Privacy Policy
Effective October 18, 2026. ClearanceTrail is operated by Michael Alexander, doing business as ClearanceTrail, in South Carolina ("ClearanceTrail," "we," "us"). Privacy questions and requests: [email protected].
At a Glance
- Your history is encrypted on your device before it leaves. We cannot read it.
- The most sensitive fields never leave your device at all, including the financial log and discharge type.
- We do not sell your personal information or share it for targeted advertising. There are no ad trackers or advertising cookies.
- We collect only what we need to run accounts, the email list you opt into, and, once it opens, billing through Paddle.
- The Service is for adults 18 and older.
1. What We Collect
| Data | Where it lives | Why |
|---|---|---|
| Email address and verification status | Our database (Cloudflare D1) | Sign-in, account and security emails |
| A server-side hash of a login key derived on your device | Cloudflare D1 | Sign-in. Your actual password is never sent to us. |
| Encrypted vault (addresses, jobs, references, travel, education, and other entries you sync) | Cloudflare D1, as ciphertext only | Sync across your devices. We cannot decrypt it. |
| Financial log, discharge type, and other device-only fields | Your device only, encrypted | Never sent to us, even in encrypted form |
| Display preferences (theme, text size) | Your browser only | Never sent to us |
| Plan waitlist choice (Pro or Lifetime) | Cloudflare D1, linked to your account | To tell you when checkout opens |
| Email list sign-up: email, source page, the consent wording you agreed to, time of consent and confirmation | Cloudflare D1 | Double opt-in email list, proof of consent |
| Email list engagement: which ClearanceTrail links you click in our emails (for example a guide or pricing link) and a resulting interest score | Cloudflare D1 | To send fewer, more relevant emails. We do not use tracking pixels. |
| A salted hash of your IP address | Rate-limit records, deleted within about 2 days. Cloudflare keeps standard security logs. | Security and abuse prevention |
| Anonymous usage events (see Section 4) | PostHog (US) | Improve the product |
| Support emails you send us | Email (Cloudflare Email Routing to our mailbox) | Answer you |
| Billing details, once checkout opens | Paddle, as merchant of record | Payments, tax, refunds. We receive only order and subscription status, plan, and billing country. We never receive your full card number. |
We do not collect Social Security numbers, passport or ID numbers, health information, criminal history, account numbers, classified information, or CUI. Please do not enter them anywhere.
2. Sensitive Information
Financial and military details are sensitive. ClearanceTrail keeps the financial log (SF-86 Section 26 items) and discharge type encrypted on your device only. We never receive them. Other entries are end-to-end encrypted before sync. We do not use any sensitive information to infer characteristics about you, and we do not process it for advertising or profiling.
3. How We Use Information
To provide, secure, and support the Service; to send account and security emails; to send the email list you opted into (you can unsubscribe at any time); to process purchases, renewal reminders, and refunds through Paddle once checkout opens; to prevent fraud and abuse; and to comply with the law.
4. Analytics, Cookies, Do Not Track, and Global Privacy Control
We use no advertising or tracking cookies, and the analytics script uses no cookies or local storage. The home page and app send a small fixed set of anonymous events to PostHog (US cloud), such as page viewed, sign-up started, section completed, or a pricing plan clicked. Each event carries only the page path and a short label. A random ID exists in memory for that page visit only. We never send your email, entries, form values, or URL query strings, and IP addresses are discarded. If your browser sends Do Not Track or Global Privacy Control, no analytics events are sent at all. The app stores your sign-in session and encrypted data in your browser so it works offline. Those are strictly necessary for the Service and are not used for tracking. Because we use no non-essential cookies, we do not show a cookie banner.
5. Who Processes Data for Us
We disclose personal information only to service providers that act on our behalf under contract: - Cloudflare, Inc.: hosting, database, security, and email routing (US). - Resend: delivery of account and list emails. - PostHog, Inc.: anonymous product analytics (US cloud). - Paddle.com Market Limited: merchant of record for purchases, payments, and tax, under its own privacy notice. - Google (Gmail): our support mailbox.
We may also disclose information when the law requires it (we cannot decrypt your encrypted content), to protect rights and safety, or in a merger or sale of the Service under this policy. We do not sell personal information, do not share it for cross-context behavioral advertising, and give employers and government agencies no access to your account unless legally compelled.
6. Retention and Deletion
- Account and encrypted vault: until you delete your account in Settings. Deletion removes your account, sessions, encrypted vault, and waitlist choice from our live database right away; backups roll off within 30 days.
- Device-only data: stays on your device until you delete it or clear your browser data.
- Email list: until you unsubscribe. Deleting your app account does not unsubscribe you; use the link in any email. After that, we keep only your email and unsubscribe date so we never email you again.
- Billing records: Paddle keeps these as required for tax. We keep order records for 7 years.
- Support emails: up to 2 years.
7. Security and Breach Notice
Entries are encrypted on your device (AES-256-GCM with a key derived from your password), sent over TLS, and protected by strict security headers and rate limits. No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as the law requires, including under S.C. Code § 39-1-90 and the laws of the state where you live, without unreasonable delay.
8. Your Privacy Rights
Depending on where you live, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, Oregon, Utah, Montana, and other states with consumer privacy laws, you may have the right to know, access, correct, delete, and get a portable copy of your personal information, and to opt out of sale, targeted advertising, and profiling. These laws apply to businesses above certain size thresholds that ClearanceTrail may not meet, but we honor these rights for every user, wherever you live. - Most of your data is already in your control: export it or delete your account in the app. - For anything else, email [email protected]. We will confirm your request within 10 days and respond within 45 days. - If we deny a request, you can appeal by replying to our decision. We will answer the appeal within 45 days. If you are still unhappy, you can contact your state attorney general. - We will not discriminate against you for using your rights. - Notice at collection (California): the categories we collect are listed in Section 1, the purposes in Section 3, and retention in Section 6. We do not sell or share personal information, and we have not done so in the past 12 months.
9. Children
The Service is for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.
10. Location
We are based in the United States and store data in the United States.
11. Changes
We will post changes here and notify you by email or in the app before material changes take effect.
12. Contact
ClearanceTrail, [email protected]. Never email classified information, Social Security numbers, or ID numbers.