Privacy Policy

What we collect

Only what running the shop requires. There is no advertising, no analytics profile, and no tracking of you across other websites.

Your account

• Email address — this is how your account is identified and how purchases find their way to you.
• Name and profile picture — only if you sign in with Google, and only what Google returns.
• Password — optional, and never stored as you typed it. We keep a scrypt hash, which cannot be reversed into your password.

Security records

• IP address and browser, recorded against each sign-in session and each template you download or copy.
• Failed purchase-verification attempts, with the email and IP used.

These exist to stop someone guessing licence keys and to make a shared or stolen account obvious. They are not used to build a picture of you.

Purchases

• The email used at checkout, the amount, the currency and the date.
• Identifiers issued by the payment provider, so a refund can be matched to an order.

We never see or store your card details. Card entry happens entirely on the payment provider's own checkout page. Nothing about your card reaches our servers.

Who else handles it

Each of these is used for one job, and receives only what that job needs.

• Stripe and Lemon Squeezy — taking payment. They receive your email and payment details directly.
• Supabase — the database and file storage, hosted in Singapore.
• Vercel — hosting and delivery of the site.
• Emailit — sending sign-in links and purchase confirmations. Receives your email address and the message.
• Google — only if you choose to sign in with Google. We request your name, email and picture, and nothing else. We do not keep any Google access token.

We do not sell your information, and we do not share it with anyone beyond the companies above.

Cookies

One cookie keeps you signed in. Two short-lived ones exist only while a Google sign-in is in progress and are deleted the moment it finishes. There are no advertising or analytics cookies, so there is nothing here to consent to or opt out of.

How long we keep it

• Account and purchase records stay while your account exists — a purchase is proof of what you own.
• Sign-in sessions expire after 30 days, or immediately when you sign out.
• Sign-in links expire after 15 minutes and work once.

Your choices

• Change your name, set or remove a password, and end every session from your account page.
• Ask for a copy of everything we hold about you, or ask us to delete your account, by writing to support@geniusflow.net.

Deleting your account removes your access to anything you bought. We may keep a minimal record of the transaction itself where tax or accounting rules require it.

Contact

Questions about any of this go to support@geniusflow.net.