Privacy

Privacy Policy

This starter policy explains the data flows currently implemented in the v1 app. It should be reviewed by counsel before public launch.

Information processed

The app processes product URLs, product descriptions, generated verdicts, saved watchlist items, price-alert requests, billing status, audit events, and rate-limit counters.

When Supabase Auth is configured, the app also processes the email address used for magic-link sign-in.

Cookies and account storage

Anonymous mode uses an HTTP-only visitor cookie to keep saved items and quota separate from other visitors.

Signed-in mode uses the verified Supabase user id as the server-side ownership key for watchlists, price alerts, billing status, and quota.

Service providers

OpenAI provides server-side analysis. Neon stores app data when configured. Supabase provides authentication when configured. Lemon Squeezy processes subscriptions as merchant of record when billing is enabled. Vercel hosts the Web/PWA deployment.

Security posture

Provider keys stay server-side. Mutating browser routes reject mismatched origins. The readiness endpoint reports launch configuration without exposing secret values.