Privacy

PRIVACY SUMMARY Last updated: October 30, 2026

What we store. Your name, work email, agency and role; the project information you enter (for example corridor, volumes, crash summaries, costs and match sources); drafts, letters and calculations the Tool generates for you; and security and activity records (sign-in times and actions such as creating a project, generating a section or exporting a document). We store your IP address only as a salted one-way hash.

How we use it. Only to run the Tool for you: to save your work, generate drafts on your request, keep the Tool secure, fix problems and understand overall usage in aggregate, de-identified form. We do not use your project content to train AI models, and our AI provider may not use it to train its models.

Never shared with Rhythm. Doxa does not share your name, contact details, agency, usage or project information with Rhythm Engineering, for sales, marketing or any other purpose. There is no opt-in, setting or consent that changes this, and the Tool's database is separate from every Rhythm system.

Service providers. These process data only on our behalf, under confidentiality obligations, and may not use it for their own purposes: Hostinger (server hosting), Resend (sign-in email) and Anthropic (AI text generation, only for sections you ask the Tool to draft).

Never sold. We do not sell, rent or trade your personal information or your agency's project data.

Other disclosures. We may disclose information if required by law or valid legal process, to protect the security of the Tool, or to a successor if Doxa transfers the Tool, in which case this summary continues to apply to data collected under it.

Retention and deletion. We keep your account and projects until you delete them. You can delete a project, or your account with all its projects, at any time from My projects. Deleted data leaves the live system immediately and our backups within 90 days. If you cannot sign in, email grants@doxaengineering.com from your account's email address and we will delete it within 30 days. After a deletion we keep only security records of actions taken, with no name or email attached. Sign-in links expire within minutes and are stored only as one-way hashes.

Public records. Applications and documents your agency creates may be public records under your state's law. Your agency is responsible for its own records obligations. Doxa does not publish your drafts.

Security. We use reasonable administrative, technical and physical safeguards, including encryption in transit. No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as the law requires. Tell us right away if you suspect a problem at grants@doxaengineering.com.

Questions and requests: grants@doxaengineering.com.