Privacy Policy

1. Introduction

Marketplace Subsidy Simulator is a portfolio demonstration project created by Mohit Taneja. This Privacy Policy explains how I collect, use, and protect your information when you use the Service.

Important: This is a demonstration project for portfolio purposes. While I take reasonable precautions to protect your data, this is not a production-grade commercial service. By using the Service, you acknowledge and accept this limitation.

Eligibility: You must be at least 18 years old to use this Service. I do not knowingly collect information from minors.

2. Information We Collect

2.1 Account Information

When you create an account, I collect:

• Email address - Used for login and account recovery
• Password - Encrypted using bcrypt/Argon2 (never stored in plain text)
• Account creation date - For record keeping and retention policies
• Account metadata - User role, tenant ID, active status

2.2 Financial Planning Data

When you use the calculator and scenario planner, I store:

• Income estimates - MAGI calculations and projections
• Family size information - Number of household members
• Location data - State and ZIP code for subsidy calculations
• Age information - For premium calculations
• Scenario data - Names, descriptions, and calculation results you save
• Calculation inputs - Temporarily processed server-side, may be logged for debugging (I minimize logs and avoid storing full calculation inputs where possible)

I do NOT collect: Social Security numbers, tax returns, actual bank account information, health records, or other highly sensitive financial documents.

2.3 Technical Information

• IP address
• Browser type and version
• Device information
• Access times and dates
• Pages viewed

2.4 Cookies and Local Storage

I use cookies and browser local storage for:

• Authentication (keeping you logged in)
• Session management
• User preferences

Cookie Control: You can log out to clear session tokens. You can clear cookies and local storage via your browser settings (typically in Privacy or Security settings).

3. How I Use Your Information

I use your information to:

• Provide the Service - Process calculations, store scenarios, maintain functionality
• Manage your account - Authentication, profile management, session handling
• Improve the Service - Analyze usage patterns, develop new features, fix bugs
• Communicate with you - Account notifications, important updates (no marketing emails)
• Security and fraud prevention - Detect abuse, prevent unauthorized access
• Legal compliance - Respond to legal requests if required by law
• Portfolio demonstration - Showcase technical capabilities (anonymized data only)

I do NOT use your data for advertising, marketing to third parties, or selling your information.

4. Data Sharing and Disclosure

I DO NOT:

• Sell your personal information to any third party
• Share your data with advertisers or marketing companies
• Use your financial data for any purpose other than providing the Service
• Share your scenarios or calculation results publicly without your consent
• Provide your data to data brokers or aggregators

I MAY share data with:

• Service providers - Hosting (Vercel/Railway), database (Supabase), caching (Redis) - only as necessary to operate the Service
• Legal authorities - If required by law, court order, or legal process
• Security purposes - To protect against fraud, abuse, or security threats
• With your consent - If you explicitly authorize sharing (e.g., scenario sharing features)

I use reputable service providers and rely on their published security and privacy commitments. I do not control their practices and am not responsible for their handling of your data.

5. Data Security

Security measures implemented or intended may include:

• Password encryption - bcrypt/Argon2 hashing (never stored in plain text)
• HTTPS/TLS encryption - All data transmitted over secure connections
• Database security - Row-Level Security (RLS), access controls, encryption at rest
• JWT authentication - Secure, stateless authentication with expiration
• Redis caching - Fail-open patterns, cache invalidation on sensitive changes
• Rate limiting - Protection against brute-force and abuse
• Security logging - Audit trails for authentication events (minimized PII)

IMPORTANT: Despite these measures, no method of transmission over the internet is 100% secure. I cannot guarantee absolute security. Use this Service at your own risk.

In the event of a data breach affecting your account, I will make reasonable efforts to notify you via email as soon as practicable.

6. Data Retention

I retain your data for the following periods:

• Account data - Until you delete your account or after 2 years of inactivity
• Scenarios and calculations - Until you delete them, or when account is deleted
• Access logs - Up to 90 days for security and debugging
• Audit logs - Up to 1 year for security and compliance purposes
• Cache data - 5 minutes to 24 hours (Redis cache with automatic expiration)

Account Deletion: To delete your account, use the in-app account settings or contact me using the information in Section 13. When you delete your account, all associated data (scenarios, calculations, profile) is permanently deleted within 30 days. Some data may be retained in backups for up to 90 days, then permanently removed.

7. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your scenarios (data portability)
• Opt out of non-essential cookies

To exercise these rights, contact us at mohit@example.com

8. Age Restriction

This Service is not intended for individuals under 18 years of age. I do not knowingly collect personal information from anyone under 18. If you believe I have collected data from someone under 18, please contact me immediately using the information in Section 13, and I will delete it promptly.

9. Third-Party Services

The Service integrates with the following third-party providers:

Essential Service Providers:

• Supabase - Authentication and PostgreSQL database hosting
  Privacy Policy: supabase.com/privacy
• Vercel or Railway - Application hosting and deployment
  Vercel Privacy: vercel.com/legal/privacy-policy
• Redis - Caching infrastructure (self-hosted or cloud)

Your Responsibility: Each third-party service has its own privacy policy and terms. I recommend reviewing their policies. I am not responsible for the privacy practices of these third parties.

Some service providers offer data protection resources and contractual terms (e.g., Data Processing Agreements) for compliance with regulations such as GDPR or CCPA, where applicable.

10. International Data Transfers

Current Data Location: The Service currently uses a Supabase database instance located in the Asia-Pacific region (Sydney, Australia).

Your data may be transferred to, processed, and stored on servers located outside your country, including countries that may have different data protection laws than your jurisdiction.

By using the Service, you acknowledge and consent to:

• Cross-border data transfers as necessary to provide the Service
• Storage of your data in the Asia-Pacific region
• Processing by third-party service providers in various countries

I take reasonable steps to ensure that your data receives adequate protection consistent with applicable data protection laws, regardless of location.

11. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in practices, technology, legal requirements, or other factors.

Notification of Changes:

• The "Last Updated" date at the top will be revised
• Material changes will be communicated via email to registered users
• Continued use of the Service after changes constitutes acceptance

I encourage you to review this Privacy Policy periodically.

12. Governing Law

This Privacy Policy is governed by the laws of India, consistent with theTerms of Service.

For data protection rights specific to your jurisdiction (GDPR for EU, CCPA for California, etc.), please contact me using the information below.

13. Contact & Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

I will respond to privacy-related inquiries within 30 days.