Privacy Policy

Effective July 6, 2026

What we collect

  • Account data: email, name (optional), hashed password.
  • Product data: your saved searches, watchlist entries, deal notes, and calculator inputs you choose to save.
  • Billing data: handled by Stripe. We never see or store card numbers, only Stripe customer and subscription identifiers.
  • Usage data: standard server logs (IP address, user agent, pages requested) kept for security and debugging.

What we do with it

Run the service, send the alert emails you asked for, process payments, prevent abuse, and fix bugs. We do not sell or rent personal data, and we do not use it for third-party advertising.

Every processor that touches your data

  • Supabase — database and authentication hosting.
  • Stripe — payment processing.
  • Resend — alert and account emails.
  • Vercel — application hosting (when deployed).
  • Cloudflare — network/CDN when a tunnel or proxy is in front of the app.

Each processor receives only what it needs for its job, under its own privacy terms. If this list changes, this policy is updated first.

Cookies

Session cookies keep you signed in. No cross-site tracking cookies, no ad pixels, no analytics beacons.

Your rights (GDPR, UK GDPR, CCPA, and similar)

Wherever you live, you can access, correct, export, or delete your personal data, object to or restrict processing, and (where applicable) lodge a complaint with your supervisory authority. California residents additionally have the right to know, delete, correct, and opt out of "sales" or "sharing" (we do neither), without discrimination for exercising those rights. To exercise any right, email support@thebidhawk.com from your account address — we respond within 30 days. Account deletion is also available directly from Settings.

Retention and security

Account data lives as long as the account, then is erased within 30 days of a deletion request. Server logs rotate within 90 days. Passwords are hashed by Supabase Auth, transport is TLS everywhere, and row-level security scopes every database row to its owner.

Children

The service is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.

Changes

Material changes are emailed to account holders 14 days ahead. Contact: support@thebidhawk.com, Capped Out Labs LLC.