Privacy Policy

Last updated: 30 July 2026

This is a starting template, not legal advice. Before you launch commercially, have it reviewed by a qualified lawyer and fill in the bracketed placeholders (company entity, address, governing law and contact details).

This Privacy Policy explains how [Company legal name] ("we", "us") collects, uses and protects personal data when you use Project Profit Tracker (the "Service").

1. Data we collect

Account data: your name, email address and hashed password.
Workspace & Customer Data: organization name, projects, clients, budgets, revenue, expenses, invoices and team/resource details you enter.
Technical data: a session cookie to keep you signed in, and limited security logs (e.g. failed sign-in attempts) used to protect accounts.

2. How we use it

to provide, secure and operate the Service;
to authenticate you and protect against abuse;
to communicate service and account information;
to process payments when paid plans are enabled.

We do not sell your personal data, and we do not use your Customer Data for advertising.

3. Cookies

We use a single essential, httpOnly session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.

4. Where your data is stored

Data is stored in a managed PostgreSQL database (Supabase) and processed by the sub-processors needed to run the Service (hosting and, when enabled, a payment processor). These providers process data on our behalf under their own security and privacy commitments.

5. Security

We take reasonable measures to protect your data, including hashing passwords and session tokens, encrypting connections (TLS), enforcing workspace-level access control, and rate-limiting sign-in attempts. No method of transmission or storage is completely secure.

6. Data retention

We retain Customer Data while your workspace is active. When you delete a workspace, its data is removed from our primary systems; residual copies may persist in backups for a limited period before being overwritten.

7. Your rights

Depending on your location, you may have rights to access, correct, export or delete your personal data. You can export your data as CSV and delete a workspace from Settings at any time. For other requests, contact us at [contact email].

8. Children

The Service is not directed to children and is intended for business use by adults.

9. Changes

We may update this Policy and will revise the "Last updated" date above. Material changes will be communicated where practicable.

10. Contact

Privacy questions or requests: [contact email].