Privacy Policy

What we collect

Account data: your email address and a bcrypt-hashed password (we cannot read your password).

Profile data you enter: loan types, balances, interest rates, servicer names, income (AGI), household size, state region, loan dates, and optional case facts (name, mailing address, account number, descriptions of your situation) used to populate your report, deadlines, and letters.

Generated content: the letters, deadline items, and communication-log entries you create, so they persist in your dashboard.

Billing data: your Stripe customer id and subscription status. Card numbers never touch our servers — Stripe processes payments.

Operational data: server logs (request times, IP addresses for rate limiting and abuse prevention).

What we do NOT do

We do not sell your data. We do not share your loan information with servicers, the Department of Education, advertisers, or data brokers. We do not send your letters anywhere — downloads and sending are entirely in your control.

Where your data lives

In the operator's own SQLite database on the deployed server (not on third-party SaaS infrastructure), signed session cookies (JWT, httpOnly, SameSite=Lax, 7-day expiry) authenticate you. HTTPS is terminated by the reverse proxy in front of the application.

Retention and deletion

Your data persists while your account exists. You may request deletion of your account and all associated data at any time via the support email below; deletion is completed within 30 days. Billing records required by tax law may be retained as required.

Third parties

Stripe (payments) and your hosting provider (infrastructure) are the only processors. Nothing else receives your information.

Contact

Privacy questions and deletion requests: support@studentloanrescue.example.com (Edit before launch). Operator: Student Loan Rescue LLC (Edit before launch), 123 Placeholder St, Suite 100, City, ST 00000, USA (Edit before launch).