What we collect, why, and how long we keep it.

• We collect only what you enter (email, first name, financial numbers) plus what your browser transmits automatically (IP address, basic session data).
• We do not sell your data. We do not use your financial data to train AI models. We do not share your financial numbers with third parties.
• We use a small number of trusted vendors to run the service (Supabase for the database, Vercel for hosting, Stripe for payments). Each is contractually bound to keep your data safe.
• You can delete your data at any time from your profile page. Backups age out within 30 days.

We collect three kinds of information:

1a. Account information you provide. Your email address, first name, and password (stored only as a salted hash by our authentication provider — we never see or store the plaintext).

1b. Financial information you enter. Account balances, monthly contributions, spending targets, savings goals, birth date (only if you provide it, for age-based projections), retirement age, home equity, and the scenario configurations you save. We do not connect to your bank, brokerage, or any external financial institution. Every number in your account was typed by you.

1c. Automatic information. When you visit the site, our servers and infrastructure providers log your IP address, browser type, operating system, referring URL, pages visited, and timestamps. This is standard access-log data used for security and to keep the service running.

1d. Payment information. When you subscribe, Stripe collects your payment details directly. We receive only a subscription reference, plan, status, and the last four digits of your card. We never see or store your full card number, CVC, or bank credentials.

• To operate the service: run your projections, save your scenarios, keep you signed in, apply your settings.
• To process payments and manage your subscription (via Stripe).
• To send account-related email (confirmation, password reset, subscription notifications, service-critical updates).
• To respond to support requests you send us.
• To protect the service and its users from fraud, abuse, and security threats.
• To comply with legal obligations and enforce our Terms of Service.

We do not use your financial information for advertising, marketing, or any commercial purpose unrelated to operating the service.

We share personal information only with the vendors we rely on to operate the service, and only what each needs to do its job:

• Supabase Inc. (US) — authentication and database storage. Your account information and financial data are stored on Supabase’s infrastructure, subject to Supabase’s privacy and security terms.
• Vercel Inc. (US) — web hosting and content delivery. Vercel handles the technical serving of the website and processes server logs.
• Stripe, Inc. (US) — payment processing. Stripe collects your card details directly and provides us with a subscription reference and status. Stripe is a PCI-DSS Level 1 certified processor.

We may disclose information if required by a valid legal process (subpoena, court order, warrant), or if we have a good-faith belief that disclosure is necessary to prevent harm to a person or to protect the service and its users. If we ever receive a lawful demand, we will notify you unless legally prohibited from doing so.

We do not sell your personal information. We do not share your financial information with advertisers, data brokers, or any party not listed above.

If Competitive Bearings LLC is acquired, merges, or transfers substantially all of its assets, your information may be part of the transferred assets. We will notify you and honor the commitments in this policy under the new ownership.

We keep your data only as long as you have an active account, plus a short backup-retention window after deletion.

• While your account is active: all account and financial data is retained so the service works as intended.
• On account deletion: your accounts, plan, scenarios, and votes are removed from our production database immediately. Encrypted backups age out within 30 days.
• Payment records: we retain limited subscription records (transaction ID, plan, amount, date) for up to seven years to comply with tax and accounting requirements. These records do not include card numbers.
• Server logs: IP addresses and access-log entries are retained by our infrastructure providers for approximately 30 days for security and diagnostic purposes.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (most of it is directly editable in the app).
• Delete your data. Use the delete button on your profile page, or email us at hello@competitivebearings.com to request full removal.
• Export a copy of your data in a portable format (email us to request).
• Object to certain processing, or restrict how we use your data.
• Withdraw consent at any time for any processing based on your consent.

We will respond to any verified request within 30 days. There is no fee for exercising these rights.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you additional rights, including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of “sale” or “sharing.” We do not sell or share your personal information as those terms are defined by the CCPA. You can exercise your rights by emailing us at hello@competitivebearings.com. We will not discriminate against you for exercising these rights.

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases: contract (to provide the service you subscribed to), legitimate interests (to keep the service secure and reliable), and legal obligation (for tax and record-keeping).

Our vendors listed above are all United States companies. Where personal data is transferred to the US, appropriate safeguards such as Standard Contractual Clauses apply.

You have the right to lodge a complaint with your local supervisory authority if you believe your data has been processed unlawfully.

We use only strictly necessary cookies: an authentication session cookie (so you stay signed in) and, where enabled, a preference cookie for your settings. We do not use advertising cookies. We do not use third-party analytics that track you across sites.

If we ever add optional analytics (for example, privacy-respecting aggregate traffic measurement), we will update this policy and, where required, ask for your consent before enabling them.

We take reasonable measures to protect your information:

• All traffic to and from the service is encrypted in transit using TLS.
• Passwords are stored only as salted hashes by our authentication provider.
• Row-level security rules in the database ensure your data can only be accessed by your own authenticated session.
• We use vendors with strong security postures (Supabase and Vercel are SOC 2 audited; Stripe is PCI-DSS Level 1).

No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you and any required authorities within the timeframes required by applicable law.

The service is intended for users 18 years of age or older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

We may update this policy occasionally. When we do, we’ll update the effective date above and, for material changes, notify you by email or in-app before the changes take effect.

Competitive Bearings LLC
Email: hello@competitivebearings.com