Privacy policy, Super Partner

The short version

This site uses Google Analytics. The application does not use anything. We do not sell your data, we do not advertise to you, and we do not contact your locations. Payment is handled by Stripe, so your card number never reaches us.

The longer version separates the two, because they genuinely are different. superpartner.app is this marketing site, which anybody can read. app.superpartner.app is the application you sign in to. What is measured on one is not measured on the other.

This site, superpartner.app

The marketing page carries Google Analytics 4, measurement id G‑TSQEBFHP9D. It tells us how many people read the page, roughly where in the world they were, and which page they came from. It is there so we know whether writing this site was worth the week it took.

The page you are reading now carries no tag at all, and neither do the other two documents. That is a decision rather than an oversight: the question on the marketing page is whether anybody read it, a privacy policy does not need to report who opened it, and this is the one page where being wrong about what it measures would be worst.

On the marketing page, Google sets its own identifiers in your browser. If you would rather it did not, a tracker blocker or Google's own opt out add on stops it, and nothing on this site breaks without it. These pages have no forms, no logins and no scripts of our own beyond the one that fires those events.

The typefaces come from Google Fonts, which means your browser makes a request to Google to fetch them. That is the only other thing this site loads from anywhere else.

The application, app.superpartner.app

The application carries no analytics at all. No Google Analytics, no product analytics, no session recording, no error reporting service, no advertising anything. There is no measurement id in it to find, and no script tag in its page beyond the application's own code. The desktop and phone builds are the same build, and they report nothing home either.

This is deliberate and it is worth saying why. The screens in this software show an operator's takings, his customer list and his commission terms. That is his book of business. Sending a stream of what he clicks on to a third party, so that we could look at a chart, is not a trade worth making.

There are no cookies. Not a banner you can dismiss, none. Signing in stores a bearer token on your own machine, which is how the application remembers you between screens: in localStorage in a browser tab and in the desktop window, and in Preferences on a phone, which is where iOS and Android keep a setting that is meant to survive. That is storage on your device, not something sent to anybody with every request by the browser, and signing out clears it. It also means there is no cross site request forgery surface here at all, which is the security half of the same decision.

If you are working with no signal, the collections you post are kept on the device until it can send them, in that same browser storage. They are your entries, waiting, and they go to your own account when the phone finds a network.

The web client loads its typefaces from Google Fonts, as this site does.

What we hold, and why

About you, the operator

Your business name, a handle for it, the name and email address of whoever we deal with, and notes about what was agreed with you, which is the place where "said he would pay after the season" has to live. Alongside that, what you bought and the dates: the plan, the tier, whether you pay monthly or yearly, and the date you are paid through.

About the people on your account

A username, a name, a role, and which routes they work. That is all a user account holds. It does not hold an email address or a phone number. Passwords are stored only as an argon2id hash and cannot be read back, by us or by anybody who took a copy of the database.

About your route

This is the bulk of it, and it is your operating records rather than ours: your locations with their addresses, your contacts at those locations with their names, phone numbers and email addresses, your machines and serials, your vehicles, your collections with their meter readings and the money, your commission terms, and what a location still owes against money you fronted it.

Five fields are held back from ordinary queries: the password hash, a location's federal and state tax identifiers, a vehicle's VIN and an insurance policy number. They have to be asked for by name, so no ordinary read of a location or a vehicle returns them. The failure that guards against is specific rather than theoretical: a stray query whose result got written to a log would otherwise put every password hash and every tax ID in that log, and logs get copied around in a way databases do not.

The application does not track anybody's location. A "location" in this software is a bar or a laundromat, not a coordinate. There is no GPS in it. It never asks for the position of a phone and it could not answer the question of where a driver is.

About your payment

The identifiers Stripe gives us for your customer record and your subscription, which plan you are on, whether you pay monthly or yearly, and the date you are paid through. Your name, email and billing address are given to Stripe at its own checkout page and are held by Stripe under its own privacy policy. We never receive a card number, because there is nowhere in this software that takes one: the checkout and the billing portal are both Stripe's pages, not ours.

Who else touches it

Stripe, for payment and subscriptions, and for calculating tax on the sale. It receives your name, email and billing address.
Google Analytics, on the marketing page of this site only, and not on these documents and not in the application.
Google Fonts, which serves the typefaces to your browser on both.
Hetzner Online GmbH, which rents us the servers, in its Helsinki, Finland data centre. It holds the disks the application runs on and nothing more: it is not given your data to do anything with.

That is the complete list. There is no email marketing platform, no customer relationship system, no advertising network and no error tracking service in any of this.

Where it is, and for how long

The hosted service runs on servers in Helsinki, Finland, rented from Hetzner Online GmbH. The business is in Florida and sells to operators in the United States; the machines are in the EU. On the self-hosted plan it runs wherever you put it, and none of your operating data reaches us at all; what we know about a self-hosted customer is that he pays us.

Your data stays while your account exists. An account that stops being paid for goes read only rather than being deleted, precisely so that the records are still there.

We keep it until you ask us to delete it, and then we delete it within thirty days. There is no retention clock and nothing removes an operator's records on a schedule, which is deliberate: collection history is the kind of record a business needs years later, and a timer nobody was watching would destroy it on the day it mattered. So the records of a closed account sit there read only and intact, and subscribing again finds them. Deletion is on request, it covers the account and everything in it, and you can ask at any time.

Asking us for something

Write to support@hyperspacemediagroup.com and ask for a copy of what we hold about you, for something to be corrected, or for your account and its data to be deleted. We will do it, by hand, for the reason above. Where you are asking on behalf of one of your own contacts, you are the person who holds that relationship and we will act on your instruction.

Depending on where you live you may have rights under a state privacy law over and above that. We do not sell personal information and we do not share it for cross context advertising, so the rights that concern selling do not arise.

Children

This is software for running a route. It is not for children and we do not knowingly collect anything from one.

Security

Passwords are hashed with argon2id at the parameters OWASP publishes, the connection is encrypted, sign in is a bearer token rather than a cookie, and the five fields above stay out of ordinary queries. One operator's data cannot be reached from another operator's session, and that is enforced by the layer that issues the queries rather than by each query remembering to ask: a read that does not know which operator it is for fails outright instead of answering with everything.

No one can promise a system cannot be broken into. If anything of yours were exposed we would tell you, and we would tell you what we knew rather than a sentence from a template.

Changes

If this policy changes in a way that matters, we will write to the address on the account rather than quietly editing the page.