PRIVACY POLICY

Account data. Your email address and a password (stored only as a one-way cryptographic hash — we never store plaintext passwords).

Payment data. Payments are processed entirely by Stripe, Inc. We never see, collect, or store your card number. Stripe provides us with your customer ID, subscription status, and billing period dates.

Usage data. Session tokens (to keep you signed in) and standard server logs (IP address, timestamps, requested paths) retained for security and operations.

Desk chat. Messages you send to the in-app desk chat are processed to generate a response (see Section 3).

We use a single strictly-necessary session cookie (httpOnly) to authenticate you. We do not use analytics, advertising, or tracking cookies, and we do not sell personal information.

We use your data to provide the Service, process billing, secure the platform, and respond to support requests. We share data only with the processors needed to operate:

• Stripe, Inc. — payment processing and subscription management;
• DigitalOcean — hosting infrastructure (servers located in the United States);
• OpenAI — processes desk-chat messages and news-event content to generate responses. Do not include sensitive personal information in chat.

We do not sell, rent, or share your personal information with advertisers or data brokers.

Account data is retained while your account is active. If you cancel, your account and billing linkage are retained for up to 24 months for record-keeping and fraud prevention, then deleted. Server logs rotate within 90 days.

Depending on your jurisdiction (including GDPR and CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email support@tapesquawk.com. We respond within 30 days. California residents: we do not sell or "share" personal information as defined by the CPRA.

We use TLS encryption in transit, hashed password storage (scrypt), httpOnly session cookies, and Stripe-hosted payment pages so card data never touches our servers. No method of transmission or storage is 100% secure; if a breach affects your data, we will notify you as required by law.

The Service is operated from the United States. If you access it from elsewhere, you consent to the transfer and processing of your information in the United States.

The Service is not directed at anyone under 18, and we do not knowingly collect their data.

We may update this policy from time to time. Material changes will be posted here with an updated date. Continued use after changes take effect constitutes acceptance.

Privacy questions and requests: support@tapesquawk.com.