Privacy Notice

ScopeTrack is run by Marc Young, doing business as Mindful Pages, 8 Potter Lane, Levittown, NY 11756, United States. Mindful Pages is a trade name, not a separate company. Privacy questions: rightnow@rocketship.com.

Owners have a ScopeTrack account and create projects and proposals. Clients receive a private link from an owner. Clients don't have accounts.

• Your account email and authentication information. Our sign-in provider (Supabase) handles password authentication.
• What you enter: projects, client names, scope, prices, timing, proposals, versions and their history.
• Private links you create. We store a one-way fingerprint of each link, not the link itself, plus when it was revoked or replaced.
• Your free-trial start and end times.
• Subscription details from Stripe: plan, status, paid-through date, and Stripe customer and subscription IDs. We never receive card numbers.

• The email address the owner shared the link with, and any address typed in to request a code, with whether it matched.
• A keyed fingerprint of the requester's IP address, used only to limit repeated code requests. The application's rate-limit records don't store the raw IP address; providers may process IP addresses in their own logs.
• Verification codes and short-lived decision passes, stored only as keyed fingerprints. Codes expire after 10 minutes, and passes after 15. Expiry prevents use; it does not itself delete the record.
• For a decision: approve or decline, the verified email, the time, and a fixed copy of the exact version decided on.

Verifying an email shows that someone could read that inbox at that time. It doesn't establish legal identity or authority.

We use it to provide project and version records, authenticate owners, verify client access, record decisions, manage billing, respond to support and privacy requests, prevent misuse and secure the service.

Verification-code emails go to clients through Resend, from scopetrack@mindfulpages.app. Account emails such as password resets go to owners from our sign-in provider. Creating a private link does not automatically send an email. We don't send marketing email.

• Supabase: database and sign-in, in the US West (Oregon) region.
• Resend: sends verification emails. Our sending domain is set up in Resend's US East (North Virginia) region.
• Stripe and Sold through Link: subscription checkout, tax, receipts and transaction support. Stripe's own privacy notice covers payment details you give Stripe.
• Lovable: hosts the web pages and server functions.
• GitHub Actions: runs database backup exports. Google Drive: stores encrypted backup archives in an operator-controlled account.

Providers may use subprocessors and process information in other locations under their terms. We make no promise to keep data in a particular country.

The demo uses made-up data stored in your browser rather than our application database. "Reset demo" or clearing your browser data removes it. Visits may still create ordinary provider request logs.

Our servers keep operational logs, designed to leave out verification codes, private link addresses and keys. Each provider also keeps its own logs under its own rules. Our sign-in provider keeps a log of account events, which can include your email address.

We create encrypted database archives and store them in our Google Drive backup account. They include account and project data; private decryption material is held separately. Exports temporarily process unencrypted material on the backup runner before encryption and cleanup. Backups run daily.

We apply a rolling 30-day retention window to Drive archives after a fresh backup is download-verified. Temporary operator restore copies are removed once verification is complete and in any case follow the same maximum 30-day window. Backup failures may delay removal. Deleted records may remain in older archives until removed; completed deletion requests must be reapplied before customer access resumes after recovery.

• Cancelling your subscription doesn't delete your account. You can still view and download your history.
• Finalized versions and client decisions can't be edited and are kept unchanged during normal use.
• Security-record cleanup is configured hourly. Minimum retention ages are 24 hours after code expiry, 7 days after decision-pass expiry, 30 days after a code request, and 90 days after link revocation for links without decisions once their dependent records are removed. Cleanup occurs on the next successful run; failures, locks or batch limits may delay removal.
• Account deletion is by request to rightnow@rocketship.com from your account's address. We'll verify you own the account (we'll never ask for your password), give you 14 days to download your records, and explain what will be deleted and kept before anything happens. Accounts linked to a client decision require separate review and are blocked from the ordinary closure process. We review verified requests within 30 calendar days and explain what is retained, why, and when it will next be reviewed. If retention remains necessary, we review again within 12 months or sooner when circumstances change. This is a review schedule, not a promise of automatic deletion.
• Closures leave a minimal pseudonymous audit with an account fingerprint, request/authorization references, record-list fingerprint, deletion counts, operator and time. It contains no project content or deleted account email. Support and verification correspondence may still identify the requester and is handled separately.
• Even after account deletion, our sign-in provider's own event log, and any provider backups, may keep some data under that provider's rules.

Support and privacy-request correspondence is accessible only to the operator and the providers needed to handle it. We ask for the minimum information needed and do not ask for passwords or government-ID copies. Extra evidence supplied to verify a request is removed within 30 days after the request is resolved, unless a specific legal requirement or dispute requires longer retention. Routine support and privacy-request correspondence is removed within 12 months after resolution. Where a specific legal requirement or dispute requires longer retention, we retain only what is needed and review the need at least annually. Provider backups may retain earlier copies under their own retention rules. This correspondence policy does not change the separate treatment of immutable client decisions or the pseudonymous closure audit.

Owners can download supported decision records; clients can download a receipt immediately after deciding. Other records can be requested from support. Downloaded copies remain on the recipient's device. To request access, a copy, correction or deletion, email rightnow@rocketship.com. We verify ownership without asking for passwords. Immutable decision snapshots cannot simply be rewritten; we will explain how a correction request can be addressed while preserving history.

We aim to acknowledge requests within five business days and give a substantive response within 30 calendar days after verification. These targets do not limit shorter legal deadlines or other applicable rights. If more time is needed and permitted, we will explain why and when to expect a response.

We will display the effective date and announce material changes through an in-app notice or account email, normally at least 30 days in advance. Legal or security changes may require shorter notice. We will obtain any additional consent required for a new use of information.