Privacy Policy

• Account information: your email address and the password you set (stored securely, hashed — we never see it in plain text).
• Newsletter sign-ups: the email address you submit for the free welcome issue or newsletter.
• Payment information: processed by Stripe. We receive limited billing details (such as your email, subscription status, and the last digits/brand of your card). We do not store full card numbers — Stripe handles that.
• Your tracker data: the schools you mark as planning or hide, and an optional saved location/ZIP for distance filtering.
• Technical data: basic logs and an IP address used for security and rate limiting.

• To provide, secure, and improve the Service;
• To process payments and manage your subscription;
• To send the newsletter, account, and transactional emails;
• To prevent abuse and enforce our Terms.

We do not sell your personal information. We do not share it for third-party advertising.

We rely on trusted processors who handle data on our behalf under their own privacy and security commitments:

• Stripe — payment processing and billing.
• Supabase — authentication and database hosting.
• Resend — sending email and managing the newsletter list.
• Vercel — website hosting.
• Upstash — rate-limiting infrastructure.

If you sign up for the newsletter, you consent to receive it. Every marketing email includes an unsubscribe link, and you can opt out at any time. Transactional emails (receipts, account, security) are sent as needed to operate your account.

We use essential cookies required for login sessions and security. We do not use third-party advertising or cross-site tracking cookies.

We keep your information for as long as your account is active or as needed to provide the Service and meet legal obligations. You can ask us to delete your account and associated personal data.

Depending on where you live (including under laws such as the California CCPA/CPRA and the EU/UK GDPR), you may have rights to access, correct, delete, or port your personal data, and to object to certain processing. To exercise any right, email us and we will respond as required by applicable law. We will not discriminate against you for exercising these rights.

We use industry-standard measures — encrypted connections, hashed passwords, row-level database security, and access controls — to protect your data. No system is perfectly secure, but we work to keep your information safe.

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect data from anyone under 18.

We may update this policy. Material changes will be posted here with a new date.

Questions or requests: hello@crnabound.com