Privacy Policy

1. Public tools and browser storage

You can browse the catalog, compare firms and use Navigator and Calculator without an account. Saved scenarios and tool continuity use browser storage. An account export or deletion does not clear storage on your devices; use the tools’ reset controls or your browser settings.

Favorites uses a one-day, HttpOnly security cookie to help moderators notice repeated activity across accounts. The server stores daily purpose-bound hashes of this browser identifier and, behind the configured proxy, the network address for up to seven days. Shared-browser or shared-network signals do not automatically establish abuse. Approved vote comments appear as Community member; removing a vote also removes its comment. Authentication uses session cookies. Optional usage events are controlled by the website’s analytics consent controls. Server and infrastructure diagnostics may include network and request information; passwords and email verification tokens must not be placed in application audit events.

2. Accounts and sessions

Supabase provides account authentication and stores authentication credentials. N73 Funding stores your profile, account preferences and security activity. Active-session information can include browser details and sign-in/activity times; browser descriptions are supplied by the client and may be incomplete.

Sensitive account actions require verification. You can sign out, sign out everywhere, or revoke another session from Account. Privileged roles are assigned through restricted administration, not public profile fields. Google sign-in is currently disabled on the public website.

3. Community and Favorites

We store reviews, revisions, votes, reports, appeals and moderation history. Reviews and edits are moderated before publication. Public reviews show the author’s public profile identity; evidence and information-request replies are restricted to the author and authorized moderators.

Deleting an account removes its authored reviews, votes, reports and replies. Minimal pseudonymous references to staff decisions may remain to preserve other users’ case history. Information another person submitted about a case is not automatically included in your personal export.

4. Contact and newsletter

Contact forms store your name, email, topic, subject and message in a private inbox. Authorized owners and administrators can add internal handling notes. Notification emails contain a reference to the inbox rather than the submitted message body.

Newsletter subscriptions require an explicit request followed by email confirmation. Signing up for an account does not itself activate a subscription. You can unsubscribe through an email link or Account. A message already being sent may finish while an unsubscribe is processed.

Newsletter status and consent events are stored separately from public profiles. Email delivery uses a private queue and Resend. Delivery providers process recipient addresses and message content for delivery. Temporary queue content is removed after successful provider acceptance; limited operational receipts remain.

5. Export and account deletion

Account provides a JSON export of the application data listed by the export control. Contact and newsletter records are matched to your currently verified account email. Internal handling notes, other people’s private evidence, authentication secrets and restricted infrastructure logs are excluded. Contact us through /contact if a request concerns a previous email address or data you cannot access through Account.

An accepted deletion request immediately blocks account access and revokes sessions. Application submissions and contact/newsletter records matched to the verified email are removed. A background task removes owned uploaded objects and erases Auth credentials and identifying metadata. If a provider is unavailable, cleanup remains pending and is retried; the account remains blocked.

A pseudonymous Auth identifier and minimal deletion/audit references remain so historical staff actions can still be attributed without preserving a usable account. The final owner must transfer ownership before self-deletion. Deletion does not immediately purge older encrypted release backups or provider-managed security logs. Those copies have restricted access and separate retention; recovery procedures must carry completed deletion requests forward.

6. Infrastructure and requests

The current website runs on a VPS. Supabase handles database, authentication and Storage; Resend handles email delivery. Authorized administrators can access the records needed to operate these features. Data may be processed in the regions used by those providers.

Use /contact for privacy questions or requests that cannot be completed through Account. We may need to verify ownership before releasing or deleting data. Response and retention commitments are not inferred from an automated success message. This notice describes the current implementation; changes to these features will be reflected here.