Privacy Policy

1. What we collect

STRPulse collects only the data you give us, in service of the product:

• Account info: your email address and a password hash (we never store your password in plaintext)
• Your financial data: the transactions, property setup, and settings you enter or import via CSV
• Browser metadata: standard request data (IP, user agent, timestamp) for security logging via our hosting provider (Cloudflare) and database provider (Supabase)

We do not collect: your bank credentials, your CSVs as files (only the parsed transaction rows), behavioral analytics, advertising identifiers, or third-party cookies.

2. Where your data lives

Your transaction and account data is stored in Supabase (Postgres) hosted on AWS US-East. Your account is protected by Row-Level Security (RLS) at the database level — other STRPulse users cannot read or modify your data, regardless of any client-side bug.

Your CSVs are parsed in your browser. Only the resulting transaction records leave your device — the original CSV file never does.

3. How we use your data

• To make the product work (display your books, sync across your devices)
• To send transactional email (password resets, account confirmations)
• To investigate security incidents and respond to subpoenas if legally required

We do not use your data for: advertising, training AI models, sharing with affiliates, or selling to third parties — ever.

4. Third parties

We use the following service providers, each of which receives only the data necessary to fulfill its role:

• Supabase (database + auth) — stores your encrypted account and data
• Cloudflare (hosting + CDN) — serves the app, logs request metadata
• Stripe (billing, Pro-tier users only) — processes payment, stores card data on PCI-compliant infrastructure

We do not transmit your transaction data to any third party for any purpose other than storage / serving.

5. Your rights

• Access: view all your data inside the app at any time
• Portability: Settings → Export JSON Backup gives you your entire data in a portable file
• Deletion: Settings → Account → Wipe My Data deletes all your data. Account → Delete Account additionally deletes your auth record (full deletion requires emailing support during beta)
• Correction: edit any transaction, category, or setting directly in the app
• Objection / restriction: contact us to restrict processing in specific ways

6. Children

STRPulse is a business product for adults. We do not knowingly collect data from anyone under 18.

7. Changes to this policy

If we materially change how we handle your data, we'll email account holders at least 30 days before the change takes effect. The current version of this policy lives at /privacy.html.

8. Contact

Questions, requests, or complaints: email jordan@joyfamilyholdings.com. We aim to respond within 5 business days.

Mailing address: Joy Family Holdings LLC · Uhrichsville, OH (full address available on request)