What we collect, why, and how long we keep it.

• We collect only what you enter (email, first name, financial numbers) plus what your browser transmits automatically (IP address, basic session data).
• We do not sell your data. We do not use your financial data to train AI models. We do not share your financial numbers with third parties.
• We use a small number of trusted vendors to run the service (Supabase for the database, Vercel for hosting, Stripe for payments). Each is contractually bound to keep your data safe.
• You can delete your financial data at any time from your profile page, and close your account entirely by emailing us. Backups age out within 30 days.

We collect three kinds of information:

1a. Account information you provide. Your email address, first name, and password. Your password passes through our servers once, when you set it, and is then stored only as a salted hash by our authentication provider; we never store it in plain text.

1b. Financial information you enter. Account balances, monthly contributions, spending targets, savings goals, birth date (only if you provide it, for age-based projections), retirement age, home equity, and the scenario configurations you save. We do not connect to your bank, brokerage, or any external financial institution. Every number in your account was typed by you.

1c. Automatic information. When you visit the site, our servers and infrastructure providers log your IP address, browser type, operating system, referring URL, pages visited, and timestamps. This is standard access-log data used for security and to keep the service running.

1d. Payment information. When you subscribe, Stripe collects your payment details directly. We receive only a subscription reference, plan, status, and the last four digits of your card. We never see or store your full card number, CVC, or bank credentials.

• To operate the service: run your projections, save your scenarios, keep you signed in, apply your settings.
• To process payments and manage your subscription (via Stripe).
• To send account-related email (confirmation, password reset, subscription notifications, service-critical updates).
• To respond to support requests you send us.
• To protect the service and its users from fraud, abuse, and security threats.
• To comply with legal obligations and enforce our Terms of Service.

We do not use your financial information for advertising, marketing, or any commercial purpose unrelated to operating the service.

We share personal information only with the vendors we rely on to operate the service, and only what each needs to do its job:

• Supabase Inc. (US) — authentication and database storage. Your account information and financial data are stored on Supabase’s infrastructure, subject to Supabase’s privacy and security terms.
• Vercel Inc. (US) — web hosting and content delivery. Vercel handles the technical serving of the website and processes server logs.
• Stripe, Inc. (US) — payment processing. Stripe collects your card details directly and provides us with a subscription reference and status. Stripe is a PCI-DSS Level 1 certified processor.
• Resend, Inc. (US) — transactional email. Resend receives your email address and first name in order to deliver account and subscription emails.
• Google LLC (US) — Google Analytics 4 on our public marketing pages only (see section 8), which receives your IP address, device and browser details, and the pages you visit; and Google Workspace, which hosts the mailbox that receives anything you send to our support addresses.
• Vercel Web Analytics and Speed Insights (US) — anonymous, cookie-less page-view counts and performance metrics across the whole site, with no user-level identifier. These are separate Vercel products from the hosting listed above.
• Have I Been Pwned — when you choose a password at checkout, your browser sends the first five characters of its SHA-1 hash to the Pwned Passwords service to check whether the password has appeared in a known breach. The password itself never leaves your browser for this check.

We may disclose information if required by a valid legal process (subpoena, court order, warrant), or if we have a good-faith belief that disclosure is necessary to prevent harm to a person or to protect the service and its users. If we ever receive a lawful demand, we will notify you unless legally prohibited from doing so.

We do not sell your personal information. We do not share your financial information with advertisers, data brokers, or any party not listed above.

If Competitive Bearings LLC is acquired, merges, or transfers substantially all of its assets, your information may be part of the transferred assets. We will notify you and honor the commitments in this policy under the new ownership.

We keep your data only as long as you have an active account, plus a short backup-retention window after deletion.

• While your account is active: all account and financial data is retained so the service works as intended.
• On data deletion (profile page): your accounts, plan, scenarios, and votes are removed from our production database immediately. Your login, email address, and subscription record remain, so you can keep using the service or cancel it. Encrypted backups age out within 30 days.
• On account closure (by email): we also delete your login, email address, and first name, keeping only the limited payment records described below.
• Payment records: we retain limited subscription records (transaction ID, plan, amount, date) for up to seven years to comply with tax and accounting requirements. These records do not include card numbers.
• Server logs: IP addresses and access-log entries are retained by our infrastructure providers for approximately 30 days for security and diagnostic purposes.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (most of it is directly editable in the app).
• Delete your data. Use the delete button on your profile page to remove your financial data, or email us at hello@competitivebearings.com to close your account and remove everything else.
• Export a copy of your data in a portable format (email us to request).
• Object to certain processing, or restrict how we use your data.
• Withdraw consent at any time for any processing based on your consent.

We will respond to any verified request within 30 days. There is no fee for exercising these rights.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you additional rights, including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of “sale” or “sharing.” We do not sell or share your personal information as those terms are defined by the CCPA. You can exercise your rights by emailing us at hello@competitivebearings.com. We will not discriminate against you for exercising these rights.

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases: contract (to provide the service you subscribed to), legitimate interests (to keep the service secure and reliable), and legal obligation (for tax and record-keeping).

Our vendors listed above are all United States companies. Where personal data is transferred to the US, appropriate safeguards such as Standard Contractual Clauses apply.

If you visit from the European Economic Area, the United Kingdom, or Switzerland, we do not load Google Analytics at all, so no analytics cookies are set and nothing is sent to Google. Vercel Web Analytics still records anonymous, cookie-less page-view counts.

You have the right to lodge a complaint with your local supervisory authority if you believe your data has been processed unlawfully.

We use strictly necessary cookies to keep you signed in and to remember your settings. We do not use advertising cookies, and we do not build cross-site behavioral profiles.

Marketing-page analytics. On every page except your Dashboard, Scenarios Lab, and Profile, we use Google Analytics 4 to measure aggregate traffic — which pages people land on, which links they follow, and roughly where visits come from. This helps us understand what content is useful and where to invest. Google Analytics sets cookies (_ga and a property-specific _ga_* cookie). Visitors from the EEA, UK, and Switzerland are excluded entirely, as described in section 7.

Google Analytics is turned off inside the app. Once you sign in and are looking at your Dashboard, Scenarios Lab, or Profile — the surfaces where your actual financial numbers are visible — Google Analytics does not load. Vercel Web Analytics and Speed Insights run on every page, including those: they count page views and measure load times without cookies or user-level identifiers, and they never see the figures you enter.

You can block Google Analytics with any standard content blocker, and the marketing pages will continue to work normally.

We take reasonable measures to protect your information:

• All traffic to and from the service is encrypted in transit using TLS.
• Passwords are stored only as salted hashes by our authentication provider.
• Row-level security rules in the database ensure your data can only be accessed by your own authenticated session.
• We use vendors with strong security postures (Supabase and Vercel are SOC 2 audited; Stripe is PCI-DSS Level 1).

No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you and any required authorities within the timeframes required by applicable law.

The service is intended for users 18 years of age or older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

We may update this policy occasionally. When we do, we’ll update the effective date above and, for material changes, notify you by email or in-app before the changes take effect.

Competitive Bearings LLC
Email: hello@competitivebearings.com