Privacy Policy for MakerProfit

1. Overview

This policy explains what MakerProfit stores about you, why, and how to get it back or have it deleted. MakerProfit is run by a single maker, who is the data controller. Contact: joffrey@joffreyio.com.

2. What we store

• Account — your email address, and the account identifier Google or X returns if you sign in with them. There is no password.
• Your ledger — your projects, the money in and out you record or import, your contractors and payables if you use them, and your badge settings if you publish one (a published badge is public by design).
• Provider connections — the restricted Stripe or Lemon Squeezy key you paste, encrypted with AES-256-GCM, and monthly totals computed from it. Imports keep counts and amounts, never your customers’ names, emails or payment references.
• Billing — your plan, its status and your Stripe customer ID. Card details are entered on Stripe and never reach MakerProfit.

We use this to run the service, sign you in securely, bill you, and check that the site works. Your data is never sold, never shared with advertisers, and never used to train a model.

3. Who processes it

• Appwrite — authentication, database and the sign-in email. Hosted in Frankfurt, Germany.
• Stripe — payments.
• Vercel — hosting and cookieless, aggregate analytics.
• Sentry — error monitoring. It receives errors and a replay of each visit: clicks, screens and what they show, including the figures and what you type, except provider API keys, which are masked in your browser. When you are signed in, the replay and any error carry your account ID, email and IP address. No cookies or request bodies are sent.

Stripe, Vercel and Sentry are US companies; transfers rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

4. Retention and deletion

Your data is kept as long as your account exists. Cancelling a plan does not delete anything. Sentry error reports expire on their own within 90 days. Invoices are kept by Stripe for as long as accounting law requires (ten years in France).

You can export everything from the app, on every plan. To delete your account, use Delete my account on the Account screen: your projects, lines, contractors, badge and encrypted provider keys are erased immediately, with the account itself, and a paid plan is cancelled the same minute. You can also email joffrey@joffreyio.com and it is done by hand within 30 days. Disconnecting a provider deletes its key immediately.

5. Cookies

Two strictly necessary cookies: the session that keeps you signed in, and a short-lived one that ties a sign-in link to the browser that requested it. No advertising, analytics or third-party cookie, so no consent banner. Your theme choice stays in local storage.

6. Your rights (GDPR)

You can access, correct, export or delete your data, and object to or restrict its processing. Email joffrey@joffreyio.com and you will get an answer within one month. You can also complain to the CNIL (cnil.fr) or the authority where you live.

7. Security

Every record is owner-only, provider keys are encrypted at rest, and card data never touches MakerProfit. There is no formal certification (ISO 27001, SOC 2). Report a vulnerability to joffrey@joffreyio.com before disclosing it.

8. Updates to this policy

Material changes are announced in the app at least 30 days ahead, and the date above changes. See also the terms.