Privacy Policy

Coherix — coherix.ca and the CMCI Signal API
Last updated: April 22, 2026

1. Overview

This privacy policy covers the services operated by Systèmes de cohérence Coherix inc. (Montréal, Canada), trading as Coherix:

• Coherix website (coherix.ca) — marketing pages and authenticated user area.
• CMCI Signal API (/cmci/signal/*) — real-time structural coherence monitoring for multi-agent AI pipelines.

We collect the minimum data needed to operate these services, and we never sell, rent, or share it with advertisers or data brokers.

2. Account Data (coherix.ca login)

If you create an account using email or Google OAuth, we receive and store:

• Your email address and, for Google OAuth, your full name and profile picture as returned by Google.
• A unique account identifier generated by our authentication provider (Supabase).
• Timestamps of login events.

We do not receive or store your Google password. Authentication tokens are managed by Supabase and Google's OAuth infrastructure.

3. CMCI Signal API Data

The CMCI Signal API is designed to process numerical observation vectors — not raw content. For every observation you push, we process:

• A four-dimensional vector y = (C, S, R, A) with values in [0, 1].
• Optional scalar parameters (self_referentiality, reversibility, seq_disruption).
• Your API key (used for authentication and rate limiting).

We do not receive, store, or analyse the underlying text, prompts, or agent outputs of your multi-agent system. The mapping from your raw signals to the observation vector happens inside your own system, before the API call.

Session state (observation count, current regime, defect values, latency metrics) lives in memory on our server and is cleared when the session is closed or after two hours of inactivity.

4. Data We Do NOT Collect

• Browsing history outside of coherix.ca.
• Location data beyond what can be inferred from IP (used only for rate limiting and regional routing).
• Financial information — payments, if any, are processed by Stripe, whose own privacy policy applies.
• Third-party analytics or advertising pixels. The website does not run trackers.

5. Third-Party Services

Coherix relies on the following providers, each with their own privacy practices:

• Supabase — user authentication and session management.
• Google OAuth — optional sign-in with Google.
• Railway — server hosting for the API.
• Vercel — static hosting for the marketing site.
• Cloudflare — DDoS protection and CDN. All traffic to coherix.ca passes through Cloudflare.
• Stripe — payment processing for paid plans (only if applicable).

We do not share account or API data with third parties beyond what is strictly necessary for these providers to deliver the service.

6. Security

All communication with Coherix services uses HTTPS with TLS 1.2+. API keys are hashed for storage where applicable. Authentication tokens from Supabase use industry-standard JWT. The CMCI Signal API enforces per-key rate limits to prevent abuse.

7. Your Rights

Depending on your jurisdiction (e.g. GDPR in the EU, Québec's Law 25, CCPA in California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and all associated data.
• Export your data in a portable format.
• Withdraw consent and stop using the services at any time.

To exercise these rights, email us (see Contact) and we will respond within 30 days.

8. Children's Privacy

Coherix services are not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes are reflected on this page with an updated "Last updated" date. Continued use of Coherix services after changes constitutes acceptance of the updated policy.

10. Contact

For questions about this privacy policy or your data:

Christian St-Louis
Systèmes de cohérence Coherix inc.
Montréal, Canada
Email: [email protected]
Website: coherix.ca