Privacy Policy

1. Overview

This Privacy Policy describes how How’s the Stack? (“we”, “us”, or “the Service”), available at howsthestack.com and related Workers deployments, handles information when you use the product.

How’s the Stack? is a command center for SaaS builders. It connects services such as GitHub, Cloudflare, Supabase, and Stripe and provides a centralized view of stack activity, usage, health, and account information.

We describe only practices implemented in the product. We do not sell your personal information. We do not operate a separate advertising or marketing-email system in this product.

For Google Sign-In details, see Google User Data below. Questions or privacy requests: howsthestack.support@gmail.com.

2. Google User Data

How’s the Stack? uses Google Sign-In through Supabase Auth (OAuth) so you can create and access an account. We do not offer email/password sign-in, and we do not store How’s the Stack? account passwords.

Sign-in and sign-up use the same Google OAuth flow. After you approve access on Google’s consent screen, Supabase Auth completes login and maintains your session.

Google user data is only accessed and used to provide or improve the functionality described by How’s the Stack?: authenticating you, maintaining your account and session, displaying account information, and associating your account with application data and connected integrations. Google is used for sign-in only; it is not used to power GitHub, Cloudflare, Supabase Management, or Stripe integrations, which are separate optional connections you authorize on their own.

2.1 What Google data we access

When you choose “Continue with Google,” the Service starts a Supabase Auth Google OAuth request. Through that flow we access the following Google-related identity information as made available via Supabase Auth:

• Email address: the email associated with the Google account used to sign in
• Name / display name: when provided (for example full_name, name, or given_name in auth user metadata)
• Profile picture / avatar: when provided (for example avatar_url or picture), shown in account UI
• Authentication / account identifier: your Supabase Auth user id (UUID), which we use as the stable account identifier for the Service

We do not use Google Sign-In to access unrelated Google account data (for example Gmail contents, Google Drive files, Google Calendar, or Contacts).

2.2 How we use Google data

We use the Google user data described above to:

• Authenticate the user
• Create and maintain their How’s the Stack? account
• Maintain signed-in sessions (including session cookies)
• Display account information in the product (for example profile and account menus)
• Associate the account with application data and connected integrations (credentials, connection records, caches, and feature requests keyed by account id)

2.3 What we do not do with Google user data

• We do not sell Google user data
• We do not use Google data for advertising
• We do not use Google data for unrelated marketing
• We do not build advertising profiles from Google user data
• We do not access unrelated Google account data beyond the sign-in/identity information listed above
• We do not share your Google email, name, or avatar with other How’s the Stack? users as a directory or social graph

2.4 How Google data is stored and protected

• Supabase Auth: stores your auth user and session as part of operating Google Sign-In
• Session cookies: on your browser keep the signed-in session working across requests
• The Service reads profile fields from the authenticated Supabase user for display. It does not maintain a separate public Google profile database beyond that auth user and application records keyed by your account id
• Application secrets for the Service (OAuth client secrets and our encryption key for integration credentials) are configured as server-side environment secrets and are not shipped to the browser. Google Sign-In itself is handled through Supabase Auth’s OAuth flow

2.5 Who processes or receives Google-related data

Google-related authentication data is processed only as needed to operate the Service:

• Google: Identity provider. You authenticate with Google; Google issues the OAuth result used for sign-in.
• Supabase Auth: Authentication provider for How’s the Stack?. Supabase completes the Google OAuth flow, stores the auth user, and issues/maintains the session the product uses.
• Cloudflare: Infrastructure host. The Service runs on Cloudflare Workers. Requests and session cookies are processed there as part of serving the application. Cloudflare is not used as a separate advertising or marketing recipient of Google user data.

We may also disclose information if required by law or to protect the Service and users. Feature-request text you submit is separate from Google profile data and may be visible to other signed-in users (see section 4).

2.6 Retention of account, credentials, and cache data

• Account / authentication data: Retained while your How’s the Stack? account exists, subject to Supabase Auth session lifetime and cookie refresh behavior for active sessions. Deleting your account (section 2.7 / section 7) removes the auth user we control for the Service.
• Connected integration credentials: Retained while the integration stays connected. Disconnecting removes the stored credential or connection record for that provider in our systems. These credentials are for GitHub, Cloudflare, Supabase Management, or Stripe, not Google Sign-In tokens stored by us outside Supabase Auth.
• Cached integration snapshots: Short-lived. Freshness is on the order of tens of seconds; physical cache entries in Cloudflare Workers KV expire after about seven days, and entries are invalidated when connections change. Caches are not a permanent archive of provider data.

2.7 Deletion

The product does not currently include a self-serve “Delete account” button. To delete your account and associated application data:

1. Sign in and disconnect any connected integrations (GitHub, Cloudflare, Supabase, Stripe) from the product.
2. Optionally delete your own feature requests and votes using in-product controls.
3. Email howsthestack.support@gmail.com with the subject line Account deletion request, and include the Google email address you use to sign in.
4. After we verify the request, we will delete your Supabase Auth user for the Service and account-associated data we control, including stored integration credentials/connection records and feature requests or votes tied to your account id.
5. You may also revoke the Service’s Google access from your Google Account permissions settings. That stops future Google Sign-In grants; email us as above so we can remove remaining data we store.

You can sign out at any time from account controls without deleting your account. Full deletion steps are also listed in section 7.

3. Connected integrations

Integrations are optional. You connect them from the product. Credentials are encrypted and decrypted only on the server; they are not exposed to the browser as plaintext secrets.

• GitHub: Connected via Supabase Auth’s GitHub OAuth provider. The product uses the access token to read repository and account activity you select (for example commits, pull requests, issues, Actions, and releases). The GitHub API client used by the Service issues read (GET) requests only. On disconnect, we delete the stored connection for your account in our store.
• Cloudflare: Connected via our Cloudflare OAuth app with read-oriented scopes (Workers scripts read, account analytics read, account settings read). We use the tokens to fetch Workers and account analytics you select. On disconnect, we delete the stored connection and attempt to revoke the Cloudflare token.
• Supabase (Management API): Connected via a Supabase organization OAuth app. We use the tokens to read org/project status and related management summaries. The product does not create projects, change configuration, or read database passwords through this integration. On disconnect, we delete the stored connection.
• Stripe: Connected when you paste a Stripe API key (restricted or secret key forms the product accepts). We store the key encrypted and use it to read account, balance, payments, subscription, and dispute information for the dashboard. On disconnect, we remove the stored credential.

While an integration is connected, we may temporarily cache fetched snapshots so the dashboard can load quickly. Cached entries expire; they are not a permanent archive of your provider data.

4. Other information we store

• Feature requests: If you submit an integration feature request (service name and optional note) or vote on one, that content is stored in our database and is visible to other signed-in users of the Service. You can edit or delete your own requests and remove your own votes where the product provides those controls.
• Local browser preferences: Some UI preferences (for example overview visibility and first-run UI state) may be stored in your browser’s localStorage. Those values stay on your device and are not synced to our servers as account profile data.

5. Where data is stored

• Supabase Auth: Account and session data for Google Sign-In (and GitHub OAuth used for the GitHub integration flow).
• Supabase Postgres: Encrypted Stripe credentials and feature-request / vote records.
• Cloudflare Workers KV: Encrypted OAuth connection records for GitHub, Cloudflare, and Supabase Management integrations, plus short-lived cached snapshots used by the dashboard. The Service itself runs on Cloudflare Workers.
• Local development only: When running the app locally without KV, connection data may be written under a local .data directory on the developer machine. That path is for local development, not the hosted product.

Encryption for stored integration secrets uses AES-256-GCM with a server-held key. Ciphertext for API keys is not readable through normal browser database access.

6. Security

We designed the product so that:

• Provider tokens and API keys are encrypted at rest
• Secrets are decrypted only on the server for authorized requests
• OAuth client secrets and encryption keys are configured as server environment secrets, not shipped to the browser
• GitHub and Cloudflare clients used by the Service are oriented to reading status and analytics, not deploying or deleting your provider resources

No method of transmission or storage is perfectly secure. You should protect access to your Google account and revoke or disconnect integrations you no longer want the Service to use.

7. Retention and account deletion

Retention for account/authentication data, integration credentials, and caches is summarized under Google User Data §2.6–2.7. In brief:

• Sessions: Kept while you remain signed in, subject to Supabase Auth session lifetime and cookie refresh behavior.
• Integration credentials: Kept while the integration stays connected. Disconnecting removes the stored credential or connection record for that provider in our systems.
• Feature requests and votes: Kept until you delete your own request or vote, or until we remove them as part of operating the Service.
• Caches: Short-lived (freshness on the order of tens of seconds; KV entries expire after about seven days) and invalidated when connections change.

How to delete your account

The product does not currently include a self-serve “Delete account” button. To delete your How’s the Stack? account and the account-associated data we control, do the following:

1. Sign in and disconnect any connected integrations (GitHub, Cloudflare, Supabase, Stripe) from the product.
2. Optionally delete your own feature requests and votes using the in-product controls.
3. Email howsthestack.support@gmail.com with the subject line Account deletion request, and include the Google email address you use to sign in.
4. After we verify the request, we will delete your Supabase Auth user for the Service and account-associated data we control, including stored integration credentials/connection records and feature requests or votes tied to your account id.
5. You may also revoke the Service’s Google access from your Google Account permissions settings. That stops future Google Sign-In grants; email us as above so we can remove remaining data we store.

You can sign out at any time from account controls without deleting your account.

8. Third-party services

The Service depends on third parties that process data under their own terms and privacy policies, including:

• Google: Identity provider for Sign-In (see Google User Data)
• Supabase: Authentication, database, and (for the Supabase integration) Management API access you authorize
• GitHub: OAuth and API data for the GitHub integration
• Cloudflare: Hosting/Workers, KV storage, OAuth, and API data for the Cloudflare integration; platform logs may be produced by the Workers runtime as part of operating the Service
• Stripe: API access using the key you provide

We do not control those providers’ independent processing. Review their policies when you connect them.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal information. In this product you can:

• Sign in and sign out
• View profile details shown from your auth provider
• Connect or disconnect integrations
• Create, edit, or delete your own feature requests and manage your votes
• Clear browser localStorage preferences on your device
• Request full account deletion by emailing howsthestack.support@gmail.com (see section 7)

For data held only by Google, Supabase, GitHub, Cloudflare, or Stripe, use those providers’ account and privacy tools as well.

10. Children

The Service is built for builders and operators of software products. It is not directed at children, and we do not knowingly collect personal information from children.

11. Changes

We may update this Privacy Policy as the product changes. The “Last updated” date at the top will change when we do. Continued use of the Service after an update means you accept the revised policy.

12. Contact

How’s the Stack? is operated as the How’s the Stack? service. For privacy questions, data requests, or account deletion, contact:

howsthestack.support@gmail.com

13. Related

Use of the Service is also governed by our Terms of Service.