Privacy Policy
Draft — business details and legal review pending.
Last updated: 2 November 2026
1. Who is responsible
This draft describes how Outlineary currently handles account and website information. The responsible operator is [Business or operator name], contact [Contact email]. These placeholders and the retention details below must be completed before launch. Applicable legal obligations depend on where the operator and its customers are located.
2. Information involved
Registration asks for a display username, email address and password. Supabase Auth handles password authentication and stores password verification information; passwords are not shown in the storefront or admin editor. Registration metadata includes the username, accepted terms version and acceptance time. Authentication and hosting infrastructure may also process IP addresses, request details, device or browser information and security logs. Do not include sensitive personal information in a username.
3. Why information is used
Account details are used to create and authenticate accounts, confirm email addresses and control access to downloads. Session information keeps users signed in. Infrastructure logs can support reliability, abuse prevention and security investigations. Terms metadata records the acceptance supplied at registration. Applicable legal bases and any jurisdiction-specific disclosures: [To be completed by the operator]. Account creation does not subscribe users to marketing.
4. Cookies and external services
The site uses authentication cookies to maintain and refresh sign-in sessions. A light or dark appearance preference is saved in your browser’s local storage when you change it in Settings. You can change it again or remove it by clearing site data. Blocking or clearing these cookies can sign you out or prevent protected downloads. No advertising or analytics integration is currently configured in this application. Supabase provides authentication, database and file storage. Vercel is the intended production hosting provider. Fonts are requested from Google Fonts, which can receive network information such as your IP address. The relevant providers process information under their own service and privacy terms.
5. Sharing and international processing
Information needed to operate the service is processed by the infrastructure providers described above. Information may also need to be disclosed to meet applicable legal obligations or address misuse. Provider locations, international transfers and any required safeguards must be confirmed by the operator before public launch. Transfer details: [To be completed]. This site currently has no payment processor and does not collect card details. The support placeholder does not send chat messages.
6. Retention and security
Account information remains stored while the account exists. Operational logs, backups and deleted data follow the configured infrastructure retention arrangements. Account and log retention periods, review criteria and backup deletion timings: [To be completed]. Access controls separate customer accounts from administrators, and private downloads require authentication. No system can guarantee complete security. Keep your password private and contact the operator if you suspect unauthorised access.
7. Your requests and choices
Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your information, object to certain uses or complain to the relevant data-protection authority. Requests should be directed to [Contact email]; the operator may need to verify your identity. There is no self-service account deletion screen at present. You can sign out and clear session cookies in your browser. Some information may need to be retained where legally required.
8. Changes to this policy
This policy should be updated when the service’s data practices change, including before enabling payments, analytics, marketing or live support. The date above identifies this draft. The operator must review the completed policy against actual provider settings and applicable law before publishing the service publicly.