Privacy

getctx is operated by Celados. This policy covers getctx.sh, signing in to it, and the getctx API at api.getctx.sh: what each collects, where it goes, how long it is kept, and who processes it.

The website

getctx.sh has no analytics, no advertising and no third-party scripts, frames or images. Signed out, it sets no cookies. Cloudflare hosts the site and, like any web host, receives each request with your IP address; we keep Cloudflare’s request logs to find faults.

Signing in

You can sign in with Google or with a code we email you.

• With Google, Google tells us your name, email address, profile picture and Google account ID (the “openid”, “email” and “profile” scopes). We keep them, and the tokens Google issues, with your account. We do not use those tokens to read anything else from your Google account.
• With an emailed code, we keep your email address and send a six-digit code to it through Cloudflare Email Sending. The code is stored encrypted and expires after 10 minutes.

Signing in creates a session: a cookie in your browser, and a record with your IP address and browser user agent. To stop abuse, we count code requests and sign-in attempts per email address and per IP address; those counters expire within a day.

Organizations and API keys

Your account belongs to an organization, which holds its name, its members and their roles, any invitations (with the invited email address), its API keys and its credit balance. We store an API key only as a hash, with its first characters so you can recognize it; the full key is shown once, when it is created.

Each paid API call leaves a usage record: the organization, the key, the capability, the credits charged, the price tier, the browser time used and when it happened. Usage records hold no URLs, queries or content.

What the API processes

The API handles what you send it so it can answer: files, URLs, search queries, JSON schemas, and any headers or cookies you ask it to send to a site. What it fetches or produces is cached in Cloudflare R2 for the periods below.

• Parse. An uploaded file is stored under its SHA-256 hash and sent to Firecrawl to convert, with Firecrawl’s cache turned off; a PDF may instead go to a Baidu Cloud model. Uploads are kept 7 days and results 30 days. A result is reused for anyone who uploads the identical file.
• Read. The URL is fetched from Cloudflare’s network, rendered with Cloudflare Browser Rendering when needed, and documents are converted with Cloudflare Workers AI. GitHub, Codeberg and jsDelivr URLs are read through their APIs. The cleaned page is cached for up to 7 days and served to anyone who reads the same URL. Headers, cookies or logins you send are passed to the site and not stored; a read that used them is cached for your organization only.
• Brand. The site is rendered with Cloudflare Browser Rendering, and what we read from the page is sent to DeepSeek, which may search the web through Exa, to write the brand profile. A brand is public information about a public site: it is cached for 30 days and served to anyone who asks for the same site. The logos, images and fonts it copies are kept with no expiry at public URLs.
• Browser. Calls to /cf/ are forwarded to Cloudflare Browser Rendering; we keep only the usage record.
• Web. Search queries go to Exa. Scrapes, link maps, screenshots and crawls run on Cloudflare Browser Rendering; JSON extraction also sends the page and your schema to DeepSeek. Results are cached for your organization for up to 7 days, and a crawl’s record for 14 days.
• Watches and feeds. A Page Watch keeps its URL and the page’s last version; a Search Feed keeps its query and creates a monitor at Exa. Both keep their events, and send them to the webhook URL you set, signed. Deleting one deletes its stored versions and events (and a feed’s Exa monitor); a stored version nobody checks for 365 days is removed.

Who processes it

• Cloudflare: hosting, storage, request logs, Browser Rendering, Workers AI and the sign-in email.
• Convex: accounts, sessions, organizations, API keys, credits and usage records.
• Google: sign-in, when you choose it.
• Firecrawl and Baidu Cloud: file conversion for parse.
• Exa: web search, search feeds and brand research.
• DeepSeek: brand profiles and JSON extraction.
• GitHub, Codeberg and jsDelivr: only the request for a URL you read on them.

We do not sell your data, use it for advertising, or train models on it.

How long we keep it

API data follows the periods above. Your account, organization, keys, credit balance and usage records are kept while your account exists. Request logs are kept for Cloudflare’s log retention period.

Your choices

To see what we hold about you, or to have your account and its data deleted, write to hello@celados.com. You can withdraw getctx’s access to your Google account at any time in your Google Account’s security settings.

Changes

When this policy changes, we update the date at the top of the page.