01Who this covers
This policy covers the Courant agent you run on your own machines, the hosted service it talks to, and this website. It applies to everyone who holds an account, everyone invited to one, and anyone who writes to us.
Where your employer holds the account, they control it: they can invite and remove people, and they can see the runs recorded under it. What we hold, and what we will not hold, is the same either way.
02The short version
Courant runs as two halves: an agent on your machine and a service on ours. The agent reads the log your solver is already writing, and sends us a small structured summary — an Evidence Bundle, typically about 8 KB.
Your mesh, your geometry and your solution fields never leave your machine. Not encrypted in transit, not held briefly, not stored in a region of your choosing: they are never transmitted at all.
03What crosses the network
An Evidence Bundle is assembled on your machine. It contains these things and no others:
- The solver name and the case's cell count.
- Residual series, downsampled — the convergence numbers your solver prints on every step.
- Findings from the deterministic checkers: which check fired, how severe it judged the result, and the value that triggered it.
- Mesh quality metrics — skewness, non-orthogonality, aspect ratio — as numbers. Not the mesh.
- Configuration keys drawn from a fixed allowlist: the timestep, the discretisation schemes, the linear-solver tolerances, the turbulence model, the relaxation factors.
- Log lines that a checker cited as evidence, after redaction.
Roughly eight kilobytes, for a case whose mesh may be several gigabytes. The size difference is the point: there is no version of this bundle that could carry your geometry.
04What never crosses it
These are excluded by construction rather than by policy — there is no setting that turns them on, and no support request that will:
- The mesh, in any form or resolution.
- Geometry, CAD, or any boundary description beyond the patch type.
- Solution fields — velocity, pressure, temperature, phase fractions.
- Absolute filesystem paths. A path like /scratch/turbine-blade-v3 is a commercial disclosure even though it is only a path, so paths are reduced to a basename or dropped.
- Hostnames, usernames and cluster layout.
- Bulk numeric arrays. A long float array is how a mesh or a field would actually escape — carried inside a configuration value — so a length limit applies to every value, not only the obvious ones.
05How that is enforced
The boundary is enforced twice. The agent sanitises the bundle before sending it, and the service sanitises again on receipt and records an audit entry when its own pass removed anything — because a patched or outdated client is exactly the case where a leak would otherwise be silent.
It is an allowlist, deliberately. There is no reliable way to ask whether an arbitrary string is a hostname, so the rule is that a field must be named before it may cross. Anything unnamed does not.
A dedicated test suite gates every release on this behaviour. If it fails, the release does not ship — that is a written rule in the repository, not an aspiration.
06What we store about you
An account holds your email address, a display name if you set one, your organisation, and your timezone — the last so scheduled email arrives during your working hours rather than ours.
For each run you choose to record, we store the Evidence Bundle described above, the diagnosis produced from it, any fix proposed or applied, the verification results, the Trust Grade and the report. That record is what makes a run auditable months later; it is the product rather than a by-product of it.
We keep an append-only audit log of actions taken against your organisation's data.
There are no advertising trackers on this site or in the product, no third-party analytics that identify you, and no sale or sharing of personal data. We do not build profiles and we do not enrich your record from outside sources.
07Why we are allowed to hold it
Where the UK GDPR or EU GDPR applies: we process account data to perform the contract you or your employer entered into, and we process run data on the same basis. Security logging and the audit log rest on our legitimate interest in keeping the service safe and accountable, which we consider proportionate because the data involved is minimal by construction.
Marketing email is sent only to people who asked for it, and every message carries a working unsubscribe link.
Where your employer holds the account, they are the controller of the run data and we are the processor.
08Who else can hold it
Diagnosis uses a language model as a reasoning step inside a deterministic control plane. The Evidence Bundle is sent to the provider below for that purpose, and nothing else is sent anywhere.
This is every third party that can hold your data. A party absent from this list does not receive it. We will update this page before adding one.
- Anthropic (United States) — Ranks diagnosis hypotheses from an Evidence Bundle. Receives: The Evidence Bundle only — never a mesh, geometry or solution field.
- OpenRouter (United States) — Fallback for the same task when the primary provider is unavailable. Used only where configured. Receives: The Evidence Bundle only.
- Resend (United States) — Delivers sign-in links, invitations and the weekly digest. Receives: Email address, display name, and the contents of that message.
- Vercel (Global edge network) — Hosts this website. Receives: Standard web request logs. No account data and no run data.
09Where it is processed
The service and its database run in the United States, and the sub-processors above operate there. If you are in the UK or the EEA, that is an international transfer, and we rely on the standard contractual clauses our providers offer for it.
If your site cannot permit that transfer at all, say so before a pilot rather than after. The agent already runs and diagnoses locally, so there is a real conversation to have about what a fully local deployment would look like.
10Keeping organisations apart
Each organisation's data is isolated by three independent mechanisms: every query is bound to your organisation when it is constructed, the database enforces row-level security policies underneath that, and a test suite runs against a real database as an unprivileged role to prove those policies are actually in force rather than merely present.
The third mechanism exists because the first two once looked correct and were not. Policies were written and nothing set the tenant, so they were inert. The test is what found it.
11How long we keep it
Run records are kept until you delete them or close your account. Deleting an account deletes its runs, diagnoses, fixes, verifications and reports within 30 days, including from backups as those backups age out.
Audit-log entries are retained for the life of the account, because an audit log you can edit is not an audit log.
Evidence Bundles sent to a model provider are additionally subject to that provider's own retention terms.
12Your rights
You can ask for a copy of what we hold on you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, or object to a particular use. Write to hello@courant.dev and we will answer within 30 days.
You can also run Courant without an account at all. The bundled demo runs the entire loop offline, and the agent falls back to a local deterministic diagnosis when it cannot reach us — offline is a degraded mode, not a failure.
Sign-in is passwordless. We never hold a password because we never issue one.
If you are in the UK or the EEA and think we have got this wrong, you may complain to your data protection authority. We would rather you told us first.
13If something goes wrong
If personal data is exposed, we will tell the people affected and the relevant authority without undue delay, and within 72 hours of becoming aware where the law requires it.
We will say what happened, what was involved, and what we changed. We will not wait until we have a complete account before telling you there is one to give.
14Cookies
This website sets no cookies for advertising or cross-site tracking, and shows no consent banner because it has nothing to ask you to consent to.
The product sets a session cookie once you sign in. It exists to keep you signed in and does nothing else.
15Children
Courant is a professional engineering tool and is not directed at anyone under 16. We do not knowingly hold data about children.
16Changes to this policy
When this policy changes materially we will email account holders before the change takes effect, and the version and date at the top of this page will move.
Previous versions are available on request, so that a claim made in an earlier version can be checked against the one you relied on.