Privacy Policy

Draft — legal review required. This page is not approved for a paid production launch. The controller identity, retention periods, data-subject contact, and complete processor disclosures still need confirmation.

The text below describes the repository's current source and intended flows. It does not confirm which services or functions are enabled in production.

Information handled by the website

The account page uses Supabase Auth for account registration and sign-in. The public account flow does not start online checkout. A legacy server function capable of creating hosted Stripe sessions remains in source; its deployment and disabled state must be verified separately.

The contact form is designed to send submitted contact details, consent, and a Cloudflare Turnstile token to a server-side function. Review submissions are associated with an account and are intended to remain private until approved. Production submission and retention are not verified.

Subscription and download access are designed to rely on server-side Stripe webhook state and Supabase entitlement checks. No verified desktop installer is published by this website.

Service providers and data location

The source code integrates Supabase, Stripe, and Cloudflare Turnstile. Production project identity, enabled services, data locations, retention schedules, and any additional processors must be confirmed before this description can be treated as complete.

Choices and requests

Account, contact, review, and billing records may be processed by the services described above. The final policy must identify the responsible legal entity and provide a verified channel for privacy requests before launch.

Before this policy can take effect

Legal review must confirm the controller, applicable jurisdictions, lawful bases, retention and deletion rules, international transfers, processor terms, and privacy contact. Do not rely on this draft as legal advice or as an approved notice.