Privacy Policy

What we collect

• Account information — name, email, username, phone number, and password (stored as a salted hash, never in plain text).
• Access and security logs — sign-ins, IP address, and request patterns, kept to detect abuse and enforce rate limits on the free and paid tiers. This is not a record of every page you view.
• Billing status — whether your subscription is active and when it renews. Your card number, expiration date, and CVC are never sent to or stored by HazFin; Stripe handles all of that directly.
• Anything you submit — messages sent through the claims form, or support correspondence by email.

What we don't collect

HazFin has no advertising or analytics trackers, and does not sell, rent, or share your personal information with data brokers or advertisers. There is nothing here to opt out of on that front — it doesn't happen in the first place.

Who we share data with

Only the services that keep HazFin running:

• Stripe — payment processing for paid subscriptions.
• DigitalOcean — application hosting and the database.
• Cloudflare — DNS and network security for hazfin.com.
• Our email provider — sending account verification and correspondence.

None of these providers may use your data for their own purposes beyond providing that service to us.

Cookies

HazFin sets two cookies: one to keep you signed in, and one for CSRF protection (a security measure required for any form submission). Both are functional and expire automatically — there is no third-party advertising or tracking cookie on this site.

Data retention

We keep your account information for as long as your account is active. Access logs are retained only as long as needed for abuse detection and are not kept indefinitely. If you close your account, contact us and we will delete your personal information except where we are required to keep billing records for tax or legal purposes.

Your rights

You can review or correct your account information at any time by signing in. To request a copy of your data, ask us to delete it, or raise any other privacy question, use Submit a claim if you're signed in, or reply to any email from us.

Security

All traffic to HazFin is encrypted (HTTPS is enforced site-wide). Passwords are hashed, never stored or logged in plain text. No system is completely immune to compromise, but we do not collect more than we need in the first place, which limits what there is to lose.

Children's privacy

HazFin is a business tool and is not directed at, or knowingly used by, children under 16. We do not knowingly collect information from anyone in that age group.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page. Continued use of HazFin after a change means you accept the revised policy.