Privacy Policy

Last updated: October 17, 2026

This policy explains what PaidCheck ("we", "us") collects, why, and what control you have over it. In short: we read as little as possible, keep it encrypted, and delete it when you delete your app.

1. Two kinds of people

Customers are the founders who sign up for PaidCheck. End users are the people who use a customer's app. For end-user data, the customer decides what to connect, and we process it on the customer's behalf, only to provide the Service.

2. What we collect

• Account data: your email address, your plan, and timestamps such as sign-up and last check.
• Credentials you give us: a Stripe restricted read-only key, and either an access-feed URL plus bearer secret or a Supabase project URL, anon/publishable key and PaidCheck secret.
• Stripe data, read with your key: customers (ID and email), subscriptions (status, price, interval), charges (amount, currency, time, refund status), events that weren't delivered to your webhooks, and webhook endpoint URLs and status.
• End-user access data from your app: email, plan name and an active/inactive flag. Nothing else.
• Reports: the findings we generate, which can include end-user emails, Stripe object IDs and amounts.
• Billing data for PaidCheck itself: handled by Stripe. We store your Stripe customer and subscription IDs, never your card details.
• Technical data: IP addresses (stored as one-way hashes for rate limiting) and standard server logs from our hosting provider.
• Usage analytics: we use Vercel Web Analytics, which doesn't use cookies, to count page views and anonymous product events (for example "free report started"). Event data never includes your keys, secrets or email address.

3. Free leak report

For the free one-time report, your keys and data are used only for that single request. The results are sent to your browser and we don't store the keys, the Stripe data or the report.

If you tick the optional box and enter an email, your browser sends that address in a separate request, never together with your keys. We email you a summary (totals and issue counts, no customer emails) and add your address to our PaidCheck updates list, held by our email provider (Resend). Every update email has an unsubscribe link. We never store or log the address alongside your Stripe or Supabase keys.

4. How we use data

Only to run reconciliation checks, show your reports, send the emails you signed up for (sign-in links, alerts, the Monday summary, and, only if you opted in, your free-report summary and occasional product updates), bill you for PaidCheck, prevent abuse, and keep the Service working. We don't sell data, don't use it for advertising, and don't contact your end users.

5. Security

• Stored credentials are encrypted at rest with AES-256-GCM. The encryption key is kept separate from the data, in server-side environment variables.
• We accept only Stripe restricted keys and refuse full secret keys and Supabase service-role keys, so a leaked credential can't be used to change your data.
• Data is stored in private storage, and all traffic uses HTTPS.

No system is perfectly secure. If we learn of a breach affecting your data, we'll notify you without undue delay.

6. Retention and deletion

• Deleting an app immediately deletes its encrypted credentials and its stored report.
• We keep only the latest report per app and overwrite it on each check.
• To delete your account and everything tied to it, email support@paidcheck.app. We'll do it within 30 days.
• Billing records may be kept as long as tax and accounting law requires. Sign-in links expire after 15 minutes and can be used only once.

7. Service providers

We use Vercel (hosting and storage, USA), Stripe (reading your billing data with your key, and our own billing), and an email delivery provider (currently Resend) to send account emails. They process data only to provide their services to us.

8. Cookies

We use one essential, HTTP-only session cookie to keep you signed in. No advertising or third-party tracking cookies. Our analytics (Vercel Web Analytics) is cookieless.

9. Your rights

You can access, correct, export or delete your data by contacting us. Depending on where you live, for example in California under the CCPA, you may have additional rights. We won't discriminate against you for using them. End users of a customer's app should contact that customer first; we'll help them respond.

10. Children

PaidCheck is a business tool and isn't meant for anyone under 18.

11. Changes

If we make material changes, we'll update this page and email customers before they take effect.

12. Contact

PaidCheck · support@paidcheck.app