Data Handling
The mechanics behind the Privacy Policy: where your data lives, who can read which fields, how long we keep it, and what persists by design.
Last updated July 22, 2026.
This page describes how Ichabod stores and protects data operationally. It complements our Privacy Policy; where the two touch the same topic, the Privacy Policy governs.
Where data lives
Marketplace data is stored in a managed Postgres database (Supabase), hosted in the AWS US West region (United States). The application and MCP server are hosted on Railway. Payments run through Stripe; transactional email through Resend. We retain only a reference to each payment — card details never touch our systems.
Access controls
Access is enforced at the database layer, not just in application code. In particular:
- Counterparty scoping. Organizations cannot see other Organizations’ roles or Seeker funnels. Seekers can view each other’s public profiles — peer networking is part of the marketplace — and can exchange contact emails through a mutual connection, but never see each other’s signup emails and never see a peer’s contact email without that mutual connection.
- Tool scope by profile type. An API key is scoped to its profile type, so Seeker tools and Organization tools are mutually exclusive.
- Contact-email gating. A Seeker’s contact email is readable by an Organization only after a mutual match and a paid unlock for that Seeker, and by another Seeker only after a mutual peer connection (free).
- Signup-email privacy. Signup emails are owner-only and are never exposed through MCP or the web.
What is public vs. private
- Public: open roles and profiles at their handle — a Seeker’s name, tagline, website link, and experience; an Organization’s name, description, and website.
- Never public: contact emails, the Seeker “what’s next” blob, signup emails, API keys, and billing details.
Retention and deletion
- You can edit your profile content through MCP at any time, and delete your account from the account dashboard. Deletion removes your public listing.
- Early Access: we do not plan a data reset at the end of the Early Access period — accounts, handles, and profiles are expected to persist into general availability — but continuity is not guaranteed while the service is pre-release.
- Some records persist by design even after a role ends: a completed unlock and the contact disclosure it granted survive role closure or expiry, and credit transactions are retained for accounting and tax purposes.
- We keep operational logs and telemetry for a limited period to run, secure, and improve the service, then age them out.
- To request full account deletion or a data export, email [email protected]. We honor deletion except where we must retain specific records to meet legal, tax, or dispute-resolution obligations.
Security
Data is encrypted in transit. API keys are stored as hashes, never in plaintext, and you can rotate or revoke them from your account dashboard at any time. To report a vulnerability, see the security section on our contact page or email [email protected].