Privacy policy

Who we are

Superpowers (superpowers.tools) is operated by PQG Ventures. Contact us about privacy at bruno@pqgventures.com.

What we collect

• Account info: the email you sign up or sign in with.
• Google sign-in: if you use Sign in with Google, we receive your Google account's email address and a unique account identifier (sub) from Google; we don't receive your Google password or anything else from your Google account.
• API keys: we store a one-way hash of each API key, not the key itself. We can't recover a lost key.
• Tool run data: the input you or your agent send to a tool, the output it returns, and usage metadata (tool, timestamp, cost, latency, status) for billing, support and fraud prevention.
• Payment status: whether a top-up is pending, paid, failed or expired, and the dollar amount. Your card number and billing details go straight to Stripe and never reach our servers.
• Session and sign-in state: a few small cookies (see Cookies below).
• Site analytics: which pages are visited, referrers, device type and rough traffic category (human, search engine, AI crawler, etc.). We don't use cookies or store IP addresses for this: a visitor is counted from a daily salted hash of IP and browser, so we can tell repeat visits apart without keeping the IP itself.

Why we use it

To run your account and run tools on your behalf, to charge for successful calls and keep failed calls free, to show you usage and spending in your dashboard, to prevent abuse and fraud, to respond to support requests, and to understand and improve the site.

Retention

We keep account, billing and run records for as long as your account is active and as needed for accounting, tax and fraud-prevention purposes afterward. Analytics records are aggregate and not tied to an identifiable person. You can ask us to delete your account and associated personal data at any time (see Your rights below); we keep what the law requires us to keep, such as financial records tied to completed payments.

Sharing

We share data only as needed to run the service:

• When you run a tool, the vendor behind that tool receives the input you send it, the same way it would if you called that vendor directly. We don't send your account email, password or API key to vendors. Vendors generally fall into categories like AI model providers, search and data providers, and other API vendors listed in our catalog; we don't share our full vendor list here because the catalog changes as vendors are added.
• Google, for Sign in with Google (as described above).
• Stripe, for payment processing. Stripe handles your card details directly; we only receive confirmation that a payment succeeded or failed.
• Service providers who help us run infrastructure (such as hosting), under their own confidentiality obligations.
• Authorities, if required by law.

We don't sell personal data.

Cookies

We use a small number of first-party cookies: a session cookie once you sign in, short-lived cookies during Google sign-in (state and anti-forgery checks) and a brief one-time cookie to show a newly created API key once. We don't use third-party advertising or tracking cookies.

Your rights

You can see your usage and spending, and create or revoke API keys, any time from your dashboard. To ask what personal data we hold about you, correct it, or delete your account and associated data, email bruno@pqgventures.com from the address on the account.

Changes

We may update this policy as the product changes. We'll update the date at the top when we do.