Privacy Policy

What we collect

We collect the smallest amount of personal information we need to run the course and answer your questions.

• Account data: email address, optional name, and a hashed password if you choose password sign-in.
• Purchase data: the fact that you bought the course, the amount, and a payment record ID. Card numbers go to Stripe and never touch our servers.
• Course activity: which lessons you've opened, what you've marked complete, bookmarks, and notes you choose to save.
• Email engagement: opens and clicks on emails we send through Resend, plus unsubscribe state.
• Technical data: IP address and basic request headers for security and rate limiting. We do not run third-party analytics or advertising trackers by default.

How we use it

• To give you access to the course and remember where you left off.
• To send the lesson materials, course updates, and the optional newsletter.
• To process payments and provide receipts.
• To answer support emails and investigate problems you report.
• To detect abuse and keep accounts secure.

We do not sell your data. We do not share your email with advertisers.

Who we share data with

We use a small set of trusted vendors to run the service. Each one only sees the data needed for their job:

• Supabase — database and authentication.
• Stripe — payment processing.
• Resend — transactional and newsletter email.
• Vercel — application hosting.
• Vimeo — lesson video hosting.

We may disclose data if a court order, subpoena, or other legal process requires it. If we ever sell or transfer the business, your data moves with it under the same protections described here.

How long we keep it

We keep your account and course progress for as long as your account exists. Payment records stay for seven years to meet tax and accounting requirements. Email engagement data is kept for two years. You can ask us to delete your account at any time.

Your rights

You can ask us to:

• Send you a copy of the data we have about you.
• Correct anything that's wrong.
• Delete your account and personal data, except records we're legally required to keep.
• Stop sending you marketing email. You can also unsubscribe from any newsletter directly.

If you live in California, the UK, the EU, or another region with specific privacy laws, the same rights apply. Email privacy@sitstaywag.com and tell us what you want. We respond within 30 days.

Cookies

We use cookies for two things: keeping you signed in, and remembering your dark-mode preference. We do not set advertising or tracking cookies. If we ever add analytics, this section will say what tool and what data, and we'll ask first where the law requires consent.

Children

The course is built for adults. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, email us and we'll delete the account.

Security

Data is stored in Supabase with row-level security policies that prevent users from reading each other's data. Payment information goes through Stripe and is encrypted in transit. No system is bulletproof. If we ever discover a breach affecting your data, we'll notify you and any regulator the law requires within the required timeframe.

Changes

We may update this policy. When we do, we'll change the "Last updated" date at the top and, for material changes, send a notice by email or post one on the homepage. Continued use after a change means you accept the new version.

Contact

Email privacy@sitstaywag.com with any privacy questions or requests.