Privacy Policy

1. Information We Collect

We collect only what's necessary to provide and improve the Service:

• Account data — your email address and a hashed password, collected at signup
• Monitoring configuration — the store domains you add, watchlists you create, and alert rules you set
• Product data — publicly available prices, titles, images, and availability from the stores you monitor (this is store data, not your personal data)
• Usage data — pages visited, features used, and error logs to diagnose issues and improve the Service
• Payment data — if you subscribe to PRO, Stripe processes your payment. We do not store your card number; Stripe provides us with a customer ID and subscription status

2. How We Use Your Information

• Provide, maintain, and improve the price monitoring service
• Send price change alerts and digests to your configured destinations
• Authenticate your sessions and protect your account
• Process payments and manage subscriptions via Stripe
• Send essential service communications (e.g., security alerts, billing receipts)
• Diagnose bugs and optimize performance

We do not use your data for advertising, behavioral profiling, or selling to third parties.

3. Cookies and Local Storage

We use a minimal set of cookies:

• Session cookie (bs_app_session) — HttpOnly, secure, used for authentication. Expires when your session ends or after 30 days.
• CSRF token (bs_csrf_token) — protects against cross-site request forgery. Matches your session lifetime.
• Theme preference — stored in localStorage (not a cookie), remembers your dark/light mode choice.

We do not use analytics trackers, advertising pixels, or third-party cookies.

4. Data Storage and Security

Your data is stored on our self-hosted infrastructure. We implement industry-standard security measures including:

• Passwords hashed with bcrypt (never stored in plaintext)
• HTTPS encryption for all connections
• CSRF protection on all state-changing requests
• Rate limiting on authentication endpoints
• Admin endpoints gated by role-based access control

5. Data Retention

We retain your data as follows:

• Account data — kept while your account is active, deleted within 30 days of account deletion
• Product monitoring data — historical price and change data retained for up to 12 months for active stores
• Server logs — retained for up to 90 days for debugging, then automatically purged
• Payment records — kept as required by tax and financial regulations (typically 7 years)

6. Data Sharing and Subprocessors

We do not sell your personal information. We share data only with the following service providers as needed to operate the Service:

• Stripe — payment processing for PRO subscriptions
• Email provider — transactional emails (account verification, password resets, alerts)

We may also disclose information if required by law, court order, or to protect the safety of our users.

7. Your Rights

You have the right to:

• Access — view the personal data we hold about you
• Correction — update your email or other account details
• Deletion — request deletion of your account and associated data
• Export — download your monitoring data (available via CSV export on PRO, or by request for free users)
• Opt out — disable non-essential notifications from your settings

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Children's Privacy

Bonesaw is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a minor has created an account, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy as our practices evolve. Material changes will be communicated via email or a notice within the Service at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

10. Contact

For privacy questions, data requests, or concerns, email [email protected].