Privacy notice
Last updated October 9, 2026
Legacy X-ray ("we") is based in Milwaukee, Wisconsin. This notice covers this website and the request form. You can reach us about it at [email protected].
What we collect
- What you type into the request form: your name, work email, company, phone number if you give one, your role, what the app is built in, what you tell us about it, and the type of request.
- Emails you send us, and anything in them.
- Technical data needed to deliver the site, such as your IP address and browser type. Our hosting provider processes this to serve and protect the site.
We don't use advertising or tracking cookies.
Who processes it for us
- Cloudflare hosts the site and forwards email sent to [email protected] to our mailbox.
- Formspree receives the request form and emails it to us.
- Microsoft OneDrive receives the files you upload through our private upload link.
- Google Fonts serves the site's typefaces, so your browser contacts Google to load them.
How we use it
Only to reply to your request and to run the work you ask us for. We don't sell or rent your details, and we don't add you to a mailing list.
Client files: where copies live
If you send us an app for an X-ray or a project, copies of it exist in these places, and no others:
- Microsoft OneDrive, behind the private upload link we send you (upload-only: you can't see other files there, and the link expires).
- Our workstation: the downloaded copy, the files we extract from it (code, queries, test recordings), working notes, and a test database for the rebuild.
- A dedicated virtual machine on that workstation. Your app only ever runs there. It's separate from our everyday system, but it does have internet access, so we don't describe it as sealed.
- Our AI provider, currently Anthropic (Claude), for material we process with it. We ask for your written authorization first, and can work from an anonymised copy of your data. Anthropic keeps that material under its own terms, which we don't control.
- Email, only if you send us files that way despite our asking you not to.
Client files are kept out of online code repositories and out of our backups.
Deleting client files
Within 30 days of a project closing, or sooner if you ask, we delete every copy we hold: the upload, the workstation copies, the virtual machine copy, the test database, and our working logs. Because client files are excluded from our backups, there are no backup copies to expire. We can't delete what our AI provider has already processed, which is why we ask before sending it anything. The project you paid for stays yours: the delivered code and database are handed over to you, not deleted.
How long we keep it
We keep request emails for as long as we need them to handle your request and keep normal business records. Ask us and we'll delete them sooner, unless the law requires us to keep them.
Your choices
Email [email protected] to see, correct or delete the details we hold about you.
Changes
If we change this notice, we'll update the date at the top.