Privacy Policy

1. What we collect

Account info

When you sign up, we collect your name, email address, and password (hashed — never stored in plain text). If you sign in with Google, we receive your name, email, and profile picture from Google.

Profile & preferences

We store profile fields (display name, Broker status, admin flags where applicable) and preferences you save — saved vault items, notification settings, and similar dashboard data.

Broker & billing

If you subscribe to Broker, Stripe processes payment. We store Stripe customer and subscription identifiers on your profile so we can grant access and manage billing. We do not store full card numbers — Stripe handles payment details.

Broker overrides & performance

Brokers may store custom affiliate URLs and view click or performance stats associated with their overrides. Aggregated counts may be used for dashboards and internal analytics.

Submissions & admin review

Opportunity submissions and scraper-imported listings pending review include the content you or our systems provide, plus metadata (source URL, timestamps, reviewer actions for admins).

Usage info

We log basic technical details — IP address, browser type, pages visited, error logs — to keep the Service running, debug issues, enforce rate limits, and prevent abuse.

Email

We queue transactional emails (confirmations, password resets, notifications you opt into) through Resend. Newsletter sign-ups store your email and consent timestamp.

2. What we don't do

• We don't sell, rent, or trade your personal data — to anyone, for any reason.
• We don't run third-party ad networks that track you across the web.
• We don't store full payment card numbers on our servers.

3. How we use your info

To:

• Create and secure your account.
• Personalize your dashboard with scholarships, discounts, and tools.
• Operate Broker features, billing, and affiliate override tools.
• Send transactional emails (confirmation, password reset, account updates).
• Send the weekly newsletter — only if you opt in. Unsubscribe any time.
• Review user submissions and scraper imports before publishing.
• Improve the Service, fix bugs, and prevent fraud or abuse.

4. Who we share with

We share data only with service providers that help us operate the Service, under strict confidentiality and data-processing terms:

• Database & auth: Supabase (user accounts, profiles, vault data).
• Hosting & CDN: Cloudflare (delivery, security, Workers where deployed).
• Payments: Stripe (Broker subscriptions and billing portal).
• Email: Resend (transactional and notification email).
• Authentication: Google (only if you choose Google sign-in).

We may also disclose information if required by law, to respond to valid legal process, or to protect the rights and safety of our users and the Service.

5. Cookies & similar technologies

We use cookies and browser storage to keep you signed in and remember preferences. We don't use advertising cookies. Details are in our Cookie Policy.

6. Your rights

Depending on where you live, you may have the right to:

• Access the data we hold about you.
• Correct anything inaccurate.
• Delete your account and associated data.
• Export a copy of your data.
• Opt out of marketing emails at any time.
• Object or restrict certain processing where applicable law provides.

To exercise any of these, email hello@dare.diy. We'll respond within a reasonable timeframe.

7. Data retention

We keep your data while your account is active. If you delete your account, we delete or anonymize personal data within 30 days, except where we're legally required to keep records longer (e.g., billing records via Stripe).

Scraper and published opportunity data may remain after account deletion if it doesn't identify you personally.

8. Security

We use industry-standard practices — HTTPS, hashed passwords, Supabase row-level security, server-side validation for sensitive actions, and rate limiting on public endpoints. No system is perfectly secure; report concerns to hello@dare.diy.

9. Kids

dare.diy isn't directed at children under 13. If we learn we've collected data from a child under 13 without parental consent, we'll delete it.

10. International users

We operate from the United States. By using the Service, you consent to your data being processed in the U.S. and other countries where our providers operate (including EU-based subprocessors some providers may use).

11. California & other region notices

We do not sell personal information as defined under the CCPA/CPRA. California residents may request access or deletion as described in Section 6. If you are in the EEA, UK, or similar jurisdictions, you may also lodge a complaint with your local data protection authority.

12. Changes to this policy

If we make material changes, we'll notify you by email or post a notice on the site before they take effect. The “Last updated” date at the top will always reflect the latest version.

13. Related policies

Terms of Service · Cookie Policy · Affiliate Disclosure · No Refund Policy

14. Contact

Questions, requests, or complaints? Email hello@dare.diy.