This page describes what Alculator does today, in plain terms, including what it does not have. It is kept in step with the privacy policy; if the two ever disagree, the policy governs.
Where your data lives
Your account, brands, markets, SKUs, pricing versions, share links and pricing requests are stored in a PostgreSQL database hosted by Supabase in the United States. Row-level security policies in the database itself — not only in the app — limit every row to the account that owns it, the teammates that account has invited, and the share or request links that account has created. Backups are managed by Supabase.
Accounts and sign-in
- Passwords are hashed by Supabase Auth; we never see them. The minimum length is 8 characters and passwords found in public breach lists are rejected.
- Sign in with Google is optional and requests only your email and basic profile.
- Email confirmation is required for new accounts; sign-in sessions are kept in your browser’s local storage, not in cookies, and expire.
- Team seats are per-workspace invitations. The owner can revoke a seat at any time.
Payments
Checkout and the billing portal are hosted by Stripe. Card numbers never reach Alculator; we store only Stripe’s customer and subscription identifiers, your plan and its status. Receipts and invoices come from Stripe.
Share links and request links
A share link shows a read-only snapshot of a brand’s pricing to anyone who has the link, with no login; a request link lets a supplier submit pricing to a distributor the same way. Both are bearer links: treat them like a document you emailed. You can revoke either at any time from the app, after which the link stops working.
In transit and at the edge
The site and the API are served over TLS only. The marketing site and app are static files on Netlify behind its CDN; the database and server functions are reached over HTTPS. Third-party libraries are loaded with subresource-integrity hashes, so a tampered copy is refused by the browser.
Analytics
We use Google Analytics to understand which pages and features are used. We do not run advertising, retargeting or ad-personalisation, and share-link and request-link tokens are stripped before any page view is recorded. Error reports sent to analytics redact tokens as well.
Who processes data on our behalf
The same list as in the privacy policy:
- Supabase — authentication (including sign-up confirmation and password-reset emails), database hosting, and server functions
- Stripe — payment processing and the subscription billing portal
- Resend — delivery of service emails (pricing-request and share-view notifications, team invitations, and payment-failure notices)
- Kit (ConvertKit) — our email list (only if you join it through a guide-download form)
- Google Analytics — usage analytics and error reports
- Google — optional sign-in with your Google account
- Netlify — website hosting and content delivery
- jsDelivr, cdnjs (Cloudflare), and Google Fonts — serve some of the site's code libraries and fonts; your browser requests these files directly, so these providers receive standard request data such as your IP address
Your data is yours
- Export a brand’s pricing as CSV on every plan, including Free; Excel and PDF on Pro and above.
- Delete brands, markets, SKUs and share links yourself in the app.
- Delete your account by writing to hello@alculator.io from your account address or via the contact page; we complete it within 30 days.
What we do not have yet
No SOC 2 report, no SSO/SAML, no uptime SLA, no custom data-processing agreement and no EU data residency. We say so here so you can decide with the facts; if one of these blocks you, tell us and we will tell you honestly whether and when it is coming.
Reporting a vulnerability
Email hello@alculator.io with the details. We acknowledge reports within one business day, do not pursue good-faith researchers, and credit fixes in the changelog if you want us to.