Privacy policy

1. Who this is

Worranty (“we”, “us”) is a tool for tracking purchases and checking what protects them — EU statutory consumer-guarantee rights, national consumer law, payment-card purchase protection, and extended warranties. This policy explains what personal data the app processes when you use it.

Data controller: Sam Potorti (contact: sampot99@gmail.com).

2. What we collect

• Account: your email address, an optional username shown around the app instead of your email, and a password stored only as a one-way bcrypt hash — we never store or can recover your plaintext password.
• Purchases you log: item name, category, purchase date, price, seller, country, payment method, and whether it was bought refurbished or online.
• Payment cards: a name you give a card for your own reference (e.g. “ABN AMRO Gold Mastercard”) and its purchase-protection terms. We do not collect card numbers, expiry dates, CVVs, or any other payment credentials.
• Uploaded terms documents: if you upload a PDF of your card’s or an extended warranty’s terms, the file is sent to our AI provider (Anthropic) for one-time, automated extraction of the key terms (coverage type, duration, caps, exclusions). The extracted text is what we store — the PDF itself is not retained by us after processing, and you can always enter the same fields by hand instead of uploading.
• Group sharing: if you create or join a group, the products you choose to share become visible to the other members of that group.
• Session cookie: a single, essential, HTTP-only cookie that keeps you logged in. We don’t use tracking, advertising, or analytics cookies.
• Aggregate performance data: anonymous page load and responsiveness metrics via Vercel Speed Insights, which are not tied to your account or identity.

3. Why we process it

To provide the service you sign up for: storing your purchases, checking their coverage, sharing what you choose with your group, and sending you a password-reset email when you ask for one. We don’t sell your data, and we don’t use it for advertising.

4. Who else sees it

We use a small number of processors to run the service. Each only sees what it needs to do its job:

• Neon — hosts our Postgres database (EU, Frankfurt region).
• Vercel — hosts the application and serves requests.
• Anthropic — processes PDF terms documents you choose to upload, to extract their key fields.
• Resend — delivers password-reset emails.

Members of a group you join can see the products you share with that group. We don’t share your data with anyone else.

5. How long we keep it

We keep your data for as long as your account exists. Deleting your account (from Account) permanently removes your products, cards, extended warranties, and group memberships within our systems.

6. Your rights

Under GDPR and similar laws, you can ask to access, correct, delete, restrict, or receive a copy of your personal data, and object to how it’s processed. You can do most of this yourself, any time, from Account:

• Export: download everything we hold about you as a JSON file.
• Delete: permanently remove your account and all linked data.

For anything else, contact sampot99@gmail.com.

7. International transfers

Our database is hosted in the EU. Some processors we use (including Anthropic) may process data outside the EEA; where that happens, we rely on their standard contractual safeguards for international transfers.

8. Children

Worranty isn’t directed at children, and we don’t knowingly collect data from anyone under 16.

9. Changes to this policy

If this policy changes materially, we’ll update the date at the top of this page.