Privacy
Short version: we collect what is needed to operate the service and nothing beyond it, we do not sell data, and we do not run advertising trackers.
Accounts
Accounts are handled by Supabase. When you create one we store your email address, an encrypted authentication record, and a session cookie in your browser so you stay signed in. Session cookies are scoped to this domain.
Payments
Payments are processed by Stripe. Card details are submitted directly to Stripe and are never stored on our servers. We retain a customer and subscription identifier so we can tell whether your membership is active.
Transactional email — sign-in links, receipts, account notices — is sent through Resend. We do not add you to a marketing list because you created an account.
Hosting and logs
The site is hosted on Vercel, which keeps standard request logs. These contain IP addresses and are retained by Vercel under its own policy.
Your data
You can request a copy of your data or its deletion at any time by emailing us. Deleting your account removes your authentication record and associated data.
Changes
If this policy changes materially, account holders will be told by email before the change takes effect.
This document describes actual current practice and has not yet been reviewed by a lawyer. It should be reviewed before launch.