Privacy Notice

1. Who is responsible and how to contact us

OrangeCheval is responsible for the processing described in this notice. For privacy questions, access requests, or deletion requests, email privacy@orangecheval.com.

2. Information we collect

• Account information. Your email address, authentication provider, account identifier, confirmation status, and account timestamps. Passwords are handled by Supabase Auth and are not visible to OrangeCheval in readable form.
• Google sign-in information. If you continue with Google, Google provides your name, email address, profile image, and a stable Google account identifier through the standard OpenID Connect profile. We do not request access to Gmail, Google Drive, Google Contacts, calendars, files, or other Google service content.
• Alert preferences. The markets and bag families or styles you choose, together with preference-update timestamps.
• Notification information. A browser push endpoint, encryption keys, browser or device user-agent information, delivery timestamps, and failure counts when you enable push notifications.
• Usage and technical information. Page views, referral and campaign information, bounded product events, error information, device and browser details, network information, and masked session replay. Form inputs and visible page text are masked in replay, and recorded network URLs have query strings and fragments removed.

3. How we use information

• Create, authenticate, secure, and administer your account.
• Save your selected markets and bag preferences and send requested availability or test notifications.
• Operate, troubleshoot, protect, measure, and improve OrangeCheval.
• Prevent abuse, investigate errors, enforce our Terms of Use, and comply with legal obligations.
• Respond to support, privacy, and account-deletion requests.

4. Google user data

OrangeCheval uses Google information only to create, secure, and sign you into your OrangeCheval account. It is not used for advertising, sold, or used to determine creditworthiness. We do not separately save Google access or refresh tokens in the OrangeCheval application database, and we do not request offline access.

Basic Google profile data is not sent to PostHog. After authentication, analytics may use your internal Supabase user UUID; it does not receive your Google account identifier, email address, name, or profile image.

OrangeCheval’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

5. When we share information

We do not sell personal information. We share information only as needed with service providers that process it for us, when you direct us to, to protect rights and safety, or when law requires it.

• Supabase provides authentication and the hosted database.
• Vercel hosts the website and provides web analytics and performance measurement.
• PostHog US Cloud provides product analytics, error capture, and masked session replay.
• Resend delivers account email, and browser push services deliver notifications you enable.

6. Cookies and local storage

OrangeCheval and its providers use browser storage and similar technologies for authentication, security, app installation, notification setup, remembering state, analytics, and performance measurement. You can block or clear these technologies using browser or device settings, although blocking necessary storage may prevent account or notification features from working.

7. Retention and deletion

We keep account and preference information while your account is active. Unconfirmed accounts are scheduled for deletion after seven days. Operational, security, and analytics records may be kept for a limited period needed for the purposes above or as required by law.

To delete your account, email privacy@orangecheval.com from the address on the account. Deleting the Supabase Auth user cascades to stored bag preferences, selected markets, and push subscriptions. We will also request or perform deletion of associated processor records where appropriate; backups may expire on provider schedules. You may separately disconnect OrangeCheval from your Google Account at any time.

8. Your choices and rights

You may ask to access, correct, delete, or receive a copy of personal information, or object to or restrict certain processing. Available rights depend on where you live. You can disable push notifications in your browser or device settings, sign out, or revoke Google access through your Google Account. We may need to verify your identity before completing a request.

9. International processing and security

OrangeCheval and its providers may process information in the United States and other countries. We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security.

10. Children

OrangeCheval is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information.

11. Changes

We may update this notice as OrangeCheval changes. We will post the revised notice here, change the effective date, and provide additional notice when required. See the Terms of Use for the rules governing the service.