Privacy policy

The short version

We collect the minimum needed to run a client portal service: your email address, the portals and files you create, and payment status. We do not sell data, we do not run ad trackers, and your clients never need to hand us anything beyond the files they upload to your portal.

What we collect

• Account data: your email address, used for sign-in links and upload notifications.
• Portal data: client names, project names, logos, milestones, and the files exchanged through your portals.
• Billing data: handled by Stripe. We store your subscription status but never see your card number.
• Client data: people who open a portal link do not create accounts. We store the files they upload and the name of the uploaded file, nothing else about them.

How we use it

To provide the service: authenticate you, store and deliver files, send sign-in links and upload notifications, and process billing. We do not sell or rent personal data, and we do not use your files for anything except storing and delivering them.

Where it lives

Data is stored with our infrastructure providers: Supabase (database and file storage, US region), Railway (application hosting), Stripe (payments), Resend (transactional email), and Cloudflare (network security). Each processes data only to provide their service to us.

Cookies

We use cookies only to keep you signed in. There are no advertising or cross-site tracking cookies, which is why there is no cookie banner.

Access and security

Each portal lives behind its own unguessable link, and you can pause or delete a portal at any time. Files are stored privately; downloads are authorized per request rather than served from public URLs.

Retention and deletion

Deleting a portal permanently deletes its files. If you want your account and all associated data deleted, email us and we will do it.

Changes and contact

If this policy changes materially, we will post the update here with a new date. Questions? Email [email protected].