Privacy policy
What WOW21, Inc. collects when you use Compute, who sees it, and how to ask us for a copy or a deletion.
Who we are
WOW21, Inc. operates Compute at https://compute.cx. Compute lets you sign in, buy prepaid GPU credits, and run Python workloads on short-lived cloud machines.
This policy describes the personal data we collect when you use the website, dashboard, API, and CLI. It is effective August 17, 2026.
Account and sign-in
You sign in with Google or GitHub through Clerk. Clerk sends us your account id, email address, and display name. We store those on a Compute user record (an opaque usr_… id). We do not link a new Clerk sign-in to an older Compute account by email.
To keep you signed in we set a compute_session cookie on compute.cx and Clerk sets its own authentication cookies on clerk.compute.cx / accounts.compute.cx. CLI setup uses a short-lived device code in the browser; the CLI then stores a session token in ~/.compute/config.toml on your machine.
If you create API keys, we store a name, a public prefix, and a hash of the secret. We cannot read the secret again after it is shown once. You can revoke keys from the dashboard.
Billing
Prepaid credits are sold through Stripe Checkout under WOW21, Inc. Stripe handles the card. We do not store full card numbers. We keep the Checkout amount, Stripe references we need to reconcile a payment, and an append-only credit ledger (top-ups, usage debits, and any manual adjustments).
The dashboard shows your balance and usage. Receipts include provider minutes, the locked hourly rate, and the platform fee.
Workloads, secrets, and logs
When you start a run we process the packaged source, arguments, environment secrets you attach, logs, and results so we can execute the job and return output. That material is stored in Cloudflare R2 and sent to the GPU provider that runs the machine (today RunPod or Hot Aisle).
User secrets are encrypted at rest and unsealed only to inject them into a job. We scrub exact secret values from our logs. Staff do not read your payload, source, or results unless you ask us to for support.
Product analytics
We use PostHog Cloud in the United States, ingested through e.compute.cx, to understand whether the product is working: marketing page views, install-script downloads, sign-up, checkout, and run lifecycle.
Browser page views are cookieless. They use a random id in sessionStorage for that tab, a sanitized route template such as /runs/:id, and an anonymous auth state. We do not send IP addresses to PostHog. Session replay, autocapture, heatmaps, and geolocation are off.
Signed-in product events use your opaque Compute user id. CLI events use an HMAC of a local install id, not your email. Amounts are sent as coarse bands (for example a $10–$24 top-up), never exact dollars. We do not send source, arguments, secrets, logs, emails, display names, tokens, file paths, or provider VM ids.
The CLI honors a full opt-out: set COMPUTE_NO_TELEMETRY=1 or telemetry_enabled = false in ~/.compute/config.toml. The CLI then sends no product events. Checkout, runs, and billing still work.
Cookies and similar storage
compute_session is a first-party cookie we set after Clerk sign-in so the dashboard and CLI approval page can call our API. Clerk cookies keep the Google/GitHub session. The CLI config file on your computer holds your Compute session token.
We do not use advertising cookies. Product analytics in the browser uses sessionStorage, not a tracking cookie.
Who else sees data
We use these processors to run Compute:
Clerk — authentication. Stripe — prepaid Checkout. Railway — API, workers, and website hosting. Cloudflare — DNS, TLS, and R2 object storage for payloads, results, and archived logs. PostHog Cloud (United States) — product analytics as described above. RunPod and Hot Aisle — GPU machines that execute your workload.
Google and GitHub see the OAuth sign-in you start with them. They are not our subprocessors for running jobs.
Retention
Packaged payloads, results, and archived logs are kept for 30 days, then deleted.
Product analytics events are retained for about 90 days.
Account, session, API-key, secret, and billing records stay for as long as the account is open, and billing records may be kept longer when we need them for accounting, disputes, or law. Device codes expire in minutes. You can delete secrets and revoke keys yourself at any time.
Your choices
You can close your browser session, revoke API keys, delete secrets, and turn off CLI telemetry as described above.
There is no self-serve export or account-deletion button yet. Email privacy@theoric.com and we will export or delete your Compute account data. We aim to reply within 30 days. We may keep billing records we are required to keep, and we cannot unsay a workload that already ran on a provider machine.
If you are in the EEA, UK, or California, you can also ask for access, correction, deletion, or a copy of the personal data we hold, and you can object to or limit some processing. You can complain to your local regulator. We do not sell personal information and we do not share it for cross-context behavioral advertising.
Children and where data is processed
Compute is not directed at children under 13, and we do not knowingly collect their information.
WOW21, Inc. is in the United States. Our processors listed above also store and process data in the United States. If you use Compute from another country, you are sending data to the U.S.
Changes and contact
If we change this policy in a material way, we will update this page and the effective date.
Privacy questions, export, and deletion: privacy@theoric.com. Please include your Compute user id (usr_…) or the email on the account if you have one.