This Privacy Policy explains how EV Time LLC ("Account:dir," "we") collects, uses, discloses, and retains personal information when you use accountdir.com and the Service. It also explains what vault encryption does and does not protect. Contact us at privacy@accountdir.com about this policy or your privacy rights.

Information we process

Account and profile: Your sign-in email address, display name if provided, authentication and account status, and support preferences.

Records you enter: Providers, service names, usernames, sign-in email addresses, projects, tags, costs, renewal dates, billing cycles, notes, and relationships among those records. These fields can contain personal information about you or others. They are necessary to provide search, connected views, and cost summaries.

Vault secrets: Passwords, API keys, and other secrets you choose to save in the optional vault. Vault secret content is encrypted in your browser before upload. We store the resulting ciphertext and information needed to manage it. Your vault passphrase is not sent to us. We cannot read vault secret content using our normal systems, although no security design eliminates every risk.

Payments: Subscription status, plan, billing dates, transaction identifiers, cancellation reason you provide in the Stripe customer portal, and limited payment details made available by Stripe, such as card brand and last four digits if provided. Stripe handles payment card details. We do not collect your full card number through our systems.

Usage and technical data: IP address, device and browser information, request logs, security events, and essential cookies or similar technologies needed to sign you in, operate the Service, prevent abuse, and diagnose problems. We do not currently use analytics, advertising pixels, session replay, or third-party error monitoring.

Communications: Messages you send to support or security contacts and our replies.

We collect information from you directly, from your use of the Service, and from payment and authentication providers.

Why we use information

We use information to create and authenticate accounts; display and connect the records you enter; provide vault, export, search, billing, and support features; process subscriptions; detect abuse and security incidents; maintain and improve reliability; comply with legal obligations; and communicate material service or policy changes. We do not use vault secret content for advertising or model training.

Where a law requires a legal basis, these activities may rely on performing a contract, our legitimate interests in operating and securing the Service, legal obligations, or your consent where required.

How vault encryption differs from other data

Vault secrets are encrypted on your device before they reach our servers using AES-GCM. The passphrase-based key process uses PBKDF2 with 600,000 iterations and an envelope encryption design; the master key is held in browser memory during use. We do not receive or store the passphrase. Other account information may remain available to our systems to provide the Service. Encryption does not replace good device security, a strong passphrase, and secure recovery-key storage.

When we share information

We share information with service providers acting on our behalf to host and operate the app, store data, process payments, deliver essential messages, and protect the Service. We may also disclose information when required by law, to protect users or the Service, in a business transfer subject to applicable safeguards, or at your direction. Our Subprocessors page identifies providers used to operate the Service.

We do not sell vault secret content.

Retention and deletion

When you delete your account, our deletion process removes your authentication account and the associated records and encrypted vault data in our database. The related Stripe subscription is canceled; its customer metadata is cleared and the Stripe customer object is deleted. Account deletion ends access immediately, even if a paid period remains.

Our Supabase Free project does not have automated managed backups. Supabase logs are available for approximately one day and Vercel runtime logs for approximately one hour under the current plans. These service logs can contain technical information but are not copies of your vault records. We retain support and security correspondence as needed to answer requests, resolve disputes, and protect the Service; email provider retention is subject to its own settings. Stripe may retain transaction and invoice information for tax, accounting, legal, fraud-prevention, and compliance purposes after the customer object is deleted, subject to its own retention practices. We do not promise that deleting an Account:dir account removes those records from Stripe.

You can export your account data through the Service. Exports containing decrypted secrets are created at your request and should be handled carefully. Account deletion is available through /command-center/data, or you may contact privacy@accountdir.com.

Your choices and rights

You can review and update much of the information you entered while your plan permits editing. You may request access, correction, deletion, a copy of data, or other rights available where you live by contacting privacy@accountdir.com. We will verify requests and respond as required by applicable law. We will not discriminate against you for exercising a legal privacy right. Some requests may be limited by legal exceptions or the rights of others. If we cannot decrypt your vault, we may be unable to provide its contents in readable form without your passphrase or recovery key.

We use essential authentication and security cookies or similar technologies needed to operate the Service. You can control some cookies through browser settings, but disabling essential cookies may prevent sign-in.

Security, international access, and children

We use technical and organizational measures to protect information, including HTTPS and browser-side vault encryption. See our Security page. No internet service can guarantee absolute security. Application hosting is configured in Vercel's Washington, DC region and database hosting in Supabase's Northern California region. Other service providers may process information elsewhere; where law requires transfer safeguards, we will use an appropriate mechanism.

The Service is not directed to children under 18 and we do not knowingly permit them to create accounts. If you believe a child has supplied information, contact privacy@accountdir.com.

Changes and contact

We may update this Policy to reflect changes in our practices or law. We will post the new date and provide additional notice when required. Contact EV Time LLC at privacy@accountdir.com.