Privacy Policy

Version 2026-09-01

1. What we collect

• Account: your email address. Used only to sign you in.
• Profile: display name, business name, which track you are on, your state, and optional industry code. Your state is recorded so we can see which states need resources added.
• Assessment answers and scores: your responses to the readiness questions, computed scores, and score history.
• Action plan: checklist items, their status, and any notes you type. For each item we store a single flag: whether you marked a document as ready. We do not store filenames, file sizes, file types, counts, or any other detail about your files.
• Usage analytics: anonymous, cookie-free page and event counts (for example, which assessment step people stop on). We use a privacy-respecting provider and do not track you across sites.

We never ask for, and you should never enter, a Social Security number, Employer Identification Number, or bank account number anywhere in this service.

2. What we do not collect: your documents

Tax returns, bank statements, and any other file you attach to a checklist item are saved in your browser’s local storage (IndexedDB) on the device you are using. They are never uploaded. There is no file upload feature and no server-side file storage in this service. When you build an export package, it is assembled inside your browser; the files never pass through our servers.

Because files live on your device, they are only available on that device and browser, and your browser may clear them. Keep your own copies.

3. Where data is stored

Account, profile, answers, scores, and checklist data are stored in a managed Postgres database hosted by Supabase in the United States. Access is restricted by row-level security so each user can read only their own rows. Email is sent through Resend. AI feedback is generated by sending a structured summary of your answers (never your files, never account or ID numbers) to Anthropic’s API; that summary is not used to train models.

4. How long we keep it

For as long as your account exists. When you delete your account, all rows tied to it are deleted immediately. Backups held by our database provider expire within 30 days. Anonymous analytics counts are retained in aggregate and cannot be traced to you.

5. Sharing

We do not sell your data. We do not share it with lenders, brokers, credit bureaus, or advertisers. The only parties that process it are the infrastructure providers named above, and only to run the service. We will disclose data if required by law.

6. Deleting your data

Settings offers two separate actions, because they do two different things:

• Delete my account and all server data removes your account and every row in our database. It cannot remove files stored on your devices, because we have never had them.
• Remove all files from this device clears the files stored in this browser. Repeat it on each device where you attached files.

You can also email support@example.com to request deletion.

7. Changes

If this policy changes, the version above changes and you will be asked to accept the new version at your next sign-in.

8. Contact

support@example.com