DRAFT, pending attorney review. Not yet in effect.
DRAFT, have an attorney review. This is a starting draft, not legal advice. Replace every [BRACKETED] placeholder. Remove any section describing a feature you have not launched (for example bank linking or cloud sync) until it is live.
Effective date: [EFFECTIVE DATE] Who we are: [LLC NAME], a Florida limited liability company ("Weekfund", "we", "us"), [STREET ADDRESS, CITY, FL ZIP]. Contact: [email protected].
| Category | When | What | Where it goes |
|---|---|---|---|
| Budget data | Always, on your device | Accounts, balances, transactions, bills, goals, loans, settings | Stays in your browser. Not sent to us. |
| Waitlist | Only when you press Join | Email, consent checkbox, referral code, page source, time | Our Cloudflare storage (or our form provider [FORM PROVIDER] if used) |
| Subscription (Plus) | When you start a trial | Name, email, billing address, card details | Card details go directly to Stripe. We receive a customer ID, plan, status and the last 4 digits and card brand from Stripe. |
| Account login (Plus) | When accounts launch | Email, login identifiers | Our login provider [CLERK / SUPABASE] |
| Encrypted sync (Plus) | Only if you turn it on | An encrypted copy of your budget data | Our cloud storage. It is encrypted on your device before upload; we cannot read it without your key. |
| Bank linking (Plus) | Only if you connect a bank | Account names, balances, transactions from your bank | Provided through Plaid Inc. See section 5. |
| AI coach | Only if you turn it on | A short summary (for example safe-to-spend number, health score, alert titles) | Sent from your browser to the AI provider address you entered, or to [OUR AI PROVIDER] for Plus. Raw transactions and keys are not sent. |
| Referral link | When you open a link with ?ref= | The referral code | Stored in your browser and sent with your waitlist or checkout request |
| Technical data | When you load the site | IP address, browser type, pages requested | Our host Cloudflare processes this to deliver and protect the site. |
| Visit statistics | When you load a page on weekfund.app | Page address, referring site, browser and device type, country, page load speed | Cloudflare Web Analytics, which is cookieless: it sets no cookies, does not use local storage to identify you, and does not track you across sites. We only see aggregate counts (for example visits per page and top referrers), never your budget data. We do not use advertising cookies. |
We do not knowingly collect information from children under 13. Weekfund is intended for adults 18 and older.
To provide and improve Weekfund; to run trials, subscriptions, receipts, renewal and trial-ending reminders; to apply founding-member pricing and referral credits; to email you about the launch if you opted in; to prevent fraud and abuse; and to comply with law. We do not use your budget data to advertise to you.
We share information only with service providers that help us run Weekfund, under contracts that limit their use: - Stripe (payments and billing): stripe.com/privacy - Cloudflare (hosting, storage, cookieless Web Analytics): cloudflare.com/privacypolicy - [CLERK / SUPABASE] (login), when accounts launch - Plaid (bank linking), only if you connect a bank - [EMAIL PROVIDER] (launch and account emails) - [AI PROVIDER] (AI coach for Plus), only if you use it
We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the business (you will be notified).
If you connect a bank, you authorize Plaid to collect data from your financial institution and share it with us under the Plaid End User Privacy Policy (plaid.com/legal). We use it only to show your balances and transactions in Weekfund. You can disconnect a bank at any time in Settings, and we then remove the connection and stop retrieving data.
Waitlist emails: until launch plus 12 months, or until you unsubscribe. Subscription records: as long as you subscribe and then as required for tax and accounting (typically up to 7 years). Encrypted sync data: deleted within 30 days after you turn off sync or close your account. Bank connection data: deleted within 30 days after you disconnect. On-device data: you control it; use Settings > Data > Erase.
Data in transit uses HTTPS. Sync data is encrypted on your device before upload. Payment cards are handled by Stripe (PCI DSS certified); we never see full card numbers. Access to our systems uses multi-factor authentication. No method is 100% secure; we will notify you and regulators of a breach as required by law.
You can: export or erase on-device data at any time; unsubscribe from emails using the link in any email; request access to, correction of, or deletion of the information we hold by emailing [email protected]. Depending on your state, you may have additional rights (for example under the California Consumer Privacy Act if it applies to us). We will not discriminate against you for using your rights.
We will post updates here and change the effective date. For material changes we will notify you by email or in the app before they take effect.
[LLC NAME], [STREET ADDRESS], [email protected].