Legal

Privacy Policy

Last updated: October 10, 2026 · Effective immediately

This Privacy Policy describes how Crunchly ("we", "us", or "our") collects, uses, and shares information about you when you use our website, mobile applications, and related services (collectively, the "Services").

Plain-English summary: we collect what we need to run Crunchly and nothing more. Your calculator inputs live on your device; scenarios you choose to save on a paid plan are stored in your account. We don't sell your information. You can delete your account at any time.

1. Information We Collect

Information you provide

Account information: name, email address, and password (stored as a salted hash) when you create an account.
Billing information: if you subscribe to a paid plan, payment details are processed and stored by our payment processor (Stripe). We never see or store your full card number.
Deal data: property details, financial inputs, and calculations you enter into Crunchly. By default, this data is stored locally on your device. Optional cloud sync is available on Pro and Investor plans.
Communications: if you email our support team or fill out a contact form, we keep that correspondence to help you.

Information we collect automatically

Usage data: aggregate, non-identifying information about how the Services are used (page views, feature usage, error reports). We use privacy-first analytics that does not track individuals across sites.
Device data: browser type, operating system, screen size, and IP address (used for security and abuse prevention). Contact-form IP addresses are retained for up to 90 days and then permanently deleted; other server-log IPs are retained per our hosting provider's standard retention window.
Cookies: a small number of necessary cookies for login session management and your saved preferences. See our cookie disclosure below.

Ask Crunch AI conversations

When you use Ask Crunch, your typed questions and the deal context from the calculator you're viewing (the inputs and computed metrics) are sent to Anthropic's Claude API. We do not store the full conversation history on our servers. We do log a per-user usage counter so we can enforce monthly AI message limits on each plan tier.

2. How We Use Information

To provide, maintain, and improve the Services.
To authenticate users and prevent unauthorized account access.
To process subscription payments and send receipts.
To respond to your inquiries and provide customer support.
To send transactional emails (account verification, password reset, billing receipts). You cannot opt out of these without closing your account.
To send optional product updates if you opt in. You can unsubscribe at any time.
To detect, investigate, and prevent fraudulent or harmful activity.
To comply with legal obligations.

3. How We Share Information

We do not sell your personal information. We share information only in these limited circumstances:

We share specific information with the following service providers, each only to the extent needed to operate Crunchly. These vendors are contractually bound to use your information only as we direct.

Stripe (payments): name, email, billing address, and payment method. Stripe is PCI-DSS Level 1 certified and we never store full card numbers ourselves.
Supabase (database + auth + hosting): account information and session tokens.
Resend (transactional email): email address and the contents of any email we send you.
Vercel (hosting + serverless functions): standard server logs (IP address, user agent). Vercel keeps these logs for a limited period (no more than 30 days on our current plan); we do not extend that retention.
Anthropic (Ask Crunch AI): when you use the Ask Crunch chat assistant, your prompts and the deal context from the calculator you're viewing are sent to Anthropic's Claude API. Anthropic processes prompts under their own privacy policy. We do not store conversation transcripts on our servers; we only record a per-user usage count for billing purposes.
Google AdSense (advertising, Free plan only): Free-plan users may see ads served by Google. Google and its partners may use cookies to serve and measure ads, including ads based on your visits to this and other websites. You can opt out of personalized advertising at adssettings.google.com. Paid plans do not show ads. See how Google uses information from sites that use its services.
Google Analytics 4 (analytics): standard pageview data, anonymized IP, and event metadata. Loaded only after you accept our cookie banner.
Google Maps (map preview): when you enter a property address, the map preview is loaded from Google Maps, so Google receives that address along with your IP address and browser information.
OpenStreetMap Nominatim (address suggestions): as you type a property address, what you have typed is sent to OpenStreetMap's servers to suggest matching U.S. addresses.
FRED API / Federal Reserve Bank of St. Louis (mortgage rate data): used by our daily rate-change cron. No user data is sent — we only request public rate data.
Twitter / X (news feed embeds): the Investor Voices feed loads content directly from Twitter; Twitter may see your IP and user agent.
Finnhub and Yahoo Finance (Stock Tracker market data): our servers request public quotes and price charts for the stock symbols shown. No personal, account or deal data is sent.
Google Fonts: our pages load fonts from Google Fonts, so Google receives your IP address and browser information when a page loads.
Unsplash (article images): the Market News feature pulls article hero images from Unsplash; Unsplash may see your IP and user agent.
Amazon Associates (Book Club): when you click an Amazon book link, Amazon's standard tracking applies. We earn a small commission on qualifying purchases.

A complete list of subprocessors — what they process and where — is maintained at crunchly.io/subprocessors. We sign a Data Processing Addendum (DPA) with each subprocessor where required by GDPR Article 28 or CPRA. EU/UK transfers rely on Standard Contractual Clauses (SCCs) plus the supplementary measures expected post-Schrems II.

We also share information when we are legally required to (subpoena, court order, regulator), or in connection with a merger, acquisition, or asset sale of Crunchly. We do not sell your personal information to anyone.

4. Data Storage and Security

We use industry-standard encryption in transit (TLS 1.2+) and at rest. Passwords are hashed using bcrypt (via Supabase Auth). We restrict access to personal data to employees and contractors who need it to do their jobs.

The numbers you type into the calculators are stored locally on your device using browser storage. If you are on a plan that includes saved scenarios (Pro or Investor) and you save a scenario, that scenario (its inputs, results, address and notes) is stored in your account in our database (Supabase) so it is available on your other devices. You can delete saved scenarios at any time, and they are deleted when you delete your account. Free and Lite plans do not store scenarios on our servers.

No security system is perfect. If we become aware of a breach affecting your information, we will notify you without unreasonable delay and in any event no later than 30 days after we determine the breach has occurred (10 MRSA § 1348), except where law enforcement requests a delay or where applicable law requires a faster timeline (in which case we will follow the stricter rule).

5. Your Rights and Choices

Access and correction: you can view and update your account information at any time from your account settings.
Deletion: you can delete your account at any time from Settings. Deleting your account cancels any active subscription and permanently deletes your profile, saved scenarios, notes and usage records from our database. Some records are kept after deletion: billing records held by Stripe (for tax and accounting), the record that you accepted our Terms and Privacy Policy (date, document version, email address, IP address and browser), and copies in routine database backups until they expire on our provider's schedule. Information may also be retained where required by law.
Data export: you can export your deal data in CSV or PDF format at any time.
Marketing communications: you can unsubscribe from marketing emails using the link in each email.
Do Not Track: we do not currently respond to browser Do Not Track signals because there is no industry standard for compliance.

6. Regional Privacy Rights

California residents (CPRA)

Under the California Privacy Rights Act (CPRA, which amended and expanded the CCPA), you have the right to: know what personal information we collect; request deletion; correct inaccurate information; limit our use of sensitive personal information; opt out of any sale or sharing of your information (we do neither); and not be discriminated against for exercising these rights. Submit requests to info@crunchly.io; we will respond within 45 days.

Shine the Light (Cal. Civ. Code § 1798.83): California residents may request information about how we share personal information with third parties for those parties' direct marketing purposes. We do not currently share personal information with third parties for their direct marketing. To request the latest information, email info@crunchly.io.

European Economic Area, United Kingdom, Switzerland (GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection (including the right to object to processing carried out under our legitimate interests, under Article 21 GDPR). The legal basis for our processing is performance of contract (to provide the Services), legitimate interest (to operate and improve the Services), and consent (where required, e.g., non-essential cookies). You also have the right to lodge a complaint with your local data protection authority. To exercise these rights, contact info@crunchly.io; we will respond within 30 days.

7. Children's Privacy

Crunchly is not directed to children under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

8. Cookies and Similar Technologies

Crunchly uses the following categories of cookies and storage:

Essential cookies and local storage — required to keep you logged in, remember your preferences, and store your saved scenarios locally. These are always on; you cannot disable them and still use the Services.
Advertising cookies (Google AdSense) — on the Free plan and on our public website, Google may set cookies to serve and measure ads. You can opt out of personalized ads at adssettings.google.com.
Non-essential analytics (Google Analytics 4) — used to measure traffic and improve the site. We load these only if you click Accept on our cookie banner. You can change your choice at any time by clearing the cookieConsent entry in your browser storage and reloading the page.

Crunchly currently does not display ads.

For details on the specific data each cookie sets, see the corresponding entry in Section 3 (How We Share Information).

9. International Data Transfers

Crunchly is operated from the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, supplemented by the technical and organizational measures we use throughout the Services (encryption in transit and at rest, access controls, and minimization). You may request a copy of the SCC text or details of the supplementary safeguards by emailing info@crunchly.io.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or by a notice on the website at least 14 days before they take effect. Continued use of the Services after changes constitutes acceptance.

11. Severability

If any provision of this Privacy Policy is found invalid or unenforceable by a court of competent jurisdiction, that provision will be modified to the minimum extent necessary to make it enforceable, or, if it cannot be modified, severed from this Policy. The remaining provisions will continue in full force and effect.

12. Contact

Questions about this policy or your privacy? Email info@crunchly.io or write to:

Crunchly LLC
126 Western Avenue Ste 2, PMB 1088
Augusta, ME 04330
United States