.

Revoa is an individual's project classified as a small-scale agent (ANPD Resolution CD nº 2/2022), which reduces formalities — never transparency.

Security

Passwords hashed with scrypt (modern parameters), sessions on opaque tokens, automatic usage limits per IP and session. No system is perfect, but we keep the minimum possible: what doesn't exist can't leak.