Privacy Policy.

WorldBLD LLC is a company registered in Pennsylvania, United States at 7 Cook Road, Media, PA 19063. Replicity, Replicity Twins, and Replicity Maps are products of WorldBLD LLC.

Questions about this policy: hello@replicity.ai or (484) 470-3311.

This policy covers personal and account data processed by the Replicity website and related APIs. It does not cover third-party sites we link to. Geospatial Maps Data you download is licensed under the Terms of Service; this policy is about information about you, not about city geometry.

Account and authentication

Sign-in is passwordless. You submit an email address; we send a one-time sign-in link through our authentication provider (Supabase Auth). We do not collect or store a password for Replicity.

On first successful sign-in we create:

• an authentication user record (email, unique user id, sign-in timestamps, and related auth metadata);
• a personal account record (a default name such as "Personal account," creation time, and an internal-staff flag used only for our own operators); and
• a membership linking your user id to that account, with a role (owner, admin, or member).

We use this to keep you signed in, show the account page, and authorize Maps API keys. We do not currently collect a profile photo, billing address, or phone number at sign-up.

API keys

If you create a Replicity Maps API key from the account page, we store:

• a display name you choose;
• a public key prefix (enough to identify the key, not enough to use it);
• a one-way hash of the full key (argon2id) — we cannot recover the full secret after it is shown to you once;
• scopes, tier, rate-limit settings, optional origin allowlist, created/revoked times, and last-used time.

The full key is displayed once at creation in your browser. We do not store the full key in plaintext.

Waitlist and survey

If you join the waitlist, we store the email you provide, an optional city of interest, your survey answers (for example use case, role, company size, current workflow, pain point, and optional notes), how far you progressed, whether you finished, and timestamps. Answers are stored as structured fields associated with that email.

Maps API usage

When you call maps.replicity.ai, we record usage against the authenticating key (or, for anonymous calls, a salted hash of client IP used for rate limiting — not a login identity). Usage summaries may be available to you via the API. We use this to enforce tiers, quotas, and abuse limits.

Communications

If you email us at hello@replicity.ai, we keep the correspondence as needed to respond. The public contact form on this site is for inquiries; treat anything you type there as information you are sending to us.

Automatically collected technical data

Our servers and error-monitoring tools may log request metadata such as timestamps, route, status code, approximate duration, and a request id. Where an account or key is involved, logs may include an account id or key prefix — not the full API secret. We use IP addresses to apply short-lived rate limits on public forms; those counters are process-local and are not a customer profile database.

We do not run advertising pixels or a product-analytics suite on the marketing site today. If that changes, we will update this policy.

We use cookies that are needed to operate the Services:

• Authentication cookies — set by our sign-in provider to keep your session after you follow a magic link. These are required to use /account and related signed-in pages.
• Waitlist survey cookie (replicity_survey_session) — an httpOnly cookie issued after you submit a waitlist email. It binds later survey answers to the browser that started the form so someone else cannot overwrite your response by knowing only your email. It expires after seven days.

We do not currently use cookies for advertising or cross-site tracking. You can block cookies in your browser; sign-in and waitlist progress will not work without the cookies above.

We use the information above to:

• create and operate your account and sign you in;
• issue, verify, and revoke Maps API keys;
• deliver Replicity Twins and Replicity Maps;
• run the waitlist, prioritize locations and formats, and email you about access;
• enforce rate limits, quotas, and the Terms of Service;
• diagnose errors and keep the Services available;
• respond to inquiries; and
• comply with law and protect our rights.

We do not sell your personal information.

Account, membership, API-key, waitlist, and survey records are stored in a hosted Postgres database (Supabase) in the United States, with row-level access controls so browser keys cannot read other people's account or survey rows. Authentication sessions live with that same provider.

Map dataset files used by Replicity Maps (city layers uploaded by our operators) are stored in object storage (Cloudflare R2). Those objects are production data, not a customer document store.

The website is hosted on Vercel. Error reports, when enabled, go to Sentry with default personally identifying information collection turned off.

No method of transmission or storage is 100% secure. We take reasonable measures, including hashing API secrets and using httpOnly cookies for sessions, but we cannot guarantee absolute security.

We share information with service providers who process it on our behalf:

• Supabase — authentication and database;
• Vercel — website hosting;
• Cloudflare — object storage for map datasets;
• Sentry — error monitoring, when configured;
• email delivery used by our authentication provider to send sign-in links.

We may also disclose information if required by law, to protect the Services or other users, or in connection with a merger, acquisition, or sale of assets. We do not sell personal information and we do not share it for cross-context behavioral advertising.

We keep account, membership, and API-key records for as long as the account is active and as needed afterward for security, billing disputes, and legal obligations. Revoked keys remain as revoked records (prefix and hash) so they cannot be reused. Waitlist and survey responses are kept to operate the waitlist and understand demand. Authentication cookies last for the session configured by our provider. The waitlist survey cookie lasts up to seven days.

You can:

• sign out at any time from the account page;
• revoke API keys you have created;
• decline to join the waitlist or skip optional notes;
• email hello@replicity.ai to request access, correction, or deletion of account or waitlist data we hold about you.

We do not currently offer a self-serve account-deletion button. If you ask us to delete your account, we will disable access and delete or de-identify personal records except where we must retain them (for example, to complete a legal obligation or to keep a revoked key from being replayed).

The Services are hosted in the United States. If you access them from elsewhere, you are transferring information to the United States and consent to that processing.

The Services are not directed to children, and you must not be a minor in your jurisdiction to use them. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will change the "Last updated" date when we do. Continued use of the Services after a revision is posted means you accept the updated policy.

WorldBLD LLC
7 Cook Road
Media, PA 19063
United States
Phone: (484) 470-3311
Email: hello@replicity.ai