Privacy Policy

Last updated: [DATE]

DRAFT - pending legal review. This is a working draft describing what the Service actually collects today, not final legal text. It has not yet been reviewed by an attorney and should not be relied on as-is before public launch.

1. What We Collect

When you create and use a LeVerrier account, we collect:

Data	Why
Email address	Account identification, login, password reset, optional daily newsletter
Password	Stored only as a one-way cryptographic hash (bcrypt) - we never store or can see your actual password
Topic & region preferences	Personalizes which risk topics/regions you see on the dashboard and in the newsletter
Newsletter opt-in status	Whether you receive the daily digest email
Login timestamps	Basic account security/activity record
Terms of Use acceptance timestamp	Record that you agreed to our Terms at signup

2. What We Don't Collect (Today)

No payment or billing information - the Service does not currently process payments.
No third-party advertising or analytics trackers/cookies. We use a single functional session cookie required for you to stay logged in - nothing else.
No data sold to third parties, ever.

3. How We Use Your Data

Solely to operate the Service: authenticate you, personalize dashboard content, send the daily newsletter if you've opted in, and maintain basic account security. We do not use your data to train any AI model.

4. Third-Party Services

The Service relies on third-party infrastructure to operate - our hosting provider, our email-sending provider, and the various public/commercial data feeds that power dashboard content (see Terms of Use, Section 7). These providers may incidentally process data (e.g. your email address passing through our email provider to deliver the newsletter) strictly as needed to provide that function, not for their own independent use. [Placeholder - specific sub-processor list to be finalized as infrastructure is confirmed.]

5. Data Retention

We retain your account data for as long as your account is active. If you'd like your account and associated data deleted, contact us at [contact email placeholder]. [Placeholder - formal deletion/export process and retention period to be finalized with counsel, particularly re: applicable regional privacy law such as GDPR/CCPA.]

6. Security

Passwords are hashed (never stored in plain text). Password reset links are single-use, expire after 1 hour, and are never stored in plain text. We take reasonable measures to protect your data, but no system is perfectly secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed at children. [Placeholder - specific age restriction to match the minimum account age in the Terms of Use, to be finalized with counsel.]

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above.

9. Contact

Questions about this policy or your data: [contact email placeholder].