Privacy Policy

Last updated: September 26, 2026

1. Introduction

Yolo or Bust ("we," "us," or "our") operates yolobust.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information you provide directly: full name, email address, date of birth, country of residence, market experience level, how you heard about us, password (processed by Supabase Auth and stored as a hash).

2.2 Information collected automatically: IP address, browser type and version, pages visited and time spent, referring URLs, device type (mobile/desktop).

2.3 Payment information: We do not store credit card numbers or banking details. All payment processing is handled by Stripe, Inc. We receive only a confirmation of payment, subscription status, customer identifiers, and gift-membership checkout status.

2.4 Optional Wealth Path information: If you choose to use My Wealth Path, you may manually enter planning information such as age, state, filing status, approximate annual household income, monthly take-home pay, monthly expenses, emergency savings, consumer debt details, 401(k) access, Roth IRA status, contribution estimates, index-fund planning numbers, high-risk bucket planning amounts, monthly budget figures for each month you save, monthly check-ins, and notes. This data is self-reported and optional.

2.5 Information we do not request: The current manual product does not ask for bank logins, brokerage logins, account numbers, Social Security numbers, employer payroll access, or exact account access for Wealth Path or Wealth Tools. If optional read-only account linking is offered later, it will require a separate consent flow. Manual entry works forever, and imported values can suggest updates but will not silently overwrite numbers you entered. We will identify the provider, disconnect controls, and deletion controls before any connection is created.

2.5.1 Receipts, statements, and CSV files you choose to read: Budget Builder can read a receipt photo, a statement PDF, or a bank CSV export to suggest budget figures. The file is read in your browser on your own device. It is not uploaded to us or to any AI provider, and we do not keep the file, its individual transactions, merchant names, or any account numbers it contains. Suggested figures change nothing until you review and apply them, and only the category totals you then save become part of your Wealth Path data. To warn you about reading the same file twice, your browser may keep a one-way fingerprint of files you applied; it stays on your device and cannot be turned back into the file.

2.5.2 Your category choices: If you sort a merchant into a budget line or subcategory (for example, a store into Shopping, Home goods) and leave "remember" on, the merchant's name and your chosen category are kept in your browser and, when you are signed in, in your account so they apply on your other devices. Subcategory totals you save for a month are kept with that month. No amounts, dates, or individual transactions are kept with these choices. They are included in your data export and removed when you delete your Wealth Path data or your account.

2.6 Calculator inputs: Wealth Tools may process numbers you type into calculators, such as salary, state, filing status, mortgage assumptions, debts, or contribution amounts. Unless a tool clearly saves data to My Wealth Path, calculator inputs are used to show the estimate on screen and are not a request for official tax, payroll, bank, or employer records.

2.7 Support, gifts, and email logs: If you contact support, buy a gift membership, claim a gift membership, request a password reset, or receive an account email, we may store the related message, delivery status, email address, gift recipient details, and operational metadata needed to run that workflow.

2.8 Optional reminders, statements, and feedback: Card reminders store nicknames, manually entered benefit and renewal dates, estimated values, and usage history. Do not enter card or account numbers. Saved quarterly statements retain copies of the Budget months and review activity you choose to save, separate from your current balances. Beta feedback stores your answers and contact email. Public quotes require your explicit publication consent; your contact email is not published with a quote.

2.9 Operational reliability: We count server errors by hour, request method, route pattern, and response status. These counters do not contain account identifiers, submitted values, query strings, or message bodies. Counters older than 14 days are removed when operational counters are next recorded or checked.

3. How We Use Your Information

We use the information we collect to: (a) provide and maintain the Service; (b) process your subscription and send receipts; (c) send you the earnings calendar digest and research reports you subscribed to; (d) send you account-related emails (confirmation, password reset, subscription updates); (e) send you one follow-up email if your profile is incomplete, sent 7 days after registration; (f) respond to your inquiries; (g) improve and personalize the Service; (h) calculate optional Wealth Path progress summaries from information you manually enter; (i) fulfill and claim gift memberships; (j) provide data export and deletion controls; (k) comply with legal obligations; (l) enforce our Terms of Service.

4. Email Communications

By signing up for Yolo or Bust, you agree to receive: (a) transactional emails (account confirmation, password reset, payment receipts, support notifications, and gift claim emails); (b) the earnings calendar digest and AI-generated research reports (Pro tier). You may pause or resume newsletter emails from Account, and newsletter issues include a signed unsubscribe link. Transactional emails cannot be opted out of while your account is active.

We keep internal email logs so we can troubleshoot delivery, support, password reset, gift, and subscription messages. Data exports omit provider message identifiers, raw webhook payloads, and internal message metadata.

5. How We Share Your Information

We do not sell your personal information. We share your information only with: (a) Supabase - our database and authentication provider; (b) Stripe - our payment processor; (c) Resend - our email delivery provider; (d) Google Workspace or Gmail routing tools, if used for founder/support inbox delivery; (e) Anthropic - our AI provider, which may process ticker and market data but not your personal information; (f) law enforcement if required by law, court order, or governmental authority.

We do not intentionally send your manually entered Wealth Path planning numbers to AI providers for personalized financial advice. If this changes in the future, we will update this policy and the product copy before using that data in a new way.

Connected-account access is not live in the current product. If we later offer optional read-only account linking through Plaid or another provider, we will update this policy, show a consent screen before linking, keep manual entry available, and treat imported values as suggestions unless you choose to apply them.

6. Data Retention

We retain your personal information for as long as your account is active and as needed to operate the Service, provide support, keep payment records, prevent abuse, or satisfy legal obligations. Stripe, Resend, Supabase, and other service providers may also retain processor records according to their own policies.

You can download a JSON export from Account. The export includes account, membership, gift, support, email-log, feedback, card reminders, saved statements, and Wealth Path records where available, while omitting reset tokens, confirmation tokens, calendar tokens, gift claim hashes, provider IDs, raw email webhook payloads, and internal message metadata.

You can manage newsletter preferences from Account and can delete My Wealth Path planning data without deleting your login. You can also request full account deletion from Account. Full account deletion removes your app login, profile row, Wealth Path data, saved statements, card reminders and usage, feedback associated with your account email, support messages, email preferences, email logs, password-reset tokens, calendar tokens, and membership entitlement rows that belong to your account. An unfinished deletion request retains the minimum account and cleanup identifiers so support can finish it if a provider or database step fails. This recovery record is removed after cleanup succeeds.

Self-serve account deletion is blocked while an active Stripe subscription entitlement is still open, because billing access must be canceled first from Manage subscription. Some payment records may remain in Stripe and in our tax/accounting records where retention is required.

Gift purchase history may be retained in scrubbed form so the transaction trail remains understandable without keeping the deleted user's personal details. When a deleted account was a gift giver or recipient, we remove or replace account-linked names, email addresses, notes, claim-token hashes, and user identifiers where the app controls those fields.

7. Data Security

We implement industry-standard security measures including: (a) all data transmitted between your browser and our servers is encrypted using TLS/HTTPS; (b) passwords are hashed using bcrypt via Supabase Auth and are never stored in plaintext; (c) payment data is handled exclusively by Stripe and is never stored on our servers; (d) access to our personal account data is protected by authentication and access controls; (e) the current product has no linked-account access tokens because connected accounts are not live. However, no method of transmission over the Internet is 100% secure and we cannot guarantee absolute security.

8. California Privacy Rights (CCPA)

8.1 Right to Know - You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collecting it, and the categories of third parties with whom we share it.

8.2 Right to Delete - You have the right to request deletion of your personal information, subject to certain exceptions. Account includes self-serve deletion controls for app-owned data, except where an active Stripe subscription must be canceled first or where records must be retained for legal, security, billing, or tax reasons.

8.3 Right to Opt-Out of Sale - We do not sell your personal information. You do not need to opt out.

8.4 Right to Non-Discrimination - We will not discriminate against you for exercising your CCPA rights.

8.5 How to Exercise Your Rights - Use the export and deletion controls in Account where available, or contact us at yoloorbust@gmail.com. We will respond within 45 days. We may need to verify your identity before processing your request.

8.6 Shine the Light - We do not disclose personal information to third parties for direct marketing purposes.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will delete such information immediately.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

11. Cookies

We use essential storage for: (a) keeping you logged in (session token in localStorage); (b) remembering your theme preference (dark/light mode); and (c) remembering your cookie choice. We do not use advertising or remarketing cookies.

Optional analytics (Google Analytics 4) only loads after you choose Accept analytics on the cookie banner. When enabled, it records page views and which free tools or CTAs you open (for example Budget, Guide, Tools, Sign up, and the beta feedback form) so we can understand traffic and improve the product. Analytics storage is denied by default until you accept. You can stay on Essential only and still use the full Service. IP anonymization is requested when analytics is active.

If you submit the optional open-beta feedback form, we collect the email you type so we can send one month of Pro when that gift is ready, plus any answers you choose to give. That form is not a newsletter signup. Skip any question except email.

12. International Users

The Service is operated from the United States. If you are located outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on the Service.

14. Contact Us

For privacy-related questions, requests, or complaints, contact us at: yoloorbust@gmail.com. We will respond to all inquiries within 30 days.