Privacy Policy

Sponge ("we," "us," or "our") is committed to handling your personal information responsibly. This Privacy Policy explains what data we collect when you use Sponge, how we use it, who we share it with, and your rights regarding that data.

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the Service.

Information you provide directly:

• Email address — collected when you sign in via magic link. This is your account identifier and the address we use to send authentication emails.
• Contact information for reports — if you choose to add your name, company, phone, or website to PDF reports, that information is stored and associated with your account.

Information collected automatically:

• Usage data — the number of analyses run, search queries performed, and reset dates for usage periods. This is used to enforce your plan limits and display your usage stats.
• Search history — recent search queries (category + city combinations) are stored to power the Recent Searches feature. This data stays within your account.
• Saved leads — businesses you mark as saved are stored in your browser's local storage and are not transmitted to our servers.
• Authentication tokens — JWT session tokens are stored in your browser's local storage to keep you signed in. These expire after 7 days.

Information we do not collect:

• We do not collect or store payment card numbers. Payments are processed entirely by Stripe.
• We do not use tracking cookies or third-party advertising pixels.
• We do not collect device fingerprints or IP addresses for tracking purposes.

We use the information we collect solely to provide and improve the Service:

• To authenticate your identity and maintain your session
• To enforce your subscription plan's usage limits
• To display your usage history and account details
• To send authentication emails (magic links) via Resend
• To process and manage your subscription via Stripe
• To generate and personalize PDF analysis reports
• To diagnose technical issues and improve platform performance

We do not use your data for advertising, profiling, or any purpose unrelated to operating the Service.

Sponge relies on the following third-party services to operate. Each has its own privacy policy governing how they handle data.

• Stripe — payment processing. Stripe handles all billing and stores your payment method. We receive only your subscription status, customer ID, and plan information. Stripe Privacy Policy
• Resend — transactional email delivery. Your email address is passed to Resend solely to deliver authentication emails. Resend Privacy Policy
• Google Places API — business search and data. Search queries and location data are sent to Google to retrieve business listings. Google Privacy Policy
• AWS (Amazon Web Services) — hosting infrastructure. The Service runs on AWS App Runner with a PostgreSQL database on Amazon RDS. Data is stored in the US East (N. Virginia) region.

We do not sell or share your personal data with any third parties beyond what is necessary to operate these services.

When you run an analysis on a business website, Sponge's automated tools access that website's publicly available content. The analysis results — including scores, flags, signals, and screenshots — are stored in our database associated with the website's domain (not with your account specifically).

Analysis results are cached for up to 30 days and may be served to any Sponge user who analyzes the same domain during that period. Screenshots of analyzed websites are stored in AWS S3.

We do not store any personal data about the businesses or individuals whose websites are analyzed beyond what is publicly visible on those websites.

We retain your account data (email, plan, usage counts) for as long as your account is active. If you cancel your subscription and do not return, we may retain your account record for up to 12 months before deletion.

Website analysis results are retained for 30 days from the date of analysis, after which they may be re-analyzed on demand.

You may request deletion of your account and associated data at any time by contacting us at our contact page. We will process deletion requests within 30 days.

We take reasonable technical and organizational measures to protect your data, including:

• All data in transit is encrypted via TLS/HTTPS
• Database connections use SSL encryption
• Authentication uses time-limited magic links and short-lived JWT tokens
• Payment data is handled entirely by Stripe and never touches our servers
• Infrastructure is hosted on AWS with access controls and private networking

No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. If you become aware of a security issue, please contact us immediately at our contact page.

Sponge does not use tracking cookies. We use your browser's localStorage to store:

• Your JWT session token (to keep you signed in)
• Your saved leads (businesses you've bookmarked)
• Your last search parameters (to restore state on page load)

This data is stored locally on your device and is not transmitted to third-party services. You can clear it at any time by signing out or clearing your browser's site data.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, or delete information we hold about you. To exercise any of these rights, contact us at our contact page.

We will respond to all requests within 30 days. We do not discriminate against users who exercise their privacy rights.

We may update this Privacy Policy from time to time as the Service evolves. When we make material changes, we will update the effective date at the top of this page. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or how your data is handled, please contact us at our contact page.