Privacy Policy

PRIVACY POLICY (DRAFT — PENDING LEGAL REVIEW)

Draft date: August 18, 2026

This draft describes, factually, what the Recky platform collects and why, so
that a reviewed policy can be produced from it. It is not yet legal advice or
a finished policy.

1. WHAT WE COLLECT
- Account data: name, email address, and password credentials (passwords are
  stored only as hashes by our authentication provider, Supabase).
- Identity verification: government ID document checks are performed by Stripe
  Identity. Recky stores only the verification STATUS, never the documents.
- Phone numbers, verified by one-time SMS codes (delivered via Twilio Verify).
- Booking, facility and payment activity. Card payments are processed by
  Stripe; Recky does not store card numbers.
- Electronic signature records for facility documents: signature, name, IP
  address, browser user-agent and timestamps, retained as an audit trail.
- Product analytics and session replay via PostHog, proxied through our own
  domain. Text content and form inputs are masked by default in replays.

2. WHAT WE DO NOT DO
- We do not sell personal data.
- We do not purchase, rent or import phone-number lists.

3. PROCESSORS
Supabase (database and authentication), Stripe and Stripe Identity (payments,
identity verification), Twilio (SMS delivery), PostHog (analytics and session
replay), Vercel (hosting), Resend (transactional
email).

4. YOUR CHOICES
Contact hello@recky.app to access, correct or delete your data, or to object
to analytics. Deleting an account preserves records we are legally required to
retain (for example, signed documents and payment records).

5. CONTACT
Recky, LLC — hello@recky.app