Privacy Policy

Last updated August 2026

[LEGAL ENTITY NAME] operates CleanETFs. This page says what we collect, why, who else can see it, and how to get it back or get rid of it. It is written to be read.

The short version

We collect your email address and the funds and comparisons you choose to save. We use them to run the tool and for nothing else. There is no analytics, no advertising, no tracking pixels and no third-party cookies anywhere on this site. We do not sell your data, and we never tell a fund provider which of their funds you looked at. Two companies process it on our behalf — Supabase and Cloudflare — and you can have all of it deleted by asking.

What we collect

When you make an account:

• your email address;
• a password, which is hashed by our authentication provider before it is stored. We never see or hold your actual password;
• if you choose Sign in with Google instead, Google tells us your email address and basic profile identity. We do not receive your Google password and we ask Google for nothing else.

What you enter into the tool:

• the funds you save, and the names you give your lists;
• the comparisons you build between funds;
• the account type you ask us to show withholding treatment for (taxable, IRA, 401(k)), if you set one;
• any notes you attach to a fund.

We do not ask what you own, how much of it, or what you paid — this tool compares funds, it does not track a portfolio. What you save still says something about your intentions, so we treat it as sensitive: your lists are readable only by the account that created them, enforced in the database itself rather than by application code.

Automatically, by being on the internet:

• our host records ordinary web server logs, including IP addresses, for delivery, security and abuse prevention;
• our authentication provider records sign-in events and timestamps, which is how a suspicious login can be spotted at all.

What we do not collect

No name, address or phone number. No social insurance number. No date of birth. No brokerage account numbers and no brokerage credentials — this tool never connects to your broker, so there is nothing to steal. No payment card details; if paid subscriptions begin we will use a payment processor and card details will go to them, not to us, and this page will be updated before that happens.

And no analytics of any kind. No Google Analytics, no tag manager, no advertising pixels, no session recording, no fingerprinting, no third-party cookies. This is verifiable — view the page source.

Why we collect it

• Your email: to identify your account, to let you sign in and reset your password, and to send the service messages you cannot opt out of and still have an account — a password reset, a security notice, a change to these terms.
• Your saved funds and comparisons: to show you the funds you asked to keep and to compare them the way you asked. That is the whole purpose.
• Logs: to keep the site up and to deal with abuse.

We do not use your data for anything else. If we ever wanted to — to improve the product in aggregate, say — we would ask you first, separately, and a no would cost you nothing.

We do not send marketing email. If that changes it will be opt-in, and unsubscribing will be one click.

Who else touches it

We keep this list short on purpose. Every one of these is a service provider acting on our instructions.

• Supabase — the database and the authentication system. It holds your email, your hashed password and everything you enter. It also sends the transactional emails (confirm your address, reset your password). Your data is stored in [SUPABASE REGION — e.g. US East (N. Virginia)].
• Cloudflare — serves the site and holds the server logs described above.
• Google — only if you choose to sign in with Google, and only for that. Google will know you signed in to this site. If you would rather they did not, use an email address and password instead.

Where a provider stores or processes data outside the country you live in, that data can be subject to the laws of that country, including lawful access by its authorities. We use contractual protections with our providers, but we cannot promise a foreign government will never compel access. This is true of every service that uses foreign infrastructure; we would rather say it than leave you to work it out.

We may also disclose information if the law requires it, or to protect our rights or someone's safety. If a court orders it and we are permitted to tell you, we will.

If the business were ever sold or reorganised, your data could transfer as part of it. The buyer would be bound by this policy, and we would tell you before it happened.

Cookies and what is stored in your browser

One thing: when you sign in, your session token is kept in your browser's local storage so you stay signed in between visits. It is strictly necessary for the site to work and it is not used to track you. Signing out removes it, and so does clearing your browser data.

There are no advertising cookies, so there is no cookie banner. That is deliberate.

How long we keep it

Your account data is kept while your account exists, because it is what the tool works on. If you close your account we delete your saved funds, comparisons, notes and account records within [RETENTION PERIOD — e.g. 12 months].

Backups roll off on their own schedule, so a copy may survive slightly longer in one — it is not accessible through the product and is overwritten in the ordinary course. Server logs are kept for a short period for security purposes. Where we are required by law to keep something (a record of a payment, say) we keep that and nothing else.

Your rights

Write to [PRIVACY CONTACT EMAIL] and we will act on any of these. There is no charge and you do not need a reason.

• See it. Ask what we hold about you and we will tell you, in a usable format.
• Take it. You can export your saved funds and comparisons at any time without asking.
• Fix it. Most of it you can edit yourself. Anything you cannot, we will correct.
• Delete it. Ask and we will delete your account and its data, subject to the retention note above.
• Withdraw consent. You can withdraw it at any time. For most of what we hold that means closing the account, because without your email and your saved lists there is no service left to give you.

We will respond within 30 days. If we cannot do what you asked we will say why. If you are not satisfied you can complain to the attorney general of your state, or to whichever privacy regulator has jurisdiction where you live, and you do not need our permission to do so.

How it is protected

• Everything travels over HTTPS.
• Passwords are hashed by our authentication provider. Nobody here can read yours, which is also why nobody here can recover it — a reset is the only route.
• Access to your rows is enforced by the database, per row, against your authenticated identity. A bug in our application code cannot hand your saved lists to another user, because the application is not what decides.
• Access to production data is limited to those who need it to run the service.

No system is perfectly secure and we will not pretend otherwise. If a breach creates a real risk of significant harm to you, we will notify you and notify the regulators the law requires us to, within the deadlines they set, and we keep records of breaches whether or not they meet that threshold.

Children

This is not for children. Do not use it if you are under the age of majority where you live. We do not knowingly collect information from children, and if we learn we have we will delete it.

Which laws apply

We aim to meet the US state privacy legislation that applies to us — the California Consumer Privacy Act as amended, and the comparable statutes in the other states that have them. Where the law where you live gives you a stronger right than this page describes, you have the stronger right, and you do not have to cite it to get it.

Two of those rights are worth stating plainly because we can answer them in one line. We do not sell your personal information, under any of the definitions those statutes use. We do not share it for cross-context behavioural advertising, because we do not advertise and run no trackers. If either ever changes, we will say so here before it does, and provide the opt-out mechanism the law requires.

Changes

If we change this page we will change the date at the top. If a change materially affects how we handle your data we will tell you before it takes effect, by email or in the app, and where the law requires fresh consent we will ask for it rather than assume it.

Contact

[LEGAL ENTITY NAME] — [PRIVACY CONTACT EMAIL]. Privacy questions, access requests and complaints all go to the same address, and it is read by a person.

See also the terms of service and the disclaimer.