Privacy Policy

What we deliberately don't collect

Your bank account balances, transactions, credit card numbers, retirement account values, net worth, cash flow, debt amounts, real estate values, business income — by default none of this is sent to us. It all lives in plain files on your computer, and we keep no copy of your financial file. (The optional AI categorization feature below sends limited transaction details only when you switch it on, and the optional bank-support diagnostic in extension version 1.2.0 can send the start of a file, as described below.) This is the whole point of GlidePath Money.

We also don't collect:

• Bank credentials (passwords, MFA secrets, security questions) — we never ask
• Plaid, Yodlee, or any other aggregator-style integration data — we don't use those services
• Browsing history, clipboard contents, screen recordings, or any telemetry from the installed app
• Crash dumps with your data attached — the optional crash report excludes anything from your DataFolder
• Financial app data in marketing analytics — website tags measure site visits and ad conversions only, not your desktop data file, transactions, balances, or imports

What we do collect

The minimum needed to operate the service:

• Your email address — used as your license identifier
• A license key we generate and email you — used to authenticate the installer
• Device records for your license — at activation (and on the app’s weekly re-verify) we store a device identifier, the device’s name, and its operating system, so the per-license device cap works and the in-app /License page can show you each device and let you remove one
• Payment information — processed by Stripe (stripe.com). Stripe handles your card details directly; we never see your card number. Sales tax + Canadian GST are calculated and filed automatically by Stripe Tax. QuickTech LLC (dba GlidePath Money) is the seller of record. When you complete a checkout, Stripe sends our server the checkout’s details, which include your name, email and billing address. We keep only what we need to deliver and support your license: your email and the order itself (what you bought, the amount, its status, and Stripe’s IDs for the checkout, the payment, your Stripe customer record and any subscription), plus, if the purchase followed one of our Google ads, the ad-click record described under Cookies + analytics. If a checkout ever reaches us without a usable email, our Worker’s error log keeps its details for up to 7 days so we can sort it out with you.
• A checkout you don’t finish — Stripe expires an unpaid checkout after about a day. Our server then reads it from Stripe: the email it carries (the one you entered on our pricing page or at checkout), what you were buying, and when you started. Unless you already have a license, we may send you one reminder through Resend. We keep a record of the checkout, whether or not we sent a reminder, for 90 days so we don’t remind you about it again, then delete it automatically. Rarely, if a send fails partway through, it is retried, so a second copy can arrive.
• Optional feedback you submit via the in-app Feedback button — the report type you pick, your message, your name and a reply email if you give them, the app version, and the User-Agent your browser sends with the request (its browser and operating-system version). The app doesn’t attach anything from your financial data. The form asks you to leave out account numbers and balances, but it can’t stop them from being typed, so please keep them out of your message.
• Optional crash reports if you click "send report" on an error page — stack trace, app version, page URL. Excludes data folder contents.
• Refund requests you start on the refund page — the email address you enter, the kind of refund you pick, and any note you add. We use them to find the charge, confirm the request with you, and process the refund.
• IP address at legal acceptance — when you accept the legal documents on the in-app /Accept screen, we record the IP address you connected from alongside the timestamp. One row per (document, version) you accept. This is the audit trail that proves which version of each document was in effect when you agreed.

What gets emailed (and where it goes)

We use Resend (resend.com) as our outbound email provider for sending welcome notes, license keys, a reminder if you don’t finish a checkout, the weekly digest if you turn it on, the confirmation and follow-up emails about feedback you send, emails about a refund request, the alerts about purchases, refund requests and reports that we send to our own support mailbox, and other operational replies. Resend keeps a log of each email it sends, including its content and recipient, under Resend’s own retention policy. Our domain SPF/DKIM records are configured per Resend's standard setup.

Replies to in-app feedback. If you add a reply email to a feedback report, we send a confirmation email with your report’s reference when we can (a sending limit can skip it). Later we may send one follow-up for each outcome: fixed in a named version, won’t fix, can’t reproduce, or a request for more detail. These go out through Resend. We may also write to you about the report from our support mailbox, [email protected], hosted by Zoho Mail (described below), for example to answer a question you sent; that email, with your address, stays in the mailbox like other support email. We use the address only to write to you about that report. We clear it, and your name if you gave one, from the stored report 30 days after we close the report as fixed, won’t fix or can’t reproduce (a request for more detail doesn’t close it, and if we close it again later, including to retry a closing email that may not have gone out, the 30 days count from that later close), or one year after you sent it, whichever comes first. Reply “stop” to any of these emails and we’ll remove the address and your name from the report and stop writing to you about it; copies already in our support mailbox stay there until we delete them. Replies you send us reach our support mailbox and are kept like other support email.

When you send feedback or a crash report, we also email a notification through Resend to our support mailbox at [email protected], hosted by Zoho Mail (described below). The notification carries only the report’s reference, its type, and the app version: not your message, name, or reply email, and none of a crash report’s details. We read the report itself from our database. Resend’s send log keeps each email we send through Resend, as described above: the notification, and any confirmation and follow-up emails we send to a reply email you gave (those include that address). Clearing or removing the address from the stored report doesn’t remove it from Resend’s log, or from any email we wrote to you from our support mailbox.

Refund requests. When you submit a refund request, we email an alert through Resend to the same support mailbox, [email protected]. Unlike a report notification, this alert does carry personal information: the email address you entered (in the subject and the body, and set as the reply-to address so we can answer you directly), the kind of refund you picked, any note you added, and our reference for your license record when the address matches one. We send it whether or not the address matches a purchase. As the request moves along, we send further alerts to that mailbox when you confirm the request and when we submit the refund to Stripe. Those carry your email address (again as the reply-to address) and our reference for your license record, and the last one adds the refund’s amount and Stripe’s IDs for the charge and the refund; they don’t repeat your note. The emails we send you about the request (the confirmation link and the refund-submitted notice) also go out through Resend. Refund alerts stay in the support mailbox until we delete them, like other support email.

Purchases and renewals. When you buy a license, renew maintenance, or upgrade to Business, we email an alert through Resend to the same support mailbox, [email protected]. It carries your email address, our reference for your license record, the amount you paid, and Stripe’s ID for the checkout. A new-purchase alert also names the license tier, says whether your license email went out (and the error, if it didn’t), and says whether you arrived from one of our Google ads (yes or no, not the ad click ID); a renewal alert adds the date your maintenance now runs to. If your license email fails at first, we send a second alert when it is delivered, with your email address, the tier, our reference for your license record, and Stripe’s ID for the checkout. If a payment goes through but we can’t apply it (for example, a renewal for a license that is no longer active), we send an alert there too, so we can sort it out with you. That alert carries the amount, Stripe’s ID for the checkout, and why the payment couldn’t be applied (such as the license’s status), plus our reference for your license record and your email address when we have them. These alerts stay in the support mailbox until we delete them, like other support email.

Mail to [email protected] or [email protected] is delivered to our support mailbox, hosted by Zoho Mail (zoho.com/mail) on US-region servers. Those messages, and the replies we send from the mailbox, stay there until we delete them. We use Zoho only as our email host: for this correspondence, for any email we write to you from hi@ about a feedback report you sent (addressed to the reply email you gave with it), for the report notifications, refund alerts and purchase alerts described above, and for the bank-support diagnostic alerts described next. Zoho handles all of it under its privacy policy. Zoho is listed on /subprocessors.

Bank-support diagnostic alerts go to their own address. When an opted-in diagnostic is accepted, our server sends an alert through Resend to [email protected], which is delivered to the Zoho Mail support host described above. The alert contains only the listed bank domain, fixed fields and counts if the extension supplies valid ones; version 1.2.0 supplies no counts. Until October 23, 2026, these alerts went to an operator mailbox hosted by Microsoft 365, which keeps the alerts it received until we delete them. Before our server changed, these alerts could carry the file’s first line, the download address and full site name described below. We deleted the old-format alerts we found in that mailbox and set a rule to delete any that arrived late. Microsoft 365 is listed on /subprocessors.

Weekly digest email (optional, opt-in)

The weekly digest email is off until you turn it on in the app. When it is on, the app asks our Worker to email it to you through Resend. It carries a first name, the date range and an activity summary, with amounts, balances and account names left out unless you also switch on detailed emails; with detailed emails on, the summary can include them. Like every email we send, it stays in Resend’s send log under Resend’s own retention policy.

AI categorization (optional, opt-in)

The in-app Categorize with AI page can suggest categories for uncategorized transactions. When you click it — and only then — the app sends, for each transaction in the batch you chose: the payee text, the amount, the date, and a high-level account type (like “Liquid” or “Business” — never the account’s name, its balance, or whose it is), plus your category names so the suggestions speak your vocabulary. That goes through our Cloudflare Worker to Anthropic’s Claude API, which processes it under their commercial API privacy commitments — they do not train on this traffic.

We don’t store the transactions: the Worker forwards the batch, returns the suggestions, and keeps only a monthly usage count (so the included cap works). Every result comes back as a suggestion — nothing is written to your file until you confirm it in the app. The feature requires active maintenance. Don’t click it and nothing is sent.

Browser extension — help improve bank support (optional, opt-in)

The GlidePath browser extension observes browser downloads and qualifying CSV/PDF blobs on every HTTPS page of an enabled bank host, including sign-in and account pages. Version 1.2.1 forwards a page-generated CSV/PDF blob only after a real export or statement action and a matching Chrome download; opening an inline viewer alone does not forward it. An installed 1.2.0 copy can capture a qualifying blob without that action. To recognize export actions, its content scripts inspect the activated control's label, title and button value, which can contain balance text. They do not inspect login/password entries or scrape separate balance elements, and the extension does not ask for your bank password. Captured files and bank-page metadata go to the app address you set in the extension: http://localhost:5000 by default, or a remote address you choose, which receives them over the network. A CSV capture can include a bank download request URL with an authentication token. If the app address cannot be reached, version 1.2.1 may hold a CSV and its filename, bank name, bank-page URL and title, download request URL, and account last four only in memory-backed browser-session storage. Retry eligibility ends after seven days; expired copies are removed at the next queue check, which Chrome can delay. A browser restart or extension reload, update or disable clears the copy sooner. If the extension reports a CSV as held, it first records a non-sensitive recovery marker; after a restart, the next queue check uses that marker to show a notice pointing to the downloaded file for manual import. If the marker cannot be recorded, the extension reports that the copy was not held and directs you to Downloads immediately. The 26th held file displaces the oldest; expiry and displacement also show manual-import notices. On its next run, 1.2.1 removes older held copies left in persistent browser-local storage by 1.2.0 and shows a manual-import notice. Until an updated extension runs, a 1.2.0 held copy can remain past seven days if the browser is closed or the extension is disabled. You can clear queued copies or turn off holding; a request already sent may still reach GlidePath. PDF captures are not held for retry.

Version 1.2.1 also keeps short-lived bank-download records in browser-session storage: a bank tab’s download address and bank name, and, for a POST download, its request address, POST request body and content type. A bank download address or request body can contain account identifiers or tokens. The extension uses these records to pair or replay a download after its service worker restarts. A timer removes them after about one minute, although Chrome may delay the timer; checking an expired record or starting the worker also removes it. A browser restart clears the records.

Separately, the extension sends an automatic bank-support diagnostic to our API only if you turn on one optional setting, off by default, called “Help improve bank support.” If you turn it on, an unrecognized file from a bank already enabled in the extension may send us a diagnostic about the failed capture. Banks that are not enabled use the manual popup or Downloads path and do not send an automatic failed-capture diagnostic. To request a new bank, email [email protected]; you can choose whether to send a sample export. What an automatic diagnostic contains depends on the extension’s version:

• Version 1.2.0, published in June 2026 and the first published version with this setting, sends some text from the file and the page:
  • the first line of the file, up to 500 characters, unless those 500 characters contain a dollar sign directly before a number (such as $12) or a date written like 1/2/2026 or 2026-01-02. It is meant to be the column names, but it can be a line the bank puts above them, such as an account name or number, or, in a file with no header row, all or part of one or more transactions, such as their descriptions or amounts (a file whose lines end in a carriage return alone counts as one line);
  • the download address. When the extension caught the full address, the value of each query parameter is replaced, and so is any part of its path made only of three or more digits or of a long code using only the digits 0–9 and the letters a–f. When it caught only part of the address, only runs of three or more digits are replaced. Everything else is kept, so it can include a name, an email address, or a code the bank uses for your account or session. If the bank hands over the file as a data: address, which carries the file’s contents in the address itself, the address holds up to the first 1,000 characters of the file, transactions and amounts included;
  • the full name of the site the file came from (the page’s or the download’s), which can include your name, for example a personal bank address such as yourname.examplebank.com, or a site whose name merely ends in a bank’s;
  • the file type as the site labels it, which can include extra text such as a file name, the outcome, how the extension caught the file, the extension version and your browser.
• Versions after 1.2.0 send no text from the file or the page, only the short list below.

Our server allows the same limited fields for every version. It builds what it stores, and the alert email we send ourselves about it, from fixed lists and, when supplied and valid, up to two counts. It ignores everything else a diagnostic carries, including all of the text above. Version 1.2.0 does not supply either count. The fields we may keep are:

• the bank, named only by its domain as it appears on our own fixed list of the banks and brokerages the extension knows, never by the address itself: a page at yourname.chase.com is recorded as chase.com, and a site not on that list is recorded as no bank at all;
• up to two counts, when the extension supplies them: how many columns the file has, and how many parts the path of the download address has;
• the file type, the outcome, how the extension caught the file, your extension version and your browser, each from a fixed list or a fixed short form.

Before our server worked this way, it kept the first line of the file, the download address and the full site name it received, and put them in its alert email. We have deleted every diagnostic it stored that way. We also delete the alert emails it sent to our Microsoft 365 operator mailbox about them: we deleted the ones we had, and because an alert sent just before our server changed could be delivered later, we set a rule in that mailbox to delete any more of them as they arrived. Copies outside that deletion are subject to provider retention: Resend’s send log keeps its copy of each email under its own retention policy, as described above; Microsoft 365 may retain deleted mail in Deleted Items or recoverable storage according to our tenant settings and any holds; and Cloudflare keeps a point-in-time recovery history of our database for up to 30 days. We don’t restore from any of them to bring them back. So the diagnostics we store, and the alerts we now send about them, don’t include your transactions, amounts, balances, account numbers, the page title, cookies, or anything that identifies you, and we don’t link them to your license or email address. The diagnostic travels in the body of the request, which our Worker’s request log doesn’t record. Leave the setting off (the default) and the extension never sends us a diagnostic on its own.

You can also send a diagnostic by hand. The extension’s “Copy diagnostic” button puts it on your clipboard, and you see the text when you paste it; later versions can also open a prefilled email asking us to add your bank in your email app, where you see the text before you send it. Neither sends anything on its own. What you send that way reaches our support mailbox like any other email, exactly as you send it: our server’s clean-up doesn’t apply to email. In version 1.2.0 the copied text is the diagnostic described above, so read it before you send.

In version 1.2.1, the extension saves the last capture time and the most recent unmatched-file diagnostic in its browser-local storage even when “Help improve bank support” is off. The saved diagnostic contains the fixed fields and counts described above, with no text from the file or bank page; it lets the popup’s Copy diagnostic button work without turning on automatic sending. The capture time and diagnostic remain until replaced by a later capture or diagnostic, respectively, or until you remove the extension. Neither is sent to us automatically while the setting is off; you can still choose to paste a copied diagnostic into an email.

Live market prices (optional)

If you track holdings and tap Refresh, the ticker symbols (e.g. AAPL, VTI) are sent through our Cloudflare Worker to a market-data provider (Yahoo Finance) to fetch current prices. Only the symbols leave your machine — never quantities, cost basis, or account info — and we don’t save them in our database. Our Worker’s request log, which Cloudflare keeps for up to 7 days, records the address of each lookup, and that address includes the symbols. Results are cached about 15 minutes at the edge. Don’t tap Refresh and nothing is sent; you can also enter prices by hand. The provider is listed on /subprocessors.

Where things are stored

One consequence worth stating plainly: the app’s weekly license check reads your customer record. If that record is deleted — after a refund or termination, or because you ask us to delete it — the check can no longer succeed, and the installed app will stop opening. Your data files on your disk stay exactly where they are either way.

Children’s privacy

GlidePath Money is intended for adults 18 years or older. We do not knowingly collect personal information from individuals under 18. If we discover we have inadvertently collected such information, we will delete it. If you believe a minor has provided us information, please contact [email protected] and we will remove it promptly.

Automated decision-making and Glide AI

We do not make automated decisions about you that produce legal or similarly significant effects. We do not profile you. The optional Glide AI helper (powered by Claude Haiku via Anthropic) generates conversational responses to conceptual questions you ask — for example, “what is a Roth conversion?” or “why is this Monte Carlo range so wide?”. It does not make decisions about your account, your license, or your access to the service. It never sees your transactions, balances, or holdings. You can disable Glide AI at any time in app settings. See the subprocessors page and security page for the technical details.

Your rights

Regardless of where you live, you have the rights below. Where applicable state, provincial, or federal law gives you additional rights, those are listed in the region-specific sections that follow.

• Request deletion. Email [email protected]. We delete your customer record + Cloudflare resources typically within 7 days, and no later than 30 days from a verified request, along with the ad-click record for your purchase, if there is one (see Cookies + analytics). Payment records that we’re legally required to retain for tax purposes (7 years under US tax law) are held by Stripe as our payment processor — see Stripe’s privacy policy for their retention and deletion process.
• Request a data export. Same email. We send back the exact contents of your customer row, any refund requests you made, the ad-click record for your purchase, if there is one, the other records about you that the storage table above lists (such as device records, legal-acceptance records and unfinished checkouts), and any feedback we can match to you. Feedback isn’t linked to your license, so we can find a report only by the reply email you gave with it, while we still hold that address, or by its reference, if you have it (our confirmation email carries it, if you received one). The same applies when you ask us to delete your feedback. (Your financial data is on your computer; we have nothing to export.)
• Disable optional collection. The in-app Feedback button and crash-reporter are off unless you click them. With every optional feature left off, the only things that leave your machine are the license check, the update check, and a one-time receipt when you accept the legal documents — all described above.
• Correct inaccurate information. If your email or other record data is wrong, email us and we’ll fix it.
• Withdraw consent for any optional collection (feedback, crash reports) at any time, with no effect on your license.

Where we offer GlidePath Money

At this time, GlidePath Money is offered to customers with a billing address in the United States or Canada. Stripe Tax gates checkout to jurisdictions where we hold tax registration; non-US/non-Canadian billing addresses can’t complete a purchase. We do not currently serve customers in the European Union, United Kingdom, or other regions because the app’s tax-modeling and retirement-planning features assume U.S. tax rules; we’d rather not sell you a tool whose core calculations don’t fit your situation. Canadian users: please see the “For Canadian customers” note at the bottom of the tax disclaimer.

Your privacy rights — U.S.

If your U.S. state privacy law gives you rights to access, correct, delete, export, appeal, or opt out of certain processing, we honor those rights where they apply to us. State privacy laws are expanding quickly, so we apply the same practical request process below instead of making you wait for a formal policy update.

What those rights mean, in plain English:

• Ask what we have. “What personal info do you hold about me?” Email us; we’ll tell you. (Formally: right to know / access.)
• Ask us to delete it. “Get rid of my customer record.” We do, within 30 days, along with the ad-click record for your purchase, if there is one. Some payment records we’re legally required to keep for tax purposes (7 years under US tax law); those stay with Stripe only as long as the law requires. (Right to delete.)
• Ask us to fix something. “My email is wrong.” We fix it. (Right to correct.)
• Ask for a copy in a portable format. We send it. (Right to data portability.)
• No discrimination. Asking us to do any of the above doesn’t affect your license, your price, or anything else. (Right to non-discrimination.)
• Opt out of selling, sharing, targeted advertising, profiling. We don’t do these — see the section below — but the right exists in case anything ever changes.

Do Not Sell or Share My Personal Information

We don’t sell your personal information for money. We also don’t use your financial app data for ad targeting. The marketing site loads a Google Ads tag on every page for visitors outside the EU, EEA, UK, and Switzerland, to measure the page visits, downloads, and purchases our ads lead to, as described in Cookies + analytics below. That tag is separate from the installed app and does not receive your financial file, transactions, balances, imported files, license key, or anything from your DataFolder. The customer record we do hold is used to operate, bill, secure, and support the service. If an applicable privacy law treats our marketing-site conversion tag as sale, sharing, targeted advertising, or profiling, we will honor the opt-out rights and browser signals required by that law.

How to actually exercise your rights

Email [email protected] and tell us what you want. We respond within 30 days. If we need more time (the law lets us extend by 30 more for genuinely complex cases), we’ll tell you in advance, not after. We verify your identity by matching the email against your license; if we can’t verify, we’ll ask for what we need — we won’t quietly deny.

If you think we mishandled a request, you can complain to your state’s attorney general or to the Federal Trade Commission. We’d rather you tell us first so we can fix it.

Your privacy rights — Canada

If you’re a Canadian customer, you have rights under PIPEDA (the federal privacy law) and, if you live in Quebec, the stronger Law 25 (think GDPR-ish). British Columbia, Alberta, and other provinces have their own laws that apply where relevant.

What those rights mean, in plain English:

• Ask what we have. Email us; we’ll tell you.
• Ask us to fix it. We fix wrong information.
• Withdraw your consent for anything optional (feedback, crash reports) at any time. Doesn’t affect your license.
• Quebec residents under Law 25 also have the right to receive your data in a normal portable format, and the right to know if we make automated decisions about you. We don’t make those; if that ever changes, we’ll tell you.
• Complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner. We’d rather you tell us first.

Email [email protected]. We respond within 30 days, as PIPEDA requires. Requests in French are welcome from Quebec residents.

Where your data physically lives

Practical reality: our infrastructure runs on Cloudflare’s global edge network, and Anthropic (for the Glide AI helper) and Resend (for outbound email) are based in the United States; our support mailboxes are hosted on Zoho Mail’s US-region servers. If you’re a Canadian customer, your customer record + any feedback or crash report you submit will be processed on servers that may sit in the U.S. By using the service you’re consenting to that. We rely on the standard vendor safeguards for the transfer. The full vendor map is at /subprocessors.

Cookies + analytics

The marketing site (glidepathmoney.com) uses Cloudflare Web Analytics — a privacy-first, cookieless measurement tool that counts page views and referrers without cookies, fingerprinting, cross-site tracking, or any personally identifying data (visitors in the EU are excluded entirely). For visitors outside the EU, EEA, UK, and Switzerland, the marketing site also loads a third-party ad-conversion tag — Google Ads — to measure the page visits, downloads, and purchases its ads lead to; it’s described below. This website tag is not part of the installed desktop app, and it does not receive your financial file, transactions, balances, account history, license key, imported files, or anything from your app data folder.

We also count a few selected site actions on the marketing site: a buy-button click, a download start, arrival at the post-checkout thank-you page, and aggregate milestones for a named public product video (visible, started, reached 25%, 50%, or 90%, completed, or a click on its displayed next step). We send a small cookieless event to our own server (not a third-party). Each event records only the action, the page path, a coarse label (a plan, flow, or public video name), one fixed number that goes with that action (the plan’s price, or the 25%, 50%, or 90% video milestone — never how far into a video you actually got), the referring site’s domain, campaign tags from the link you followed, and a country code. To keep those campaign tags attached when you move from a landing page to Download or Pricing, the site may keep the campaign labels in this browser tab’s temporary session storage; it is not a visitor ID and it clears when the tab session ends. The event dataset contains no cookie, device or visitor ID, or IP address; nothing in the event identifies you — just aggregate counts so we can see how many people who look end up buying. It runs on our own infrastructure (Cloudflare Analytics Engine), not a marketing vendor.

Google’s ad tag. For visitors outside the EU, EEA, UK, and Switzerland, every page of the marketing site loads Google Ads’ gtag (a small Google script that reports visits and conversions to Google Ads), whether or not you came from a Google ad, so Google can attribute page-load, download, and completed-purchase conversion events to its ads. When you start an installer download, and again on the post-checkout thank-you page for a normal license purchase, the site sends Google a conversion event (the download or the license purchase). Like any page view, the tag also sends Google the page’s address; on the thank-you page, that address includes Stripe’s ID for your checkout. It does not send your financial file, transactions, balances, account history, imported files, license key, or anything from the desktop app. Unlike the rest of the site, it sets first-party cookies in your browser to connect an ad-referred visit to a later purchase — so we don’t load it at all for visitors in the EU, EEA, UK, or Switzerland, the same line we hold by excluding the EU from our cookieless analytics.

The ad click ID. When you click one of our Google ads, Google adds a click ID (a code that identifies that ad click) to the link. In every region, the site keeps that click ID in this browser tab’s temporary session storage so it can travel with your checkout to Stripe.

Our record of an ad-referred purchase. If you then buy a license, we keep a record in our own database: the click ID, the amount and currency, the license tier, the time, and Stripe’s ID for the checkout. That record sets no cookie and holds no name or email, but your customer record stores the same checkout ID, so we can match it to your purchase. The record exists so we can report the purchase to Google Ads as an offline conversion (telling Google afterwards that an ad click led to a purchase: the click ID, amount, currency, time, and checkout ID). Nothing deletes it on a schedule; when you ask us to delete your data, we delete it along with your customer record. Separately, the purchase alert we email to our support mailbox, which carries your email address, says yes or no to whether the purchase followed one of our ads; it doesn’t include the click ID.

Changes to this policy

If we change anything material, we'll email everyone with an active license at least 30 days before the change. The current version is dated at the top.

Contact

Privacy or data requests (deletion, export, questions about this policy): [email protected]. General product questions: [email protected].