Privacy notice (draft)
What is kept about you
Your account: your email address, when you were invited, confirmed and last signed in (kept by Supabase Auth), and the company, CAGE and note Willow Tree Strategies set on your customer row. Signing in sets Supabase's session cookies in your browser.
Counts of your use, per UTC day: pages opened, lookups (kept by your email address), searches cut short, calls to each of the site's functions and per minute; and, for the digest, watch changes, views and downloads. These counts name no NSN and no page.
What you ask the site to do: the NSNs you watch and their notes, your digests (the RFQs, awards and stock changes they listed), and the NSNs whose pages you opened, which the site keeps to fill in their award history for you.
[What Supabase Auth itself keeps of each sign-in (its session records and audit log, which can hold an IP address and browser), and for how long: to be described from Supabase's terms.]
Who sees it
Other customers: none of it; the site answers no customer from another's watch or requests. Willow Tree Strategies' staff pages show, per account, the address, company, CAGE, note, last sign-in and the day's counts, and how many NSNs it watches and its digests' counts; they do not show which NSNs it watches or what its digests listed.
Anyone with access to the database itself (Willow Tree Strategies' administrator, and the jobs that make digests and read requests) can read all of it.
Where it goes
An NSN whose page you open may be looked up at a public U.S. government source, as any NSN is; the lookup names no person.
Some of the site's work, the digests among it, is done by scheduled jobs run on GitHub's service.
Logs
The site's own log messages are written to hold counts and function names, not your address or the NSNs you look at. The records of the site's scheduled jobs can list NSNs, those customers' pages asked about included, but not who asked.
[Whether every log, the hosting providers' own request logs included, holds to that, and for how long they are kept: to be confirmed and described.]
Sign-in links and invitations are sent by Supabase Auth through Resend's email service. No digest is emailed today: the digest job makes each day's digest and sends nothing. The code to email it through Resend is in place but not turned on; once on, it goes only to an account that turns it on on its digest page, and stops when the account turns it off there, uses the one-click unsubscribe link in any digest email, or stops watching NSNs.
[When the digest email is turned on, the sender address, and whether other email may be sent: to be decided.]
Service providers
Supabase (the database and sign-in), Vercel (the website), GitHub (the jobs) and Resend (sign-in and invitation email, and the digest email once it is turned on).
[Where each provider keeps data, and each provider's own terms: to be listed after review.]
How long it is kept
[Retention for each kind of record above, and deletion on request: to be decided. Nothing deletes these records on a schedule today.]
Your choices and requests
[How to see, correct or delete what is kept about you, and whom to ask: to be decided.]
Changes and contact
[How changes to this notice are announced, and a contact address: to be decided.]