Privacy Policy

Account and authentication. We use Supabase Auth to create and sign in to your account via email and password or Google OAuth. We store session cookies on your device. Account metadata may include a timestamp of when you accepted our Terms and this policy (terms_accepted_at).

Study data. When you generate or use a plan, we store study schedules, onboarding preferences, plan settings, full-length scores you enter, and optional mistake-logger entries associated with your account.

Payments. Paid unlocks are processed by Stripe. Stripe handles card details. MPlan stores entitlement and tier information on your profile; we do not store full card numbers.

Analytics and advertising measurement. We use Google Analytics to understand aggregate usage of the Service (for example, which pages are visited). We also measure the performance of our advertising on Google and Reddit, which involves recording that a visit or purchase followed a particular ad or campaign.

Cookies. In addition to session cookies, we store a first-party cookie named mplan_attribution for up to 30 days. It holds campaign parameters and advertising click identifiers from the link you arrived through (for example utm_source or a Google or Reddit click id) so we can tell which campaigns lead to sign-ups. It does not contain your name or email address.

We use this information to operate the Service: authenticate you, generate and display your study plan, process one-time unlocks, improve the product, and comply with law.

We do not sell your personal information for money. We do use advertising and analytics technologies that share limited identifiers — such as an advertising click identifier or a cookie id — with Google and Reddit to measure the performance of our advertising. Some privacy laws describe this as “sharing.”

We retain account, plan, and related data for as long as your account exists. If you wipe or delete your account from the product, we delete application data associated with your user id and the Supabase Auth user. Backup copies may persist for a limited period as part of ordinary operations.

Authentication is provided by Supabase. Payments are processed by Stripe. Analytics are provided by Google Analytics. Transactional emails are processed by Resend. Advertising measurement is provided by Google (Google Analytics and Google Ads) and Reddit. Those processors handle data under their own terms and privacy policies.

We may update this policy as the Service changes. When we do, we revise the date shown at the top of this page. Material changes apply going forward from that date.

Privacy questions may be directed through www.themplan.com.