01Who we are
In this policy, “Courant”, “we” and “us” mean Shivanshu Dwivedi, doing business as Courant (company in formation). It explains how we handle personal information when you visit courant.dev, when you write to us, and when you use the Courant gate, our open-source software for checking simulation runs. Under data-protection law, Courant is the controller of the personal information this policy describes.
Courant is being formed as a company. When it is, the company becomes the controller in our place, keeps to this policy, and is named here.
You can reach us about anything in it at hello@courant.dev, and our postal address is available on request at hello@courant.dev.
02The gate
The gate is open-source software that runs on machines you control. It reads a run’s files (the case directory, the solver’s log and output, and a task specification if you give one) and writes a verdict and an evidence pack beside them. It has no account and no telemetry, and Courant runs no service it could send to: nothing it reads is sent to us, ever, so we receive and hold none of it. Its checks open no network connection.
Only these contact the network, and only when you run them; each command names the host before it connects. None sends your runs, cases or results, and none sends anything to Courant.
- courant update
- downloads a release of the gate, its checksums and their signature from GitHub (github.com), which receives the request under its own privacy statement. A pip installation does not use it
- courant doctor --models
- reads OpenRouter’s public list of models from openrouter.ai, without a key, under its privacy policy
- courant test run --judge llm:…
- with a language model you name as the judge and your own key for its provider, sends the Courant Test’s own tasks, built from public tutorials, to that provider under your account and its terms
- courant spec extract
- with a language model and your own key, sends the task text you gave it to the model provider under your account and its terms
- Installing the gate
- with pip downloads the package from PyPI, or the package index you use, under PyPI’s privacy notice; the one-line installer and
courant updatedownload from GitHub, under its statement above
If you connect the gate’s MCP server to an AI agent, the agent and the model provider you chose see what the gate returns to them, under their terms. We do not.
03Visiting this site
This site, courant.dev, is hosted by Vercel Inc. To serve each page and keep the site secure, Vercel processes the technical details of every request: your IP address, your browser’s user agent, the page asked for and the time. Vercel keeps these request logs for a period it sets, under its privacy policy. We use them only to run and secure the site, never to identify or profile you.
The site’s own code sets no cookie. It keeps one thing in your browser: your choice of the human or the machine reading, in local storage under the key courant:mode. That choice never leaves your browser, and clearing this site’s data removes it. If Vercel has to screen traffic during an attack, it may set a short-lived security cookie of its own to tell people from automated traffic; that cookie is strictly necessary and is not used to follow you.
The site loads no analytics, advertising or tracking script, and nothing from another company’s servers: its fonts, images and films are served from courant.dev itself. Because it does not track you, it treats every visitor alike, whether or not your browser sends a Do Not Track or Global Privacy Control signal. A link to another site takes you to pages under that site’s own policy.
- Cookies
- none set by the site’s code
- Local storage
courant:mode: human or machine- Analytics
- none
- Third-party scripts
- none
- Request logs
- kept by Vercel, under its policy
04The contact forms
The form at /contact asks for a topic, your name, your email address, your organisation if you want to give it, and a message. The form at /start asks which of its two offers you want, your name, your work email, your organisation, and in one line what you run; your choice and that line travel as its message. Each also sends two things you do not see, used only to turn away automated messages: a trap field a person leaves empty, and how long the form was open.
The forms send these to our forms service, which Cloudflare runs for us. It checks each field for type and length, keeps the message in a Cloudflare D1 database so that we can answer it and count the messages each form receives, and emails it to the company’s email account. If the service cannot take the message, your browser opens your own email program with it filled in, addressed to hello@courant.dev, and nothing reaches us unless you send that email.
To stop abuse, the service counts the messages each IP address sends: at most 5 in any 10 minutes. It never keeps your IP address itself, only a salted hash of it (a code made from the address and a secret of ours), which the count uses and which is stored with your message.
- Name
- 1 to 120 characters
- 3 to 254 characters
- Organisation
- up to 160 characters
- Message
- 1 to 5,000 characters
- Whole request
- up to 16 KB
- Turned away
- a filled trap field, or a form sent within 3 seconds of opening: answered as sent, and dropped
05Email to us
Mail to hello@courant.dev, including a message you send from the form, passes through Cloudflare Email Routing, which runs the domain’s email and DNS and forwards each message, in transit, to the company’s email account, where it is held. We receive your email address, your name as your email program gives it, what you write, and the technical headers every email carries.
We use it to read and answer your message and, if a conversation follows (a design-partner engagement, a purchase or a security report), to carry that on. We do not add you to a mailing list, and we do not sell what you write or share it with anyone for advertising.
06Why we use it
We use personal information only for the purposes in this policy: to serve and secure the site, to answer you, and to carry on any relationship you start with us. Where the GDPR or the UK GDPR applies, these are our legal bases:
- Legitimate interests
- serving and securing the site, keeping the forms free of abuse, and answering and counting the messages they bring (Article 6(1)(f))
- Steps before a contract
- answering you when you ask about becoming a design partner, entering SilentBench, a Team or Enterprise plan, or another agreement (Article 6(1)(b))
- Legal obligation
- keeping or disclosing information when the law requires it (Article 6(1)(c))
We make no decision about you by automated means. The gate’s verdicts are about simulation files, not people.
08How long we keep it
We keep personal information only as long as we need it for the purposes in this policy.
- as long as we need it to answer you and to run any relationship that follows, then no more than 24 months after our last exchange; sooner if you ask, unless the law requires us to keep it
- Request logs
- Vercel’s retention period, under its policy
- The forms’ messages
- kept by the forms service for no more than 24 months, then deleted; sooner if you ask
- Your IP address
- never kept itself; its salted hash, with your message, and for 10 minutes in the abuse count
- Reading mode
- in your browser, until you clear it
09Where it is handled
Courant is based in the United States, and we handle personal information there. Vercel and Cloudflare may handle it in other countries where they operate. When personal information from the European Economic Area, the United Kingdom or Switzerland passes through them, they rely on the safeguards in their data processing terms: for Vercel, the European Commission’s standard contractual clauses and the UK’s addendum to them; for Cloudflare, the EU-U.S. Data Privacy Framework and its UK extension.
10Your rights
Wherever you live, you can ask us what personal information we hold about you and for a copy of it, ask us to amend what is wrong, and ask us to delete it: write to hello@courant.dev. We answer within one month. Where a request is complex or one of many, we may take up to two months more, and if so we will tell you why within the first month. We may ask you to confirm a request from the email address it concerns. There is no charge.
Where the GDPR or the UK GDPR applies to you, you may also object to our use of your information on the basis of legitimate interests, ask us to restrict it, and receive the information you gave us in a portable form. You may complain to your data-protection authority (in the United Kingdom, the Information Commissioner’s Office), and we would welcome the chance to answer your concern first.
11California
If you live in California, you have the rights the California Consumer Privacy Act gives, and we extend them to you whether or not the Act applies to a company of our size: to know what we collect and why, to delete it, to correct inaccurate information, and not to be treated differently for asking. We do not sell or share personal information as the Act defines those words, and we use no sensitive personal information to infer anything about you.
In the past 12 months we have collected the categories below, from you and from your browser, for the purposes in this policy, and disclosed them only to the providers named above. To make a request, or to have an authorised agent make one for you, write to us.
- Identifiers
- your name, email address and IP address
- Internet activity
- the request details in the host’s logs
- Professional information
- your organisation, if you give it
- Communications
- what you write to us
12Children
Courant is a professional engineering tool. The site and the gate are not directed at anyone under 16, and we do not knowingly collect personal information from them. If you believe a child has written to us, tell us and we will delete what they sent.
13Security
The site and the forms service are served only over encrypted connections. The service checks every field a form sends before it does anything with it, and keeps your IP address only as a salted hash. Access to the forms’ database and to the company’s email account is limited to the people who answer them.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will tell you and the authorities as the law requires. To report a vulnerability, use the contact form’s security topic or write to hello@courant.dev.
14Changes to this policy
When this policy changes, the version and date at the top of this page change with it. If a change materially affects how we use information you have already given us, we will say so here before it takes effect and, where we have your email address, tell you by email. Earlier versions are available on request.