Privacy Policy

rect.sh hosts rects — live, shareable interactive views backed by a JSON view model that people and AI agents edit together in real time. Understanding that model helps this policy make sense: view authors publish reusable templates, agents or people issue live instances from them, and each instance is reachable at a capability URL — a link whose unguessable address is the access control.

We may collect the following categories of information:

• Account information, such as name, email address, workspace and team details, and authentication information.
• Templates you publish, including view HTML, bundled assets, specs, action code, and optional remix source.
• Instance content: the JSON view model of each issued rect, including everything typed into the view by anyone holding its link and everything written to it by AI agents over MCP, the CLI, or the HTTP API.
• Attachments uploaded to an instance, and their metadata (file name, type, size).
• Usage and device information, such as log data, IP address, browser type, requests made, and diagnostic events.
• Billing information if you purchase a paid plan, such as plan, payment status, and transaction metadata. Payment card details are processed by our payment providers, not stored by us.

Some of this content reaches us without a rect.sh account: agents and their users can issue and edit instances anonymously. That content is still handled as described in this policy.

An issued rect is deliberately shareable: anyone who has an instance's link can open the view, read its view model, change it, and download its attachments. The link's unguessable identifier is the only access control on an instance. Treat a rect's link — and anything you or your agent put into the rect — as shared with everyone the link reaches.

Do not put into a view model or attachment anything you would not share with every holder of the link — in particular payment card numbers, government identifiers, passwords or credentials, or health information.

We use information to:

• provide, maintain, troubleshoot, and improve the service — including hosting templates, storing and syncing view models in real time, running view-declared actions, and serving attachments;
• create and manage accounts, workspaces, and teams;
• respond to support requests and communicate with you;
• process payments and manage subscriptions, if applicable;
• detect abuse, investigate issues, and reduce security risks;
• comply with legal obligations.

rect.sh does not send your content to AI model providers. We host the views; the AI agents that read and write them belong to you or to third parties (for example, an assistant connected to our MCP endpoint). What an agent does with data it reads from a rect — and what data it chooses to write into one — is governed by that agent's own provider and its policies, not by rect.sh.

When an agent issues or edits a rect on your behalf, the resulting view model content is stored by rect.sh as instance content under this policy.

We may share information with:

• infrastructure providers that host the service — including our database, authentication, file storage, and realtime infrastructure, and our hosting/CDN providers;
• payment processors, if you purchase a paid plan;
• teammates and workspace members, according to your workspace settings — team templates and their instances are visible to the team;
• anyone holding an instance's link, as described in section 3 — including AI agents given the link or its identifier;
• authorities or other parties when required by law or needed to help protect rights, safety, and security;
• a successor in connection with a merger, acquisition, financing, restructuring, or sale of assets.

We do not sell personal information.

Account data is kept for as long as your account exists and as needed to meet legal and accounting obligations. Templates, instances, and attachments are kept until you delete them or delete the workspace that owns them. Instances issued anonymously (without an account) may be removed after extended inactivity. Log and diagnostic data is retained for a limited period for security and operations.

We use administrative, technical, and organizational safeguards designed to help protect information: views run in a sandboxed environment, attachments are stored in private storage and served only through instance-scoped URLs, and access to workspace data is enforced at the database layer. No method of transmission or storage is completely secure — and as section 3 explains, instance links are themselves credentials, so guard them accordingly.

You may update account information, delete templates, instances, and attachments you control, or contact us to request access, correction, deletion, or export of personal information, depending on your location and subject to applicable limits. Instance content is also readable in full at any time through the instance's own URL and API. We may need to verify your identity before fulfilling certain requests.

rect.sh is operated from the United States, and information may be processed in the United States and other countries where we or our providers operate. These countries may have data protection laws different from those in your location.

rect.sh is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you. The updated policy will be effective when posted unless stated otherwise.

rect.sh is provided by Suri. You can contact us at support@suri.team or by mail at 1111b South Governors Av #88996, Dover, DE 19904, US.