The short version: the files, spreadsheets, and data you analyze are processed entirely in your browser and are never uploaded to or stored on our servers in readable form. Optional AI features send only anonymized summary figures, and the optional device-handoff feature relays only a copy encrypted on your device with a key we never receive. We don't sell your data. Close the tab and your analysis is gone.
PlainSight — Insightful Actions ("PlainSight — Insightful Actions," "we," "us," or "our") operates the web application at plainsightai.app (the "Service"), which helps individuals and businesses turn their own spreadsheets and transaction data into plain-language insights, benchmarks, and reports. PlainSight — Insightful Actions is not affiliated with, endorsed by, or related to any other company using the name "PlainSight." This Privacy Policy explains what information the Service handles and how. If you have questions, contact us at ps.insightfulactions@gmail.com.
When you upload a file, paste data, or open a spreadsheet, the Service parses and analyzes it locally in your web browser. Your raw rows — transactions, client or customer names, amounts, trade logs, and file contents — are not transmitted to our servers and are not stored by us. When you close or refresh the tab, that working data is cleared from memory.
Two clearly labeled exceptions:
If you choose the optional "read a ledger photo" feature, the image you select is sent to our AI vision provider so the numbers in it can be transcribed for you. This is entirely opt-in, used only to perform that one-time read, and the image is not retained by us afterward.
If you choose the optional "Send to my phone" feature to move a report between your own devices, your browser first compresses and encrypts the report on your device, and only that encrypted result is relayed through our server. The decryption key is generated in your browser and travels solely inside the link or QR code shown on your screen (in the URL "fragment," which browsers do not send to servers) — so we relay data we are unable to read. The encrypted copy can be retrieved exactly once, only by your signed-in account, is deleted the moment your other device retrieves it, and expires and is deleted automatically after 15 minutes in any case.
| Category | What it includes | Why |
|---|---|---|
| Account information | Your email address, and name if you provide it, managed through our authentication provider (Clerk). | To create and secure your account and remember your plan. |
| Billing information | Subscription status and payment records handled by our payment processor (Stripe). We never receive or store your full card number. | To process Pro subscriptions and Report-pack purchases. |
| Anonymized AI inputs | When you use an AI feature, we send summary figures only — e.g. monthly totals and "Client A: 34%"-style shares — to our AI provider (Anthropic). Never your raw rows, real names, or files (except an opt-in ledger photo as described above). | To generate benchmarks, narratives, and recommendations. |
| On-device preferences | Settings such as your favorite industries, unlocked session state, and interface choices stored in your browser's local storage. | To remember your preferences between visits on that device. |
| Saved reports (optional) | If you choose "Save report," the analyzed data is stored in your own browser's local database (IndexedDB) on that device only. It is never transmitted to us or anyone else, and you can delete it in the app at any time or by clearing your browser data. | So you can reopen a dataset later and keep working with it. |
| Device handoff (optional) | If you choose "Send to my phone," an encrypted copy of the report — encrypted in your browser with a key we never receive — is held on our server for up to 15 minutes so your other device can retrieve it once, after which it is deleted. We cannot decrypt it. | So you can move a report between your own devices without re-uploading files. |
| Basic technical data | Standard server and usage logs from our hosting provider (Vercel), such as IP address, browser type, and pages requested, in aggregate. | Security, reliability, and understanding overall usage. |
| Newsletter subscriptions (Pro, optional) | If you subscribe to Market Watch, Oil & Gas Weekly or an industry brief, we keep the email address you choose, which newsletters and briefs you take (and whether each brief is also emailed), the ticker symbols on your watchlist for Market Watch, and when each was last sent. Every email carries a one-click opt-out that works without signing in. | To write, show and send you the newsletters you chose. |
| A backup file (optional) | If you press Back up my data in PlainSight, on the comedy page or in Alabaster Box, the app saves one file to your own device with what it keeps there (for PlainSight, that includes your saved reports and their rows). The file is never sent to us, and restoring reads it on your device. Keep it somewhere safe: anyone who has the file can read what's in it. Your desk key, passes, plan and purchases are never in it. | So you can keep a copy of your own data and move it to another device. |
| Companies you follow (the Doghouse, optional) | The tickers you follow on the Doghouse are kept in your browser's local storage on that device. To show their filings, only the tickers are sent to our server, which looks them up in the SEC's public EDGAR records. We keep the SEC's public answers for a short while so the next reader doesn't have to ask again, but never your list. A one-way hash of your IP address counts lookups for two days, so no one can overload the service. | To show the SEC filings of the companies you choose. |
| Hosting on the Floor (optional) | If you join the host waitlist on the Floor, we keep the name, email address and channel link you give, and the line about what you'd host, so we can write to you before hosting opens. Only the site owner sees them; they are never published. Asking again replaces your earlier entry, and we remove it whenever you ask. A one-way hash of your IP address counts sign-ups for two days, so no one can flood the list. | To tell you when you can host a desk. |
| Hosting on the Easel (optional) | If you join the host waitlist on the Easel (under its videos), we keep the name, email address and channel link you give, and the line about what you'd paint, so we can write to you before hosting opens. Only the site owner sees them; they are never published. Asking again replaces your earlier entry, and we remove it whenever you ask. A one-way hash of your IP address counts sign-ups for two days, so no one can flood the list. | To tell you when you can host a studio. |
| A church's group listing (Alabaster Box, optional) | If you send your church's group sign-up page through Find a Group, we keep what you type about the church (its name, city, state, ZIP, the page's link, a closing date and a short note) and the email address and role you give, until the listing is approved or turned down. Only the church's details are ever shown; your email and role are never published. What a reader types to search Find a Group is matched on their own device and is never sent to us. | So the site owner can check a listing, and write back if something needs changing, before anyone sees it. |
| A shop's magazine (the Magazine Builder, invited shops) | If PlainSight is making a magazine with your shop and you sign in to the Magazine Builder, the issue you build — your answers, and the photos, clips and voice memos you add — is saved to your account on our servers (our database, and Cloudflare R2 for the files) as well as in your browser, so you can pick up on any device and we can work on the issue with you. Only your account and PlainSight can open it; its files are served only on private links that expire after a few hours. We keep the email address we invited, so that account can sign in, and the date we emailed the invitation. The draft stays until you ask us to delete it or we delete it; deleting it removes the words and the files. A web edition you approve and we publish is public, behind a 21+ age check, and kept out of search engines. | To make the magazine with you, and let you keep working on it from any device. |
| Buying a magazine issue | If you buy a paid issue at plainsightai.app/m/, we keep that your account holds it — which issue, when, and what you paid — so it opens whenever you sign in. Stripe takes the payment; we never see your card number. We keep the sale itself (the amount, Stripe's fee, the shop's share, and your account's id, so a refund can take the issue back) to pay the shop and keep our books. The shop that made the issue sees how many copies sold and what they took, never who bought them. While you read, a small cookie for that one issue's address (HttpOnly, lasting a day) lets its pages and pictures open; it holds no more than the issue, your account's id and when it ends. We send you one receipt email with the issue's link. | To open the issue you bought on any device you sign in on, to pay its shop, and to keep accounts. |
| A shop paid for its issue | If PlainSight sells your shop's issue, we keep the email address you're paid under, the PlainSight account you set payouts up from, the Stripe account you opened, whether Stripe has it ready, when you agreed to the payout terms, and each sale's share — held or sent. Your identity, bank and tax details go to Stripe, never to us. | To pay you your share of each copy and show you your statement. |
| Sending in your series (the comedy site, optional) | If you send in a comedy series from the Micro series shelf, we keep your name, your email address, the series' link and the line you write, so the site owner can watch it and write back. Only the site owner sees them; nothing is published unless the series is put on the shelf. Sending again replaces your earlier entry, and we remove it whenever you ask. A one-way hash of your IP address counts send-ins for two days, so no one can flood the line. | To consider your series for the shelf, and tell you if it goes on. |
| The community (optional, 18 and older) | If you join the community, the profile you write, who you follow, what you like, your notifications, your messages and what you say in the Floor's chat, as section 6b sets out in full. | To run likes, follows, messages, the Floor's chat and live notices between members. |
| PlainSight Games | With an account, a games record: play chips, wins and losses per game, badges, a level and the heaviest fish of each kind you land (section 6b, "Your games record"). | To keep your bankroll and record from one visit to the next, and to show your level and badges to the people you play. |
| The Easel (the painting room) | With an account, whether you hold an Art Pass and until when, and whether you have had your free week (section 6b, "The Easel"). Your paintings are never sent to us. | To open the room to a pass and to give each account its one free week. |
We use the limited information above to provide and secure the Service, to authenticate your account, to process payments and manage subscriptions, to generate the AI insights you request, to remember your preferences, to communicate with you about your account or important changes, and to maintain and improve reliability and safety. We do not use your content to train AI models.
We share the minimum information necessary with trusted providers who act on our behalf:
| Provider | Purpose | Information involved |
|---|---|---|
| Clerk | Account sign-up, sign-in, and session management | Email, name, authentication data |
| Stripe | Payment processing and subscription billing; and the payout account a shop opens to be paid for its magazine issue (Stripe Connect) | Payment details you enter directly with Stripe; we receive only subscription and payment status. A shop's identity, bank and tax details for its payouts go to Stripe directly |
| Anthropic | AI insights, benchmarks, and narratives; and, in the Magazine Builder, showing a magazine's words in another language when your browser cannot translate them itself | Anonymized summary figures (and opt-in ledger photos); the tickers each folder alerts snapshot reads, for everyone at once, with no member named (see 6c); the words of the magazine pages you choose to see in another language, which come back translated and are kept, under a fingerprint of the words, so a page is translated once; in The Easel, a small copy of your canvas and of the step's reference when you press Ask the tutor, for that one answer and kept by no one (see 6b, "The Easel") |
| Vercel | Application hosting and delivery | Standard technical/usage logs |
| Upstash | Data store | Support requests you submit (name, email, message); short-lived operational caches; encrypted device-handoff copies we cannot read, deleted within 15 minutes; a push delivery address for your device, only if you asked for notifications (see 6a); and, if you join the community, your community profile, likes, follows, notifications, messages and the Floor's chat (see 6b); and, if you join folder alerts, your alert settings, pass dates and, if you connect it, your Telegram chat id (see 6c) |
| Telegram | Delivering folder alerts, only if you connect our bot (@Folder_Alerts_bot) | Your Telegram chat id, and the snapshots sent to it |
| OpenAI | Checking photos sent in community messages, and community profile pictures, once photos are switched on; and, in The Easel, making a reference picture from words when you press Paint from words | The photo or picture, for an automatic check of its content before anyone sees it; the words you typed for the picture (see 6b, "The Easel") |
| Cloudflare | Storing files (R2), and scanning the domain community photos are served from against lists of known child sexual abuse images | The files you add (a shop's magazine; a photo in a community message or a community profile picture, once photos are switched on) |
| Optional "Sign in with Google" | If you choose it, your Google email and basic profile | |
| Ticketmaster | Dates near a city or a place: comedy dates under the Circuit's "What's on near you", and art dates under The Easel's "Near you" — only once the site owner has switched the listings on | The city you typed, or, if you pressed Use my location, your position rounded to about a kilometre — nothing about you or your account |
| AssemblyAI | Following the words you say on the Stage and in the Pulpit, only when you choose our speech service for it (paid in credits), or your browser has none of its own and you turn it on | Your microphone's audio while that set runs, sent from your browser straight to AssemblyAI; the words come back to your browser. We never receive the audio. With our account opted out of AssemblyAI's model training, it keeps no audio or transcript from a live session, only records for billing. |
Each provider processes data under its own privacy terms. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Media you choose to play. Some rooms play media straight from the people who publish it: videos from YouTube, in YouTube's own player (its privacy-enhanced youtube-nocookie.com player, except in Safari and on iPhones and iPads, where PlainSight, the comedy site and The Easel use its standard youtube.com player because the privacy-enhanced one often refuses to play there), and in Alabaster Box, Still Waters, which plays Abiding Radio's Quiet Meditations live stream from Abiding Radio's own server, and asks that server for the name of the song playing. The trading desk's sound board, set to YouTube clips, plays its clips the same way, in YouTube's own player. PlainSight's 📻 Radio plays live stations from their broadcasters' own servers (SRG SSR's Radio Swiss Classic, Jazz and Pop; WCPE through StreamTheWorld) and public-domain Beethoven and Mozart recordings from the Internet Archive; its SomaFM choices open SomaFM's own site in a new tab. It remembers your last station and volume on this device only. The same radio plays in The Easel (📻 in its top bar) and in the Games' Music while you play, from the same servers, and remembers the same station. PlainSight's World News desk plays news organizations' videos and, when you open one, a newsroom's own live stream, in the same YouTube player. The Easel's Videos (the tutor's second face) plays painting lessons and paint-alongs in YouTube's own player too, and once you open it, shows each one's picture from YouTube's image server (i.ytimg.com); the list itself comes from our server, the same for everyone. The headlines beside the CEO Desk and World News are read by our server from the publishers' public feeds (UN News, Global Voices, and US government releases: the State Department, the Labor Department, the FTC, NASA, the Federal Reserve Board, the SEC and the Census Bureau), so your browser asks only us for them; a headline you open takes you to the publisher's own page, where its own privacy terms apply. When you press play, your browser connects to that service directly, and like any website it sees your IP address and basic browser details, under its own privacy terms. Nothing you analyze, write or save in the Service is sent with it, and those services send us nothing about what you play.
The Service uses your browser's local storage to remember preferences (such as your favorite industry) and session state, and our authentication and payment providers use cookies or similar technologies needed to keep you signed in and to process a purchase securely. We do not use third-party advertising trackers.
Sounds and tracks of your own. If you put a sound of your own on a pad of the trading desk's sound board, or a track of your own on the night drive, the file is kept in your browser's storage on that device (IndexedDB), so it's there next time you visit on that device. It is played there and never uploaded to us. "↺ Ours" removes it, and so does clearing this site's data in your browser.
You can ask to be told when a new issue of The Circuit is published. This is off unless you switch it on, and we will only offer it at the bottom of an issue you have just read — never as a prompt when you arrive.
It is worth being straight about what this costs, because it is the only thing on this site that works this way. When you turn notifications on, your browser generates a delivery address for that specific device and hands it to us. That address is a persistent identifier for the device — the first one this product has ever stored. Everything else here is either kept in your own browser or tied to an account you chose to create.
What we hold against it is deliberately almost nothing:
No account, no name, no email, and no connection to anything you have bought. A subscription is a device asking to be told when something is published; it is not a person. The notifications we send carry no message content at all — they are an empty signal that wakes your browser, which then asks our server what to display. Nothing about you travels with them.
Switch it off with the same control that switched it on, or in your browser's site settings. Switching off deletes the record. If a device stops accepting delivery — you uninstall the browser, clear its data, or change phone — the address is removed automatically the next time we try it.
Community notifications are the one exception to "not a person", so here it is plainly. If you turn on notifications from the community's bell, the same delivery address (as a one-way hash) is also linked to your community profile, so we can wake that device when you have a new message, a new follower, or someone you asked about goes live. The notification still carries nothing: your browser asks how many things are new and shows a count — "You have 2 new messages" — never who or what. Untie the device with Stop community notifications on this device under You in the community; deleting your community profile unties every device.
The community is optional and is for people 18 and older — you say so when you join. It is not open in Mississippi or Tennessee for now, because their laws require age checks for features like this; we know the state a request comes from only because our host tells us, and we don't store it.
If you don't join, nothing about you is stored for the community: no profile, no likes, no devices, and nobody can find, follow or message you. Signed in or not, you can still see how many likes something has.
What we keep: the profile you write (a name, one line, up to two links, and a picture: the one you upload, or your account's own if you haven't, if it has one); who you follow and who follows you; what you liked; your bell (the last 200 notifications); who you blocked or muted; the devices you asked us to notify; your messages; and what you say in the Floor's chat, for 24 hours. Your profile is shown under a public member number, never your account's email or ID.
Who sees what: anyone can see how many likes something has. Profiles, followers and who liked something are shown only to signed-in readers. If you keep your likes private, they are counted but never named — not in the list of who liked something, and not in the other person's notifications. Someone you block can't see your profile, follow you or message you.
Public or private: you choose when you join, and can change it under You. A public account can be followed by any member. A private account approves each follower: everyone else sees only your name, your picture and that the account is private — not your line or links, your followers, who you follow, your likes by name, or when you're live. A request you decline is simply removed; the person isn't told. If you switch to public, everyone waiting is let in.
Community off: you can switch the community off for your account, from the join card or from You. The hearts, the bell and the badges then stop appearing on all three sites — the choice is saved in your account's own settings at Clerk, our sign-in provider, so every site knows it. If you're a member, your profile is hidden while it's off: nobody can find, follow or message you, and you aren't notified. Nothing is deleted, and turning it back on (Community in the menu) brings everything back as it was.
Messages are kept on our servers so both of you can read them on any device. They are not end-to-end encrypted: the site owner could read them, and reads a conversation only when one of you reports a message in it. A conversation keeps its newest 500 messages. Unsend blanks a message for both of you. Messages from people you don't follow wait in Requests, and they aren't told you've read them.
Photos in messages (once switched on) are resized on your device to 2,048 pixels and re-encoded, which removes the location and camera details a photo carries. Before delivery each one is checked automatically for sexual, violent and self-harm content; a photo the check refuses is deleted. Photos are stored in our Cloudflare R2 media store and served from our own media address, which Cloudflare scans against lists of known child sexual abuse images. A photo is kept for one year, then deleted. PDFs and other files can't be sent.
Your profile picture (once photos are switched on): you can upload one. Your device takes the middle of the photo you pick, square, and makes it 400 × 400 pixels and re-encodes it, which removes the location and camera details a photo carries. It is checked the same way before anyone sees it, stored in the same media store and served from the same scanned address. Until you upload one, or after you remove yours, your account's own picture shows, if it has one. A picture you replace or remove is deleted seven days later (the time it can take Cloudflare's scan to report a match), and an upload you never used after a day; leaving deletes yours at once — except a copy a report keeps.
The Floor's chat (on PlainSight's trading desk, beside the screen) is for members only: only signed-in members read it and post in it, and nobody else sees it. A message shows your community name and picture to the members there. Each message is deleted 24 hours after it's posted — sooner if you delete it or the desk takes it down — and the chat keeps its newest 500. It is not private: everyone in the chat can read it, and the site owner moderates it (a pinned note, slow mode, blocked words, taking a message down). Links are allowed, shown exactly as typed, and open in a new tab. When you open the chat, the people you blocked or muted are handed to your own page so their messages stay off your screen. A message three members report comes off the chat until the desk decides; a report keeps a copy as described below. Don't post personal details there, yours or anyone's, and nothing anyone posts there is investment advice.
Reports: a person reads every report, and the queue is checked automatically twice a day so nothing waits more than a day unseen; that check counts reports, and the alert it sends the site owner holds counts only. A report keeps a copy of what it reports — for a message, that message and the ten before it — for one year, even if it is later unsent or the account is deleted. A request to take down an intimate image includes your signature, an email address to reply to and your statement; we keep those with the report for a year. An intimate image shared without consent comes down within 48 hours of a valid request. Anything that appears to be child sexual abuse material is reported to the National Center for Missing & Exploited Children and preserved as the law requires (18 U.S.C. § 2258A).
Live now: when a host opens a live room on the Residency, their profile shows they are live, and followers who asked to be told are notified. The live mark clears when the room closes.
Your games record (PlainSight Games): with an account, the games keep a small record of play — a bankroll of play chips, your wins and losses per game, badges and a level. Your level, badges and wins and losses are shown to the people you play with, at the table and on your player card; your chips are shown to nobody but you. The record holds no personal details beyond the account it belongs to, and it goes with the account when the account is deleted. Chips are play chips with no cash value. It also keeps, while you sit at a Hold'em or Craps table, what you bought in for (until you get up — a seat never got up from is settled at that amount after a day and a half, four days online), when you last collected daily chips, and how many times you started over. In Fishing it keeps the heaviest fish of each kind you land — the kind and its weight, nothing else — and those show on your player card for anyone who looks; a fish counts toward no win, loss or level.
Watching a table (PlainSight Games): a public table — random play, or a table of your own you leave public — can be watched by anyone, signed in or not. A watcher sees the table as someone standing at the rail would (never anyone's hidden cards), and sees each player's level and badge count; a player's name only if the watcher is a member of the community. Mark a table of your own private and it is never listed or watchable. While you sit at a table played on your device, the page keeps a note of where you stand on that device (your seat's key, your chips, the hands played) so a closed tab still brings your chips back on your next visit; it is removed when you get up. Your choice of game sounds, on or off, is kept on your device too.
The Easel (the painting room, plainsightai.app/easel): your paintings, your gallery, the canvas in progress and your settings (brushes, palette, room, painting hand, pen and touch) are kept on your device, in the browser's own store, and are never sent to us; a photo you choose to paint from is read on your device and goes nowhere. Two buttons are the exception, and each says so before you press it: Ask the tutor sends a small copy of your canvas (768 pixels on its long side) and of the step's reference (512 pixels) through our server to Anthropic (section 5) for one three-sentence answer, and Paint from words sends the words you type through our server to OpenAI (section 5), whose picture comes back to your device as your reference. We keep neither the copy nor the words nor the picture; we count only how many times an account used each button that day, for the daily limits. Clearing that browser's data removes them, so export the paintings you want to keep. With an account we keep only whether you hold an Art Pass and until when, and whether your one free week has been started; a purchase goes through Stripe (section 5), which tells us the account and the term and nothing about your card. The desk's weekly tallies count passes and free weeks, never who. Near you, the easel's exhibitions-and-events panel: a city you type is sent to our server to look the listings up and is remembered on your device only; if you press Use my location, your browser asks you first, and the position leaves your device already rounded to about a kilometre, goes to our server and to Ticketmaster (section 5) to find dates within forty miles, and is kept by us only as that day's cache key — never with an account. The search doors beside the dates open a search engine in a new tab with the city in the query, and nothing else. The tutor's Videos face plays YouTube's own player, as described under Media you choose to play; nothing you paint goes with it. The host waitlist under the videos ("Paint on camera? Host your own studio here.") keeps only what you type into it, as the table above says under Hosting on the Easel. Paint together is the one place your painting leaves your device: in a shared room, every stroke you lay (the tool, the colour and the points of the line) goes to our server and to the others in the room, alongside your community name, and is kept until a day after the room was last used, when it is gone. Your own painting stays on your device while you're in a room, and nothing else of yours is sent.
Jigsaw (PlainSight Games): the nine free boards need no account. A puzzle you put aside, and your best times, are kept in this browser only (its local storage). A picture of your own — a photo you choose on the Games page, or a painting you send from the Art Room's Puzzles door — is made smaller and kept in this browser too, and is never uploaded: the pieces are cut and drawn on your device. The passes are checked only when you open a board that needs one (the Game Pass or the Art Pass, asked of our server in one question).
Building a jigsaw together (PlainSight Games, a community table): our server keeps the table while it lasts — where every piece lies, who is sitting at it, and whose hand a piece is in for the twenty seconds it's held — and clears it away once it has gone untouched for three days. Everyone at the table sees the builders' community names and where they move the pieces. The table is never listed or watchable: its link seats whoever holds it, while a seat is free. The board is one of the Art Room's lessons or the Games' rooms, drawn on each builder's device; a picture of your own is built alone and never leaves your browser. Building together isn't a game on your record.
Leaving: Delete my community profile (under You), or deleting your account, removes your profile, likes, follows, followers, follow requests, notifications and linked devices, blanks your messages in every conversation and deletes the photos you sent and your profile picture, and everything you said in the Floor's chat — except the copies a report keeps, described above. You are back where you started: signed in, with nothing anyone can find, follow or message.
If you join folder alerts on the trading desk, we keep, with your account: the tickers, threshold, levels and sound you choose; your pass's dates; how many people joined from your share link (and, if you joined from someone's link, that it was theirs); your account's email address, to tell you when alerts switch on if you haven't connected Telegram; and, if you connect Telegram, your Telegram chat id — not your name, username or phone number. It's kept in our data store (Upstash).
Each snapshot reads public quote pages once for everyone: the market's movers and every member's tickers together, with nobody's name attached. That read goes through Anthropic's web search. We keep each reading for three days, a summary of each send (counts, not names) for thirty days, and the signals sent (ticker, price and time) for sixty days, to say how earlier names have done since and to judge whether the signals were worth sending.
Our bot, @Folder_Alerts_bot, sends to the chat id you connect, and Telegram's own privacy policy covers Telegram. Send /stop to the bot, press Disconnect on the Floor, or Leave, and nothing more is sent there. Browser notifications, if you allow them, are shown by your own browser while the page is open; we keep nothing for them. Passes are paid through Stripe: we receive the pass you bought and its dates, never your card.
Leaving: Leave removes your record. Leave with a pass still to run and we keep the record (without your Telegram chat id) until the pass ends, so it's yours if you join again; then it's deleted. Deleting your account removes the record and your share code; a pass still to run is archived with your other purchases as its dates and kind only (see 7a).
Because your analyzed data never leaves your browser in readable form, we have nothing to retain about it. If you use the optional "Save report" feature, that data is stored only in your own browser on that device — we hold no copy — and it remains until you delete it in the app or clear your browser data. If you use the optional "Send to my phone" feature, the encrypted copy (which we cannot decrypt) is deleted the moment your other device retrieves it, and automatically after 15 minutes in any case. Account and billing records are kept for as long as your account is active and as needed to meet legal, tax, and accounting obligations.
Full instructions, on a page you can reach without signing in: Delete your account.
You can delete your account yourself, from inside the app: open the account menu, choose Manage account, then Delete account. You do not need to ask us, and you do not need to give a reason. If you are locked out and cannot reach that button, email ps.insightfulactions@gmail.com and we will do it for you.
When an account is deleted, our systems immediately remove the live records tied to it: your entitlements, the list of material you licensed, and your usage counters. What we keep is deliberately narrow, and we would rather describe it plainly than let you discover it later:
If you would rather we erase the purchase record too, say so and we will. Email us from the address on the account before or after deleting it and we will remove the archived record as well — at which point signing up again starts genuinely from zero, and anything you previously paid for will not come back. We are telling you this because a deletion that quietly preserves something is only acceptable if you know about it.
If you joined the community, your community profile goes with the account, as section 6b describes.
Anything stored on your own device — saved reports, preferences — is not ours to delete and is not touched by any of the above. Clear your browser storage and it is gone.
Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you (your account and billing records), and to object to or restrict certain processing. Deletion you can do yourself at any time — see section 7a, which also sets out exactly what is removed and what is not. For anything else, email ps.insightfulactions@gmail.com and we'll respond within a reasonable time. You can also clear on-device data at any time by clearing your browser storage.
We use reputable providers and reasonable technical measures to protect the limited information we handle, including encryption in transit. Keeping your analyzed data in the browser is itself a privacy safeguard. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.
The Service is intended for adults and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it. The community (section 6b) is for people 18 and older; we close any community profile we learn belongs to someone younger.
The Service is operated from the United States, and information we process may be handled in the United States and other countries where our providers operate. By using the Service you understand your information may be transferred to and processed in these locations.
We may update this Privacy Policy as the Service evolves. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app. Continued use after changes take effect means you accept the revised policy.
Questions or requests about this policy or your data: ps.insightfulactions@gmail.com.