Privacy Policy

• Account info you provide: email, name, and password (stored hashed).
• Profile & onboarding: your state, age, experience level, goals, books you hold, and hours per week — used to personalize offers and enforce eligibility.
• Phone number & SMS consent: your mobile number (used to secure your account) and, if you opt in, your consent to receive text alerts — we record whether and when you consented.
• Product activity: tools used, plays logged, and first-party analytics events, to run and improve the service.
• Support content: messages you send us and AI-assistant conversations (see below).
• Billing: handled by Stripe. We store a customer/subscription ID and status — never full card numbers.

To operate your account, personalize offers to your state and books, provide and improve the tools, prevent abuse, process payments, and communicate about the service. Our product analytics are first-party; we do not run third-party advertising trackers. We do use PostHog, a product-analytics service, to understand how the product is used — this includes session replay: a reconstruction of how a visitor interacts with our pages (clicks, scrolling, navigation). Text you type into forms (passwords, emails, payment fields) is masked and never recorded, sessions are linked to an internal account id rather than your name or email, and recordings are used solely to improve the product. You can request deletion of your recordings at any time via support@bonusedge.ai.

When you use the in-app assistant, your messages are sent to our AI provider (Anthropic) to generate a response and are stored so we can review conversations and improve support. Don't share passwords or payment details in chat. Account-specific issues are handled by a person.

SMS alerts are strictly opt-in: we only text you if you checked the consent box, and you can revoke consent at any time by replying STOP to any message (message & data rates may apply). Your phone number is collected during onboarding to secure your account, but text alerts are optional — declining SMS doesn't affect your account. Marketing emails include an unsubscribe link (served via /api/unsubscribe) that opts you out in one click; transactional emails about your account are separate and unaffected.

We use only essential cookies needed to keep you signed in and secure. We don't use advertising or cross-site tracking cookies, so there's no consent banner to click through.

We don't sell your personal data. We share it only with service providers who help us run Bonus Edge (e.g. Stripe for billing, Anthropic for the assistant, our hosting and email providers), under their own terms, and where required by law.

To keep accounts personal and secure we set a long-lived device cookie in each browser you use, and record the device type, IP address, approximate location (country/region, derived from the IP by our hosting provider) and time of sign-ins and security changes. New browsers must be confirmed with a code we email you, an account can be active on a limited number of devices, and unusual multi-location use may trigger re-verification. You can see and sign out devices, and download or delete this data, in Settings → Security and Settings → Data. We use it only for security and licence enforcement, never for advertising.

Passwords are checked against the public Have I Been Pwned breach corpus using a privacy-preserving partial-hash lookup — your password never leaves our server.

Do Not Sell or Share My Personal Information (California): we don't sell personal information. Advertising pixels (Meta, Google) may count as "sharing" under the CPRA — you can opt out by emailing support with the subject "Do not share", or by declining the analytics/marketing cookies in your browser. Deleting your account (Settings → Data) removes your profile within 14 days; we keep invoices and a hashed anti-abuse tombstone as the law allows.

You can view and update your details in settings, and you can request deletion of your account and associated data at any time via the Help & Feedback button. We retain data only as long as needed to provide the service or meet legal obligations.