Privacy Policy

1. Draft status and responsible organization

This Privacy Policy is a review draft based on the application code inspected for this release. It does not establish that the application’s complete data practices, vendors, or legal obligations have been verified.

[FOUNDER/COUNSEL TO CONFIRM: the legal operator, its address, the applicable privacy roles, and the effective date of any final policy.]

2. Account and authentication information

The sign-up form collects an email address and password and sets the account name to the trimmed email address. The authentication schema includes an account password field and session records with expiration, IP address, and user-agent fields; the IP address and user agent are nullable and may not be available for every session.

The app is configured to send email-verification messages and password-reset messages through its installed Polsia email integration. The configured verification and password-reset links expire after one hour. Exact session-cookie handling, credential storage details, and authentication-data retention require confirmation before this draft is approved.

Ordinary customer registration is currently closed. The code permits the configured owner account through the registration gate, and existing accounts can use sign-in and recovery flows. This is not an open customer-registration service.

3. Readiness information users enter

For an account’s readiness work, the current data model supports effort names and preparation context; work-item requirement references, descriptions, and optional source references; customer-reported self-assessment status, notes, and next work; and family-level assessment statuses. These entries may contain information a user chooses to provide, so do not enter classified information or Controlled Unclassified Information (CUI).

The workspace organizes customer-entered information; it does not establish that entries, sources, or assessment statuses are accurate or independently verified.

4. Page-view beacon

When a deploy-provided app slug is present, the application’s page-view beacon reads or creates a visitor ID in the browser’s localStorage and sends that ID together with the app slug in a pixel request to a Polsia endpoint. The checked-in code does not establish the beacon’s retention period, downstream use, consent or opt-out behavior, or the complete recipient/vendor roles.

[FOUNDER/COUNSEL TO CONFIRM: the beacon’s purpose, data retention, analytics settings, and visitor choices, including whether localStorage or cookies require a notice or consent mechanism.]

5. Registration and checkout status

Customer registration is closed; only the configured owner account is allowed through the current account-creation gate. Starter and Pro monthly prices are approved, while checkout remains disabled until both this Privacy Policy draft and the Terms of Service are complete and founder-approved. The current checkout route returns an approval-pending response before creating a payment session. This policy does not describe a live customer billing relationship or assert that a charge has been made.

6. Recipients, retention, and security

The observed integrations include the Polsia email integration for verification and password-reset email and the Polsia page-view beacon endpoint. The repository does not establish a complete list of data recipients, vendor or processor roles, processing locations, retention periods, deletion behavior, security controls, or incident-response practices. No representation about those practices is made in this draft.

[FOUNDER/COUNSEL TO CONFIRM: all recipients and vendor roles; international transfers, if any; retention and deletion schedules for account, session, token, readiness, and beacon data; security measures; and incident handling and notice obligations.]

7. Privacy requests and choices

A privacy-request contact, response process, applicable rights, and analytics or storage choices have not been established in the repository. Do not treat this draft as a statement that a particular request channel or opt-out is available.

[FOUNDER/COUNSEL TO CONFIRM: privacy-request contact and process, data-access/correction/deletion procedures, analytics and cookie/localStorage choices, and any age-related rules.]