Privacy Policy

Last updated: April 24, 2026

SoftProgrammer ("we", "us", "our") operates softprogrammer.com and the SoftProgrammer iOS app (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have.

If you have questions or want to exercise any of the rights below, email support@softprogrammer.com.

1. Information we collect

Account data — Full name and work email you provide at signup, plus (optional) company name, the password hash generated by our auth provider, and the time of your signup.

Project data — Descriptions, requirements, budgets, timelines, attached files, and messages you submit when you request a quote, book a demo, or open a project in your dashboard.

Payment data — If you purchase a subscription or build, Stripe processes your payment details on our behalf. We do not store your full card number — we store only a token reference and limited billing metadata (card brand, last 4, country, subscription status).

Communications — Emails, chat transcripts with our AI assistant, support conversations, and any files you share during those conversations.

Usage data — IP address, user agent, pages viewed, referring URL, timestamps, approximate location derived from IP (country/region level), and device type. We collect this via server logs.

We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

2. Why we use it (legal bases)

  • To provide the Service — authenticating you, building what you've asked for, sending you project updates (performance of a contract).
  • To communicate with you — reply to support requests, notify you of material changes, send transactional emails (performance of a contract; legitimate interests).
  • To bill you — process payments, send invoices, handle refunds (performance of a contract).
  • To improve the Service — aggregate, anonymized analytics and product research (legitimate interests).
  • To keep the Service secure — detect abuse, prevent fraud, enforce our Terms (legitimate interests; legal obligation).
  • To comply with law — respond to lawful requests, preserve records we are required to keep (legal obligation).

We do not sell your personal data, and we do not use it to train third-party large language models without your explicit consent.

3. Who we share it with (sub-processors)

We share the minimum necessary data with the following sub-processors. Each is contractually required to protect your data and use it only to provide services to us.

  • Supabase — authentication, Postgres database, file storage (US).
  • Amazon Web Services — hosting (US).
  • Stripe — payment processing (US / Ireland).
  • Resend — transactional email delivery (US).
  • Google — "Sign in with Google" OAuth (US / global).
  • Anthropic — powers our AI chat assistant on /contact (US).

We do not share your personal data with advertisers or data brokers. We disclose data to law enforcement only when legally compelled and, where permitted, we will tell you first. If we are involved in a merger, acquisition, or asset sale, your personal data may transfer to the successor, bound by this Privacy Policy or a materially similar one.

4. International transfers

Our infrastructure is based in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms with our sub-processors.

5. How long we keep it

  • Account data — while your account is active, plus 90 days after deletion.
  • Project data — while your account is active, plus up to 7 years thereafter for contractual, warranty, and tax recordkeeping, unless you ask us to delete it sooner.
  • Payment records — 7 years (tax and accounting requirements).
  • Server and security logs — 90 days, then aggregated or deleted.
  • Support tickets and AI chat transcripts — 2 years.

6. Cookies and similar technologies

We use a small number of first-party cookies and localStorage entries: session cookies to keep you logged in, CSRF protection, cookie-preference memory, and UI preferences such as your decision-helper answers. We do not use advertising cookies or third-party tracking pixels. If we add analytics in the future, we will update this policy and, where required, ask for your consent first.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to withdraw consent where we relied on it. EU/UK residents may also lodge a complaint with their local supervisory authority. California residents: we do not sell or "share" your personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these rights, email support@softprogrammer.com from the address on your account. We will respond within 30 days (or 45 days for complex requests, with notice to you).

8. Security

We use industry-standard measures to protect your data: encryption in transit (HTTPS with HSTS) and at rest; role-based access controls and audit logging; salted password hashes; security headers on every response; and regular dependency updates with automated vulnerability scanning. No system is perfectly secure. If we discover a breach that affects your personal data, we will notify you without undue delay and, where legally required, within 72 hours of becoming aware of it.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top. If changes are material, we will email account holders at least 14 days before the change takes effect.

10. How to reach us

For privacy questions, data requests, or to exercise your rights: support@softprogrammer.com.