Privacy Policy

Overview

STWLTH ("STWLTH", "we", "our", "us"), a trade name of MXLIS1040 LLC, operating Stwlth Software and Stwlth Wealth, operates stwlth.com. We take your privacy seriously. It's not a feature, it's the foundation of how we build. This policy explains what data we collect, what we don't, and how we protect it.

What We Collect

• Account information: Email address and authentication data when you create an account. Managed by Clerk (clerk.dev). We support email/password and OAuth sign-in.
• Email you give us to use the tools: If you use a Stwlth Wealth calculator without signing in, we ask for an email address once. We store that address, the tool you were on, the time, and your browser's user-agent string. We use it only to send occasional STWLTH updates, and we never sell or share it. A small flag in your browser's local storage (not a cookie) remembers that you've entered it. Ask us to delete it anytime at support@stwlth.com.
• Project inquiries: If you contact STWLTH through an inquiry form, we store what you submit (name, company, email, project details) to reply to you. We send one automatic email to that address with a link to book an intro call, and the founder gets a copy of your inquiry by email. If you book, we store the time, your name, email, and any note, and create a Google Calendar invite (with a Google Meet link) for you and the founder.
• Subscription data: For accounts that had a Premium or Ultimate subscription: the tier and Stripe customer ID. Payment and billing information is processed entirely by Stripe. We never see or store your card details. New subscriptions are no longer sold.
• Saved scenarios: Calculator inputs you explicitly choose to save. These are stored in our database (Supabase, PostgreSQL) and are accessible only to you via row-level security policies. We cannot see other users' scenarios.
• Analytics: We use cookieless, privacy-respecting analytics (Umami and Vercel Web Analytics) to understand how the product is used (page views, tool popularity), reported only in aggregate. We also count a few steps people take: starting or sending an inquiry, booking an intro call, unlocking a tool with your email, signing up, and starting or finishing checkout. These counts carry categories only (for example, which form or which tool), never your name, email, messages, or the numbers you enter. No personal data is collected, no tracking cookies are set, and no data is shared with advertising platforms.
• Security reports: If a page breaks our Content Security Policy, your browser sends us a report automatically. It records the page address (with any booking or share link token removed), the blocked resource, and your browser's name and version. We use these reports only to fix site errors.

What We Don't Collect

This is the part we care most about. We will never:

• Access your bank accounts or brokerage. There is no Plaid integration, no account linking, no screen scraping. We don't want your credentials and we don't need them. You type in your own numbers. We do the math.
• Sell or share your data. We don't sell your data to third parties. We don't share it for advertising. We don't use it for marketing profiles, and we don't make money from it.
• Track you with cookies. We don't use tracking cookies, advertising cookies, or third-party marketing pixels. Our analytics are cookieless by design.
• Store calculator inputs you don't save. If you use a calculator without saving, your inputs exist only in your browser and are discarded when you leave the page. Nothing is sent to our servers unless you click "Save."

AI Answers (Ask S.W.)

Some calculators offer an opt-in "Ask S.W." feature that explains the math of your current scenario using an AI model. It is off until you use it, and the first use shows a disclosure.

• What's sent: Only your question and the active calculator's numeric inputs and results. No name, email, account ID, or data from other tools. Your question also goes to Voyage AI to match it against our own methodology documentation.
• Who answers: By default, the request goes to Anthropic (Claude) under our account. If you add your own API key from Anthropic, OpenAI, or Google (Gemini), your requests go instead to that provider under your own key and account, and that provider's terms and privacy policy apply to them. We store your key encrypted and use it only for your Ask S.W. requests; you can remove it at any time.
• What's stored: Anonymous aggregate counters (question counts, token usage, latency, thumbs up/down) and a cache of answers keyed by an irreversible hash. Daily usage limits are tracked against a salted hash of your user ID or IP address; the raw value is never stored.
• What's never stored: Your questions, your scenario values, or any link between a question and your identity. We cannot reconstruct who asked what.
• Daily limits: 3 answers per day when signed out and 25 with a free account (100 for existing Ultimate subscribers). Limits reset each day (UTC) and exist to keep the feature sustainable.

Cookies

We use only strictly necessary cookies for authentication, keeping you signed in across page loads. These are session cookies managed by Clerk and are required for the app to function.

Your browser also keeps a few small settings for us in its local and session storage, such as whether the sidebar is open or you have seen a notice, and an offline copy of public pages so the free calculators work without a connection. These are not cookies and, apart from a referral code (below), they stay on your device. You can clear them in your browser settings at any time.

Referral links: if you arrive through a referral link (one ending in ?ref=), we keep that code in your browser's local storage for 30 days. If you start a checkout in that time, we send the code to Stripe with your checkout so the person who referred you gets credit.

We do not use:

• Tracking cookies
• Advertising or retargeting cookies
• Third-party marketing pixels (Facebook, Google, etc.)
• Cross-site tracking of any kind

Because we only use strictly necessary cookies, no cookie consent banner is required under GDPR or ePrivacy regulations.

Third-Party Services

We use the following services to operate STWLTH:

• Clerk: authentication and user management. Clerk loads on Stwlth Wealth pages, the sign-in and sign-up pages, and the client portal, not on the rest of stwlth.com. Privacy policy
• Cloudflare Turnstile: the bot check Clerk uses to protect sign-up and sign-in. It reads signals from your browser to tell people from automated scripts. Privacy policy
• Stripe: payment processing. Handles all card details directly. We never see them. Privacy policy
• Supabase: database hosting (PostgreSQL with row-level security). Privacy policy
• Google Workspace: Gmail sends inquiry replies and notifications; Google Calendar and Meet host booked intro calls. Privacy policy
• Vercel: application hosting and CDN, and Vercel Web Analytics (cookieless, aggregate pageview counts). Privacy policy
• Anthropic: AI answers for the opt-in Ask S.W. feature (numbers only, see above), under our account or, if you add your own Anthropic key, under yours. Privacy policy
• OpenAI: answers Ask S.W. requests only for users who add their own OpenAI key (under their own account). Privacy policy
• Google (Gemini): answers Ask S.W. requests only for users who add their own Gemini key (under their own account). Privacy policy
• Umami: cookieless, aggregate pageview analytics. Privacy policy
• Voyage AI: matches Ask S.W. questions against our methodology docs (question text only). Privacy policy

We do not use any advertising networks, data brokers, or analytics services that track individual users.

Data Security

• All data is encrypted in transit (TLS/HTTPS).
• Database access uses row-level security, so you can only access your own data.
• Subscription management uses Stripe's admin client with the service role key, which bypasses RLS only for webhook-driven updates. Users cannot modify their own subscription status.
• We use the principle of least privilege for all service integrations.
• Authentication tokens are short-lived and managed by Clerk.

Data Retention

• Account data: Retained as long as your account is active. Deleted upon account deletion request.
• Saved scenarios: Retained until you delete them or request account deletion. You can delete individual scenarios at any time from within the app.
• Subscription events: Retained as an audit log for billing disputes. Deleted upon account deletion request.
• Tool-access emails and project inquiries: Retained until you ask us to delete them (support@stwlth.com).
• Security reports: Deleted automatically after 90 days.
• Unsaved calculator inputs: Never stored. Exist only in your browser session.

Your Rights

You can:

• Delete your saved scenarios at any time from within the app.
• Cancel your subscription via the Settings page (Stripe Customer Portal).
• Export your data by contacting us.
• Request complete deletion of your account and all associated data by contacting us.

We aim to fulfill all deletion and export requests within 30 days.

Children's Privacy

STWLTH is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We will not reduce your rights under this policy without your explicit consent.

Contact

Questions about this policy? Email us at support@stwlth.com