Privacy Policy

SignBoard Planner is a small, independent service. This policy describes what data we collect, why we collect it, who we share it with, and how long we keep it. We try to keep it short, plain, and honest. If something here is unclear, email us at [email protected] and we'll explain.

1. What we collect

We collect different information at different times:

When you sign up for an account

• Your name (whatever you type into the signup form)
• Your email address
• Your password, stored only as a one-way hash — we cannot recover or read your plaintext password
• The IP address and browser user-agent string of the device that created the session, stored alongside your session record
• Timestamps for when the account was created and last updated

When you verify your email or reset your password

We generate a short-lived verification or reset token (one hour for email verification) and send it to you through Resend. The token is deleted after use or expiry.

When you subscribe to Pro

• We pass your email and name to Stripe so they can create a customer record. Stripe handles the actual payment page; we never see your card number, CVV, or full PAN.
• We store, on our side, the Stripe customer ID, subscription ID, subscription status (active, past due, canceled, etc.), and which plan you're on (monthly or annual). That's it. The card details stay at Stripe.

When you browse the public site

Cloudflare Web Analytics records the URL of the page, your referrer, your browser/OS/device type, your country (derived from IP without storing the IP), screen size, and Core Web Vitals timings. It does not set cookies, does not fingerprint you, and does not track you across sites.

Server logs

Our admin server logs operational events to the system journal on our host machine. These logs may include the email address used in a sign-in attempt (never the password), Stripe customer IDs and subscription IDs in error paths, and IP addresses in rate-limiting and webhook error paths. Logs are kept on the host until disk pressure rotates them out and are not shipped to a third-party log service.

2. Why we collect it

• Account data — so you can log in, save your subscription, and we can email you about your account when something changes.
• Session data (IP, user agent, token) — to keep you logged in for thirty days, to detect abuse like credential stuffing, and to let you sign out from a stolen session.
• Stripe IDs and subscription state — so the site knows you're a Pro subscriber and unlocks the full library for you.
• Cloudflare Web Analytics — so we can tell which pages people read and which we should improve. We chose Cloudflare specifically because it does this without cookies or tracking.
• Logs — to debug problems and respond to security incidents.

We do not sell your data. We do not use it to train AI models. We do not show you advertising. There is no advertising on this site.

3. Who we share it with

We use a small number of third-party services to run SignBoard Planner. Each one only sees the data it needs to do its job.

• Stripe — processes payments. Receives your email, name, and card details (which you enter directly on Stripe's page, not ours). Stores your subscription history. stripe.com/privacy
• Resend — sends transactional email (verification links, password resets). Receives the recipient's email address and the contents of the email. resend.com/legal/privacy-policy
• Cloudflare — serves the site (Cloudflare Pages and Cloudflare Tunnel) and runs Web Analytics. Sees normal HTTP request data plus the analytics fields described above. cloudflare.com/privacypolicy

We do not share your data with anyone else. We have not sold, rented, or traded user data to any other party, and we have no plans to. If we are ever required by law to disclose information (e.g. a valid subpoena), we will comply only with the specific request and will tell you about it unless we are legally prohibited from doing so.

4. How long we keep it

• Account record — for as long as your account exists. When your account is deleted, the user record and all attached sessions are removed from our database.
• Sessions — up to thirty days from last use, then automatically expire.
• Email-verification and password-reset tokens — one hour, then deleted.
• Server logs — on our host until disk pressure rotates them out (typically weeks to a few months).
• Stripe data — Stripe retains payment and subscription history per their own retention policy, which we do not control. Cancelling your subscription stops further billing but does not erase past invoices from Stripe.
• Backups — we keep nightly backups of our database. A deleted account can persist in the most recent backup for up to thirty days before that backup ages out. We do not actively read from backups except during recovery.

5. Accessing, correcting, or deleting your data

Currently, name and email changes are handled by emailing [email protected] from your account address. Self-service editing on the account page is on our roadmap. You can cancel your subscription any time from your account page via the “Manage billing” button, which takes you to Stripe's customer portal.

Account deletion is currently a manual process. We haven't yet built a self-service “Delete my account” button. To delete your account, email [email protected] from the address on the account, and we will:

• Cancel your Stripe subscription if it's still active.
• Delete your user record and sessions from our database.
• Confirm by reply when it's done, usually within a few business days.

We are tracking the work to add a one-click delete button on your account page. Until it ships, the email path above is the supported way.

You can also ask us for a copy of the data we hold about you, or ask us to correct anything that's wrong. Same email, same response window.

6. Cookies and tracking

• Better Auth session cookie — one HTTP-only, Secure, SameSite=Lax cookie that holds your session token. This is essential for keeping you logged in. It is not used for tracking.
• Cloudflare Web Analytics — cookie-free.
• Stripe Checkout — Stripe sets its own cookies on its checkout page (a different domain) when you are paying. Those cookies are governed by Stripe's privacy policy.

We do not use Google Analytics, advertising pixels, or session replay tools.

7. Children's data

SignBoard Planner is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has created an account on our service, email us at [email protected] and we will delete the account.

8. International users

SignBoard Planner is operated from the United States. We are not actively marketing to users in the European Union, the United Kingdom, or other jurisdictions, but if you use the service from one of those places, we apply the standard data subject rights you are entitled to:

• The right to access the data we hold about you.
• The right to correct anything that's wrong.
• The right to delete your account and the data attached to it.
• The right to receive a portable copy of your data.
• The right to object to specific uses of your data.

Email [email protected] to exercise any of these. Your data will be transferred to and stored in the United States.

9. Changes to this policy

When we update this policy, we'll change the “Last updated” date at the top of the page. If the change is material — meaning it expands what we collect, who we share it with, or how we use it — we will email everyone with an active account at least thirty days before the change takes effect, so you have time to review and decide whether you still want to use the service.

10. Contact

Privacy questions, data requests, or anything else covered in this policy: [email protected].

SignBoard Planner is operated by an independent owner based in Columbia, Tennessee, United States.