Privacy Policy

Last updated: August 26, 2026

This is the privacy policy for Rooted Coast Invoices, a product of Rooted Coast Design LLC, Bandon, Oregon. The short version: we collect what the product needs to work, we sell nothing, and your invoice data is yours.

What we collect

• Your account email and password hash, for signing in.
• The business details, client names and addresses, line items, and logo you enter, because that is what an invoice is made of.
• Subscription status from Stripe. Your card number never touches our servers.
• Basic technical logs (requests, errors) to keep the service running.
• When a share link is opened and how many times, so the person who sent it can see whether it has been read. We do not record who opened it.

What we do not do

• We do not sell or rent your data to anyone.
• We do not read your invoices except when you ask for support.
• We do not use advertising trackers.

Who processes data for us

The service runs on a small set of processors: Supabase (database and authentication), Stripe (payments), Resend (email, both our own account mail and the invoices, estimates and reminders you send to your clients), Upstash (rate limiting, which checks a visitor's IP address to slow down abusive traffic), and Vercel (hosting). Each receives only what its job requires.

Share links

Anyone with a share link can see that document. Links use long random tokens. The ordinary client link only opens documents you have sent. The separate preview link, the one you copy to show somebody before sending, will also open a draft, so only share it with people you mean to.

Retention and deletion

Your data stays until you delete it or ask us to. Email rootedcoastdesign@gmail.com from your account address and we will delete your account and its data.

Changes and contact

If this policy changes materially we will say so in the app or by email. Questions: rootedcoastdesign@gmail.com.