Privacy Policy

We collect the minimum needed to run your account, we don't sell or share your data with advertisers, and you can delete everything yourself from Settings at any time.

When you create an account, we store:

• Your email address and username
• Your password — as a one-way cryptographic hash; we never see or store the password itself
• The plan you selected on the pricing page, if any
• The date and time you accepted the terms
• Session records (including IP address and browser type) so logins work and stolen sessions can be revoked

We don't collect payment details yet — when payments launch, they'll be handled by a payment provider and we won't store card numbers ourselves. This policy will be updated first.

Running your account: signing you in, greeting you on the dashboard, securing sessions, and — once email features launch — verification and password-reset emails. We may email account holders about material changes to the service or these policies. No marketing lists, no selling data, no ad tracking.

One session cookie, used purely to keep you signed in. It's httpOnly (scripts can't read it) and secure in production. There are no analytics or advertising cookies.

The site runs on Vercel and account data is stored in a Neon Postgres database hosted in the EU (London region). These providers process data on our behalf under their own security and privacy commitments.

For as long as you have an account. Deleting your account from Settings permanently removes your account record and sessions.

You can see and change your account details in Settings, and delete your account entirely — no need to ask us. For anything else (a copy of your data, a correction, a question), email us and we'll sort it.

A lawyer-reviewed version of this policy will replace this one before full launch. Material changes will be announced to account holders by email, and the effective date above always tells you which version you're reading.