⚠ DRAFT — attorney review before publishing. Confirm it matches what your deployment actually collects and your obligations (state privacy laws; GDPR if you serve EU users). Replace every [bracketed] item.

Privacy Policy

Effective date: [DATE PUBLISHED]

1. What we collect

From you: your email and a hashed password when you sign up; payment details when you subscribe (handled by Stripe — card numbers never touch our systems); your saved watchlist; and support emails you send.
Automatically: a session cookie to keep you logged in, and basic security/usage logs (IP, feature usage, valuation counts to enforce plan limits). Analytics: [NONE yet / specify before adding one — prefer a cookieless option like Plausible].

2. How we use it

To run the service, authenticate you, enforce plan limits, process subscriptions, respond to support, and (if you opt in) send the weekly digest. That's the list. We do not sell or rent your information, and we run no third-party advertising.

3. Who else touches it

Service providers only, each for its function: Stripe (payments), [email provider], and our hosting provider. Each has its own privacy policy. We disclose information only if legally compelled (subpoena, court order).

4. Retention

Subscriber records: while your account is active, plus [7] years for payment/tax records. Marketing emails: until you unsubscribe. Every non-transactional email includes an unsubscribe link.

5. Your choices

Email [hello@yourdomain] to access, correct, or delete your information. Unsubscribing stops all non-transactional email. Deleting your account removes your contact info from active systems within [30] days (payment records retained as required by law). Depending on your state or country you may have additional rights to access, correct, or delete data.

6. Security

Passwords are hashed and traffic is served over HTTPS; access to subscriber data is limited to the operator with unique credentials and 2FA where available. No system is perfectly secure; we will notify affected users of a breach as required by law (including Va. Code § 18.2-186.6).

7. Children

The service is for adults (18+). We do not knowingly collect information from anyone under 18.

8. Changes

We'll post changes here and update the effective date; material changes get an email notice.

9. Contact

[COMPANY LLC / Donovan Isaiah Corbin], Glen Allen, VA area, [hello@yourdomain].